leaked-key-impact

The problem

Most data on how fast leaked credentials get exploited comes from generic honeypots or vendor reports with an incentive to overstate the risk. I wanted my own numbers: how long does it actually take for someone to find and use a public AWS key? I built the experiment from scratch, with my own infrastructure and real logging from minute one.

The data

5 IAM keys with minimal permissions (iam:GetUser exclusively), distributed across channels with different audiences and visibility: GitHub, Pastebin and security forums. Full CloudTrail logging with no prior filtering. 1,301 API events captured over 33 days of active monitoring.

Approach

• Deliberately null permissions: the keys could not do anything useful, only authenticate — attacks are real but cost risk is zero
• CloudTrail logging exported to S3, processed and normalised in Python (pandas + geopandas)
• OSINT enrichment per IP: geolocation, ASN lookup, identification of known VPN providers and proxies
• User-agent fingerprinting to distinguish automated tools from manual access
• Mapping each observed technique to MITRE ATT&CK (TA0006 Credential Access, TA0009 Collection)
• Counterfactual cost model: what it would have cost in dollars if the keys had production permissions
• Streamlit dashboard with interactive timeline, geographic breakdown and technique classification

Tools

python

aws

streamlit

Result

The first attempt arrived in under 2 minutes from publication. 80% of the 1,301 attacks occurred within the first 24 hours — the subsequent decay is sharp and predictable. The most frequent origin was cloud provider IP ranges (EC2, GCP Compute), not residential machines. Simulated cost with real production permissions: $6,187/day.