Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

111–120 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#111

Post by corytheboyd »

ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

Everyone here throwing down the “technically not a secret” card but I don’t think that was your point. I guess “sensitive, but not secret” is the right way to say it. They’re obviously not secret like credentials, but it’s a damn good piece of info for an attacker to hold against you, because, like you said, it’s impossible to rotate, but is tangentially related to every single part of your AWS infrastructure (per-account of course).

Re: How to find the AWS account ID of any S3 bucket

#112

Post by corytheboyd »

Uehreka wrote: post #51
INTPenis wrote: post #35

Earlier quoted context omitted.

It's valuable info to any pentester. Security by obscurity is still one layer of security.

But there’s a reason people advise against security by obscurity: the obscurity can go away at any time and once it does it’s unrecoverable. So sure, maybe pat yourself on the back today that on top of your other measures, no one outside your org and AWS knows your Account ID. But if it gets out at some point, those other measures should be foiling your pentesters on their own. In fact, to better test that this is th…

When obscurity is the only option, like opting not to expose AWS account ID, why not do it? Don’t think this should be conflated with replacing proper security with obscurity, which is obviously wrong. The less you expose about your operation, the better. Not exposing details of your infrastructure to the public is another commonly suggested best practice that is obscurity, not security, that nobody challenges. For example, cleaning up common default response headers for things like cloud front.

Re: How to find the AWS account ID of any S3 bucket

#113

Post by evandale »

laserlight wrote: post #38
abadpoli wrote: post #31

Earlier quoted context omitted.

It’s not defense in depth to build your security model off of false assumptions, it’s just bad security.

I don't understand your reasoning. Neither my name nor where I live nor my phone number nor my license plate are secrets. Yet I don't go around wearing a t-shirt with my personally identifying information printed on it. What am I missing?

This is posted in other places but Amazon explicitly says they're not secret, sensitive, or confidential.

https://docs.aws.amazon.com/accounts/latest/reference/manage...

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information.

Re: How to find the AWS account ID of any S3 bucket

#114

Post by evandale »

kube-system wrote: post #103
junon wrote: post #48

Earlier quoted context omitted.

If you place any sort of security assumptions on AWS account IDs into your threat model, you're effectively directly introducing a security vulnerability. If you're not then why include it into your security threat model to begin with? I believe that is their point. Since AWS does not, and has never, treated that information as secret, then there is absolutely no reason to consider it sensitive because there is no se…

This is a false dichotomy. There is a deep chasm between "publish everything", and "this is a secret", called operational security. Any time a topic like this comes up, there are people on this forum that try to apply the "security by obscurity does not work" principle to every security topic under the sun, when in reality, that principle really only applies to the world of cryptography. In meat space, where humans o…

How is it possible for a user of AWS to keep the account ID secret if Amazon doesn't even consider it secret? If Amazon leaked your account ID they could point to their docs and say the account ID was never meant to be a secret, sensitive, or confidential.

Re: How to find the AWS account ID of any S3 bucket

#115

Post by evandale »

corytheboyd wrote: post #111
ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

Everyone here throwing down the “technically not a secret” card but I don’t think that was your point. I guess “sensitive, but not secret” is the right way to say it. They’re obviously not secret like credentials, but it’s a damn good piece of info for an attacker to hold against you, because, like you said, it’s impossible to rotate, but is tangentially related to every single part of your AWS infrastructure (per-ac…

It's not even sensitive or confidential though, Amazon says that themselves in their docs.

Re: How to find the AWS account ID of any S3 bucket

#116

Post by kube-system »

Uehreka wrote: post #51
INTPenis wrote: post #35

Earlier quoted context omitted.

It's valuable info to any pentester. Security by obscurity is still one layer of security.

But there’s a reason people advise against security by obscurity: the obscurity can go away at any time and once it does it’s unrecoverable. So sure, maybe pat yourself on the back today that on top of your other measures, no one outside your org and AWS knows your Account ID. But if it gets out at some point, those other measures should be foiling your pentesters on their own. In fact, to better test that this is th…

Unfortunately, until humans have crypto modules installed in their brains, we will have to rely on some form of "security by obscurity" that many colloquially call "operational security".

Yes, there are types of data and metadata about your company's infrastructure that can be used against you. But no, you shouldn't hand it to attackers on a silver platter.

