In this work, we analyze to what extent actors target poorly-secured cloud storage buckets for attack. We deployed hundreds of AWS S3 honeybuckets with different names and content to lure and measure different scanning strategies. Actors exhibited clear preferences for scanning buckets that appeared to belong to organizations, especially commercial entities in the technology sector with a vulnerability disclosure program. Actors continuously engaged with the content of buckets by downloading, uploading, and deleting files. Most alarmingly, we recorded multiple instances in which malicious actors downloaded, read, and understood a document from our honeybucket, leading them to attempt to gain unauthorized server access.

The Internet Routing Registry (IRR) is a set of distributed databases used by networks to register routing policy information and to validate messages received in the Border Gateway Protocol (BGP). First deployed in the 1990s, the IRR remains the most widely used database for routing security purposes, despite the existence of more recent and more secure alternatives. Yet, the IRR lacks a strict validation standard and the limited coordination across different database providers can lead to inaccuracies. Moreover, it has been reported that attackers have begun to register false records in the IRR to bypass operators' defenses when launching attacks on the Internet routing system, such as BGP hijacks. In this paper, we provide a longitudinal analysis of the IRR over the span of 1.5 years. We develop a workflow to identify irregular IRR records that contain conflicting information compared to different routing data sources. We identify 34,199 irregular route objects out of 1,542,724 route objects from November 2021 to May 2023 in the largest IRR database and find 6,373 to be potentially suspicious.

While the computer science community has explored the importance of Undergraduate Research Experiences (UREs) and, separately, collaboration in computing (e.g. pair programming), little research has studied collaboration in the context of a URE. We performed a qualitative thematic analysis of how students collaborate within a group-structured, academic-year, inclusive computing URE catered towards second-year students at two large public research universities in the United States. We analyzed free-response and Likert-scale survey data collected early and late in the program from a total of 106 students who comprised three program cohorts. We studied their overall group function, what aspects of group work led to positive or negative group experiences, how their group affected their feelings of being supported, and how their group affected their sense of belonging in computing. We found that group experiences were overwhelmingly positive. Further, we found that students’ experiences in groups centered around three themes: group fit and belonging, emotional and academic support, and logistics. Within each theme, their experiences were rich and nuanced, and we observed variations by gender, and to a lesser degree by race. Our work suggests that group-structured UREs are both feasible and beneficial for students, and we give concrete suggestions for how to make these experiences successful.

While Autonomous Systems (ASes) are crucial for routing Internet traffic, organizations that own them are little understood. Regional Internet Registries (RIRs) inconsistently collect, release, and update basic AS organization information (e.g., website), and prior work provides only coarse-grained classification. Bootstrapping from RIR WHOIS data, we build ASdb, a system that uses data from established business intelligence databases and machine learning to accurately categorize ASes at scale. ASdb achieves 96% coverage of ASes, and 93% and 75% accuracy on 17 industry categories and 95 sub-categories, respectively. ASdb creates a more rich, accurate, comprehensive, and maintainable dataset cataloging AS-owning organizations. This system, and resulting dataset, will allow researchers to better understand who owns the Internet, and perform new forms of meaningful analysis and interpretation at scale.