Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

161–170 of 187 posts

Re: Bucketsquatting is finally dead

#161

Post by cyberpunk »

mhurron wrote: post #123
a2tech wrote: post #94

Earlier quoted context omitted.

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

Amazons assistance for account issues to organizations if an employee did anything individually is honestly horrible. They treat it like the organization is attempting to commandeer someone else's account so all the privacy protections you expect for your own stuff is applied no matter how much you can prove it is not some other individuals account. The best part is the billing issues that arise from that. In your ex…

While true, the engineer would have to be a weapons grade tit to get themself in such legal trouble, and honestly deserves whatever criminal charges comes their way.

Re: Bucketsquatting is finally dead

#162

Post by a2tech »

mcherm wrote: post #133
dixie_land wrote: post #128

Earlier quoted context omitted.

I named random Joe as the sole owner of "my" bank account and the bank wouldn't allow me to access "my" money!

That's not an equivalent analogy. A better analogy would be to say I had a bank account and I told my bank to call up Joe on the phone when confirmations were needed. I still have the account, but I have fallen out with Joe. I want the bank to call somebody else, but they refused to do so, even though it's my account and I'm paying the bill for it!

And we're paying extra for support!

Re: Bucketsquatting is finally dead

#163

Post by nightpool »

kevin_thibedeau wrote: post #102
a2tech wrote: post #94

Earlier quoted context omitted.

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

This is why you either issue corporate phones or key dongles.

when your startup is three employees and only one technical? this person created their AWS root account, I think it's fair to assume that he's their first engineer and probably first employee

Re: Bucketsquatting is finally dead

#165

Post by jorams »

brnt wrote: post #87
josephg wrote: post #30

Sometimes I wonder if package names, bucket names, github account names and so on should use a naming scheme like discord. Eg, @sometag-xxxx where xxxx is a random 4 digit code. Its sort of a middleground between UUID account names and completely human generated names. This approach goes a long way toward democratizing the name space, since nobody can "own" the tag prefix. (10000 people can all share it). This can al…

The .NL gTLD used to work like that for personal registrations (ie individuals without a business registration). $name.NNN.nl where you were allowed to choose the number. It won't surprise you the scheme never caught on and has been decommissioned (you can now register any available domain as an individual as well). The difference is probably few people use a personal TLD, but many use a name on some social media.

Small correction: .nl is a ccTLD, or country code TLD. Not a gTLD, or generic TLD.

Re: Bucketsquatting is finally dead

#166

Post by nulltrace »

ethanrutherford wrote: post #158
lcnPylGDnU4H9OF wrote: post #83

Earlier quoted context omitted.

If they can't make the bucket before you do then they are not "bucket squatting", and they can't do so for a salted and hashed bucket name without knowing the salt at runtime. The public/private distinction seems moot here, too: the salt is a throwaway since you just need the bucket name. Even if you do need to keep track of the salt, it should be safe for the attacker to know, at least with respect to this attack, b…

The "squatting" part of "bucket squatting" is a bit of a misnomer here. The attack vector is actually in the opposite direction. 1. You set up an aws bucket with some name (any name whatsoever). 2. You have code that reads and/or writes data to the bucket. 3. You delete the bucket at some later date, but miss some script/process somewhere that is still attempting to use the bucket. For the time being, that process li…

Seen this happen with Terraform. One team tears down a stack, bucket gets deleted, but another stack still has the name hardcoded in an output. Next CI run uploads artifacts to a bucket name that's now up for grabs. You only notice when deploys start failing. Or worse, succeeding against someone else's bucket.

Re: Bucketsquatting is finally dead

#167

Post by hluska »

kstrauser wrote: post #108
shmolyneaux wrote: post #101

Earlier quoted context omitted.

That seems like a GDPR violation waiting to happen. It shouldn't be possible for them to store an email address like that forever and be in compliance.

If user foo@gmail.com violates our ToS and I suspend them, I can keep that email address forever to keep them from signing up again. They can’t just say “GDPR! You have to forget me, tee-hee!”

Any reason you won’t just use a hash?

Re: Bucketsquatting is finally dead

#168

Post by rob-olmos »

a2tech wrote: post #94
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

Is the AWS account phone number also their phone and not the business/corp phone? And you tried the dedicated lost MFA device form?

Re: Bucketsquatting is finally dead

#169

Post by [deleted] »

mhurron wrote: post #123
a2tech wrote: post #94

Earlier quoted context omitted.

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

Amazons assistance for account issues to organizations if an employee did anything individually is honestly horrible. They treat it like the organization is attempting to commandeer someone else's account so all the privacy protections you expect for your own stuff is applied no matter how much you can prove it is not some other individuals account. The best part is the billing issues that arise from that. In your ex…

[deleted]

Re: Bucketsquatting is finally dead

#170

Post by icedchai »

SoftTalker wrote: post #127

DNS names have the same problem. Once they are not renewed, they eventually become available again. Then anyone can re-register them, set up an MX record, and start receiving any emails still being sent to recipients in that domain. This could include password reset authentications for other services, etc.

Yup. You can get control of valuable assets this way, like legacy IPv4 blocks.
Post reply on HN