Service Hijacking, Denial of Service & Economic DoS in the Cloud

Service Hijacking: Owning the Account, Not the Application

Service hijacking occurs when an attacker gains control of a cloud service account and uses it for malicious purposes — cryptomining, data exfiltration, launching attacks on third parties, or holding resources for ransom.

Unlike traditional account takeover, cloud service hijacking gives the attacker access to an entire suite of services (compute, storage, databases, DNS, email) under a single compromised identity.

Credential Exposure Vectors

Cloud credentials end up in the wrong hands through predictable channels:

Vector	Example	Control
Hardcoded in source code	AWS key in GitHub repository	Secret scanning (truffleHog, GitGuardian); use IAM roles instead
Environment variable leakage	.env file committed or exposed via SSRF	Secrets Manager / Parameter Store; never commit .env
CI/CD pipeline exposure	Build logs printing AWS_SECRET_ACCESS_KEY	Masked variables; restrict log access
Phishing	Fake AWS console login page	MFA; hardware security keys
Stolen session cookies	Browser session token exfiltrated via XSS	HTTPOnly/Secure cookies; short session lifetimes
Overly permissive cross-account roles	Role with sts:AssumeRole open to *	Restrict Principal to specific accounts and services

GitHub is an open-source credential dump. Automated scanners continuously search public repositories for AWS access keys, Azure credentials, and GCP service account JSON files. A key committed for even 30 seconds can be harvested. AWS has a partnership with GitHub to detect and auto-revoke exposed keys — but detection lag can still result in damage.

Denial of Service in the Cloud

Traditional volumetric DDoS attacks target bandwidth and connection tables. In cloud environments, additional attack surfaces emerge:

• API rate-limit exhaustion: Flooding management APIs to prevent legitimate provisioning
• Auto-scaling abuse: Triggering expensive compute resources via crafted workload spikes
• Lambda cold-start flooding: Generating concurrent invocations to overwhelm function concurrency limits

Cloud providers offer native DDoS mitigation:

• AWS Shield Standard: Free, automatic protection for all AWS resources
• AWS Shield Advanced: $3,000/month; includes DDoS cost protection and 24/7 DDoS Response Team
• Azure DDoS Protection Standard, GCP Cloud Armor: Equivalent offerings

Economic Denial of Sustainability (EDoS)

EDoS is the cloud-specific evolution of DoS. Instead of crashing a service, the attacker makes it financially unsustainable to operate.

How EDoS Works

1. Attacker crafts requests that trigger expensive operations (large media transcoding, ML inference, storage writes)
2. Auto-scaling provisions additional resources to meet demand
3. The legitimate organisation receives a bill for thousands of dollars for compute they did not intend to use
4. If the attack persists, the organisation may be forced to shut down the service or restrict access — achieving the attacker goal without any downtime

EDoS Mitigation Controls

Control	Implementation
Billing alerts	Set AWS Budget alerts at 50%, 80%, 100% of expected spend
Auto-scaling caps	Maximum instance count prevents runaway growth
WAF rate limiting	Block IPs exceeding request thresholds
CAPTCHA for expensive operations	Gate transcoding, ML inference behind human verification
Spot instance termination guards	Avoid billing spike from on-demand fallback
Cost anomaly detection	AWS Cost Anomaly Detection; Azure Cost Management alerts

Key Takeaway

Service hijacking and EDoS attack the business model of cloud computing — they exploit elasticity and shared-billing to create financial and operational harm without traditional exploitation. Credential hygiene, billing visibility, and auto-scaling guardrails are the primary defences.