I consider anything that's not public knowledge to be a secret. When possible, try not to come up with anything that's guessable. I randomize even DB usernames in Terraform, not just the passwords. I do the same with schema names, etc. This requires sweat and tears, but it's always worth it. WordPress sucks, but the idea to have a custom table name prefix is not random, but a security consideration. But don't prefix field names the same way, please! :D
Well, it's just an AWS Account ID
11–20 of 36 posts
Re: Well, it's just an AWS Account ID
#12This seems wrong. Surely you can’t “Enumerate IAM Entities” with just the aAccount ID? So if a company has a user for every dev with username first.last, you could list all devs just by knowing the Account ID? Maybe the author misunderstood what “enumerate” means and meant to say that you can check if a given IAM entity exists under the account? Enumeration and bruteforce are very different things.
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
And then what?
Re: Well, it's just an AWS Account ID
#13This seems wrong. Surely you can’t “Enumerate IAM Entities” with just the aAccount ID? So if a company has a user for every dev with username first.last, you could list all devs just by knowing the Account ID? Maybe the author misunderstood what “enumerate” means and meant to say that you can check if a given IAM entity exists under the account? Enumeration and bruteforce are very different things.
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
A.k.a. .. enumeration.
Re: Well, it's just an AWS Account ID
#14Earlier quoted context omitted.
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
A.k.a. .. enumeration.
No, enumeration would be if you can get the entire list of usernames somehow.
Re: Well, it's just an AWS Account ID
#15Earlier quoted context omitted.
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
And then what?
Send targeted phishing mails.
Re: Well, it's just an AWS Account ID
#16Earlier quoted context omitted.
A.k.a. .. enumeration.
No, enumeration would be if you can get the entire list of usernames somehow.
> No, enumeration would be if you can get the entire list of usernames somehow.
It's still a form of enumeration.
Once you know the generation scheme, you can always enumerate some form, perfect or otherwise.
Re: Well, it's just an AWS Account ID
#17Earlier quoted context omitted.
No, enumeration would be if you can get the entire list of usernames somehow.
> No, enumeration would be if you can get the entire list of usernames somehow. It's still a form of enumeration. Once you know the generation scheme, you can always enumerate some form , perfect or otherwise.
If there are rate limits, or if the search space is vast, this is notably more limited (even if arguably still enumeration)
Re: Well, it's just an AWS Account ID
#18Not an expert on AWS, but as this seems something that you may need to share and that cannot be easily changed, considering it a secret is just snake oil.
Re: Well, it's just an AWS Account ID
#19Not an expert on AWS, but as this seems something that you may need to share and that cannot be easily changed, considering it a secret is just snake oil.
> ...considering it a secret is just snake oil.
I'd think of it as more a defence in depth measure. It's not a secret, but taking some common sense steps to not spray it all over the place could slow down an attacker, and a lot of the time just making yourself a slightly harder target than the next guy is enough that an attacker will go in search of softer targets.
Re: Well, it's just an AWS Account ID
#20Not an expert on AWS, but as this seems something that you may need to share and that cannot be easily changed, considering it a secret is just snake oil.
As the author writes: it's not a secret, anymore than your house adresse is, but it allows a burglar to recon and plan an attack