How to Investigate Abnormal Billing Increase in AWS SNS

DevOps AWS
#1

[SNS]

Hello everybody. Hope you’re doing great.
I noticed an abnormal billing increase in the SNS service. Looks like a “hacking” because billing shows thousands of SMS’s to France

I noticed all the Cloudwatch logs and I got even the number where the subscription was made
Cloudtrail just shows which user had the sns permissions, which services used sns but does not show why the SMS were sent to France or how.

How could I get more insights regarding this issue?

Is there any service where I could dive deeper?

Looking forward to your response.

Thanks in advance!

#2

First thing I would check is if your devs have some hard coded “test” number, especially if they’re all to the same number in France

#3

Like in the US testing it’s common to see something like tel:5555555555|555-555-5555 as a place holder for testing

#4

Could also be someone spun up a phone number for testing, like a virtual number in twilio, mailosaur, etc

#5

If you’re very confident it’s a compromise I would immediately contact your AWS rep and any internal security resources you have access to

#6

Better safe than sorry and this could be an all hands on deck kind of issue if it really is an account compromise

#7

Here’s also a blog post that may help you get more details about the messages
https://repost.aws/knowledge-center/monitor-sns-texts-cloudwatch|https://repost.aws/knowledge-center/monitor-sns-texts-cloudwatch

#8

Thanks a lot for your help

#9

Interested to hear updates when you figure it out