Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

151–160 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#151

Post by firebaze »

thenickdude wrote: post #125

Related: AWS key IDs (not the secret key part) include your account ID within them, bitshifted by one position: https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f... These key IDs are included in the URL for pre-signed links to S3, so there's a good chance you've already been publishing your account ID.

Quite a few people in this thread assume that the AWS key id is part of a "security by obscurity" "protection in depth".

This will probably be downvoted, but if you read this anyway: this is a good example of why "security by obscurity" is not a good defense. You will overlook something (a determined attacker will not)

Anything non-"security by obscurity" does not depend on you understanding something or not - it will apply, no matter what, as long as the attacker hasn't a genius on payroll which cracks e.g. AES-256 just so (https://www.youtube.com/watch?v=KEkrWRHCDQU)

Re: How to find the AWS account ID of any S3 bucket

#153

Post by INTPenis »

Uehreka wrote: post #51
INTPenis wrote: post #35

Earlier quoted context omitted.

It's valuable info to any pentester. Security by obscurity is still one layer of security.

But there’s a reason people advise against security by obscurity: the obscurity can go away at any time and once it does it’s unrecoverable. So sure, maybe pat yourself on the back today that on top of your other measures, no one outside your org and AWS knows your Account ID. But if it gets out at some point, those other measures should be foiling your pentesters on their own. In fact, to better test that this is th…

Doesn't change the fact that security by obscurity is a layer of security. It's not a good layer, it's not one you should depend on, but it is a layer that causes problems for attackers.

Re: How to find the AWS account ID of any S3 bucket

#155

Post by denysvitali »

NovemberWhiskey wrote: post #136

There seems to be a large discussion of whether account IDs are "secret" or "private" or "confidential" or whatever. From my point of view, that entirely misses the point. The problem here is that what's revealed here is the relationship between buckets and account IDs, which allows discovery of shared ownership of buckets (unless you use a micro-account approach). I probably don't care if you can discover that 23432…

Accounts on AWS are pretty cheap (free?) - why would you host everything on the same account?

Re: How to find the AWS account ID of any S3 bucket

#156

Post by lijok »

ITT lots of debate on whether AWS Account IDs are sensitive or not. To chime in my 2c; we've had this debate in multiple orgs with different security teams and the outcome has always been the same; they're not and it's counterproductive to your security posture to treat it as privileged information. Humans have a nasty habit of placing trust in people who have access to privileged information.

"Hi, this is Tom from AWS, I need to speak with you about your account 5923965523" - as a social engineering primer garners significantly different levels of trust from the target depending on whether the target perceives the account ID to be privileged information.

Re: How to find the AWS account ID of any S3 bucket

#157

Post by mfenniak »

nerdjon wrote: post #105
emilburzo wrote: post #33

Earlier quoted context omitted.

If you use AWS config setup for the organization (aggregator), you'll get a athena-sql-queryable inventory of all your resources from all organization accounts. So finding out which account owns a resource can be as simple as, roughly: select accountId where arn = "x"

... how did I not know this existed. That is exactly how we are setup, the amount of time I just spent going account by account looking for a specific resource. Thank you! I have long wondered why it didn't exist, and apparently it did...

Be aware that AWS Config is not free. https://aws.amazon.com/config/pricing/

Re: How to find the AWS account ID of any S3 bucket

#160

Post by darkwater »

supriyo-biswas wrote: post #57
jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

This is because, I assume, the AWS policy execution has a number of “operators” and “operands”, and in this case, you’re using the StringLike operand on the account ID string. Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] now, although other types of side channels such as speculative execution side channels on CPUs (Meltdown, Spectre) already made waves at the ti…

> Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1]

We, the DevOps people, already knew about side channel attacks, Spectre and the likes, evaluated the performances hit for the fixes (or alleged fixes), patched our kernel boot params etc etc. We are curious people, just like many here.

Post reply on HN