> In fact, to better test that this is the case, you should probably give the pentesters your account ID so you can be informed regarding your security in this scenario.

That depends on the scope of the test. Many organizations will do both (and others) to test different layers of security. Remote software exploits are something that many people on this forum are concerned about, but that is hardly the be-all-end-all of security for an organization. There's a lot of security topics entirely outside the scope of computer systems to be cognisant about here.

Re: How to find the AWS account ID of any S3 bucket

#117

Post by evandale »

corytheboyd wrote: post #112
Uehreka wrote: post #51

Earlier quoted context omitted.

But there’s a reason people advise against security by obscurity: the obscurity can go away at any time and once it does it’s unrecoverable. So sure, maybe pat yourself on the back today that on top of your other measures, no one outside your org and AWS knows your Account ID. But if it gets out at some point, those other measures should be foiling your pentesters on their own. In fact, to better test that this is th…

When obscurity is the only option, like opting not to expose AWS account ID, why not do it? Don’t think this should be conflated with replacing proper security with obscurity, which is obviously wrong. The less you expose about your operation, the better. Not exposing details of your infrastructure to the public is another commonly suggested best practice that is obscurity, not security, that nobody challenges. For e…

You can't keep it secret because Amazon doesn't keep it secret.

So if Amazon doesn't keep the account ID a secret how can you as a user of Amazon be expected to keep your account ID secret? There's no way for you to stop Amazon from exposing it.

Re: How to find the AWS account ID of any S3 bucket

#118

Post by corytheboyd »

evandale wrote: post #115
corytheboyd wrote: post #111

Earlier quoted context omitted.

Everyone here throwing down the “technically not a secret” card but I don’t think that was your point. I guess “sensitive, but not secret” is the right way to say it. They’re obviously not secret like credentials, but it’s a damn good piece of info for an attacker to hold against you, because, like you said, it’s impossible to rotate, but is tangentially related to every single part of your AWS infrastructure (per-ac…

It's not even sensitive or confidential though, Amazon says that themselves in their docs.

I guess I disagree with the AWS documentation then. It should be treated as a sensitive piece of information that should not be exposed to the public. It’s not going to bring you down if it’s leaked, but it could be used along with other leaked info over years in more sophisticated attacks. Why risk it is more the point.

Re: How to find the AWS account ID of any S3 bucket

#119

Post by corytheboyd »

evandale wrote: post #117
corytheboyd wrote: post #112

Earlier quoted context omitted.

When obscurity is the only option, like opting not to expose AWS account ID, why not do it? Don’t think this should be conflated with replacing proper security with obscurity, which is obviously wrong. The less you expose about your operation, the better. Not exposing details of your infrastructure to the public is another commonly suggested best practice that is obscurity, not security, that nobody challenges. For e…

You can't keep it secret because Amazon doesn't keep it secret. So if Amazon doesn't keep the account ID a secret how can you as a user of Amazon be expected to keep your account ID secret? There's no way for you to stop Amazon from exposing it.

You as a user of Amazon can do whatever you want though, including being careful about which pieces of information you elect to expose publicly. If it’s up to you, why choose to expose it, when you can choose NOT to? Just because this reverse search of bucket to account id exists doesn’t mean you should begin to expose your account id on your own.

Re: How to find the AWS account ID of any S3 bucket

#120

Post by evandale »

corytheboyd wrote: post #119
evandale wrote: post #117

Earlier quoted context omitted.

You can't keep it secret because Amazon doesn't keep it secret. So if Amazon doesn't keep the account ID a secret how can you as a user of Amazon be expected to keep your account ID secret? There's no way for you to stop Amazon from exposing it.

You as a user of Amazon can do whatever you want though, including being careful about which pieces of information you elect to expose publicly. If it’s up to you, why choose to expose it, when you can choose NOT to? Just because this reverse search of bucket to account id exists doesn’t mean you should begin to expose your account id on your own.

You can't choose NOT to expose it because you can't stop Amazon from exposing it.

Amazon says it's not secret, so it's not secret. They make no attempts or guarantees to keep it secret so there's always the threat that Amazon themselves can expose it on your behalf. You can't stop that no matter how wrong you think it is.

Post reply on HN