Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

181–190 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#181

Post by quickthrower2 »

SamuelAdams wrote: post #142
sylens wrote: post #39

While I wouldn't publicly hand out my account IDs as a general practice, I think you have to expect that some of them will be disclosed at some point. As more third party vendors and SaaS platforms move away from IAM users and access keys to using role assumption as the preferred method of integration (as they should!), the account ID of at least the account you use as their integration point is now known by another…

This is what I’m curious to learn. What can an attacker do with an AWS account ID? How is that any different from knowing someone’s email address?

Useful social engineering datapoint

Re: How to find the AWS account ID of any S3 bucket

#182

Post by nine_k »

twoodfin wrote: post #62
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

Bucketing them by prefix of the end-user ID is not exactly smart.

Either you bucket by an internal ID and give the user a hash, or you give the user an ID and bucket by your internal hash.

Users have no business knowing your sharding scheme.

Re: How to find the AWS account ID of any S3 bucket

#183

Post by paulddraper »

jameshart wrote: post #176
paulddraper wrote: post #126

Earlier quoted context omitted.

> the AWS policy execution has a number of “operators” and “operands” That is correct. The IAM condition language is flexible and does not prevent you from doing strange things.

It’s a consequence of weak typing choices - not an inevitable result of allowing flexibility. Doing glob matching on account IDs is like doing concatenation with guids, applying a bitshift to a UTF8 string, or running a regex on an integer. It is a nonsensical operation, and - as shown here - results in surprising security properties of the resulting system. Surprising security properties are an undesirable result in…

Of course it's possible to create a more sophisticated system with less possibility for user error.

Re: How to find the AWS account ID of any S3 bucket

#184

Post by jimmalongading »

I apologize in advance for what Im going to say here.

AWS account ID is not sensitive data in any way. Just because you can screw up a config doesnt make a user name or account id “sensitive”.

Its not more sensitive than an email address. What is wrong with you people? Where did you come from, and why are you so dumb?

Re: How to find the AWS account ID of any S3 bucket

#185

Post by gusmd »

corytheboyd wrote: post #108
ed wrote: post #47

How might this matter? A obvious one: Given a production bucket, it’s now possible to find development buckets for that same org, which is not expected behavior IMO.

You only need the bucket name to do that. You should include a randomly generated prefix/suffix in bucket names to prevent against such enumeration attempts. Another good idea (as well as, not instead of) is to expose objects in buckets publicly with a non-default host name, such that the bucket name isn’t leaked at all.

Or, for read scenarios, putting a CloudFront distribution in front of the bucket!

Re: How to find the AWS account ID of any S3 bucket

#186

Post by abadpoli »

Dylan16807 wrote: post #94
abadpoli wrote: post #81

Earlier quoted context omitted.

If an organization considers it sensitive, that implies they’re putting some level of reliance on it being so. Otherwise there would be no point in considering it sensitive. There’s a difference between “making it easier for an attacker” and using it as a security control, even if it’s not the only security control. The point is that even if you don’t go around wearing a shirt with your address on it, that should nev…

It's hubris to think any security measures are completely safe. Painting a target is a bad idea.

You’re still misunderstanding. I’m not saying you should go “paint a target” on yourself, I’m saying you should assume _someone else is_ going to paint a target on you, and defend yourself accordingly, rather than acting like the lack of a target protects you in any way.

Re: How to find the AWS account ID of any S3 bucket

#187

Post by abadpoli »

kube-system wrote: post #121
evandale wrote: post #114

Earlier quoted context omitted.

How is it possible for a user of AWS to keep the account ID secret if Amazon doesn't even consider it secret? If Amazon leaked your account ID they could point to their docs and say the account ID was never meant to be a secret, sensitive, or confidential.

You can walk over to the user's desk and ask them not to share it. Whether or not Amazon leaks it is unrelated to my employees' ability to follow instructions. There is a lot of data that exists in a space somewhere between "100% secret" and "100% public". This is one of those situations, for many organizations.

You’re wasting your employees time by asking them to keep it secret, when you gain absolutely no benefit from keeping it secret (and in fact are introducing an easy failure point by pretending it’s secret) and you have no guarantees that others are keeping it secret.

> This is one of those situations, for many organizations.

And those organizations are wrong.

Re: How to find the AWS account ID of any S3 bucket

#188

Post by dotancohen »

victorbjorklund wrote: post #71
RajT88 wrote: post #32

Will it make it easier to identify the operators of malvertising campaigns hosted on AWS?

Doubt they use their real information on their AWS accounts.

Just need enough information to send to either Amazon or the FBI.

Re: How to find the AWS account ID of any S3 bucket

#189

Post by derefr »

rtkwe wrote: post #124
derefr wrote: post #75

Earlier quoted context omitted.

I think the GP is talking about granting access to a particular bucket to an unbounded number of customer AWS accounts — probably in requester-pays config. (Think: static data used by an Amazon Marketplace virtual appliance.)

Those wouldn't follow any particular partial pattern though would they?

They don't need to — in fact, you might be depending on them not following any particular pattern. Think: treating the Account IDs as pre-hashed keys, and then specifying prefix patterns as ways of sharding the hash keys onto a set of buckets, to evenly distribute access (and therefore traffic) by customer.
Post reply on HN