Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

171–180 of 187 posts

Re: Bucketsquatting is finally dead

#171

Post by kstrauser »

hluska wrote: post #167
kstrauser wrote: post #108

Earlier quoted context omitted.

If user foo@gmail.com violates our ToS and I suspend them, I can keep that email address forever to keep them from signing up again. They can’t just say “GDPR! You have to forget me, tee-hee!”

Any reason you won’t just use a hash?

Yep. Almost every company uses multiple vendors for things. Suppose you use a tech support helpdesk and you don't want to waste time dealing with banned ex-customers. You can't import that list of hashes into Zendesk or whatever and tell them to blocklist them.

Substitute "billing company" or "authentication provider" or "fraud detector" for "helpdesk". There are times when it's not sufficient to say "don't do business with SHA-256 hash ef61a579c907bbed674c0dbcbcf7f7af8f851538eef7b8e58c5bee0b8cfdac4a". You need to say "John Smith is banned".

Re: Bucketsquatting is finally dead

#173

Post by wizzwizz4 »

kg wrote: post #141
throwaway173738 wrote: post #62

Earlier quoted context omitted.

I’m pretty sure Azure was built out with Hyper-V, which was built into the Windows kernel. So everything that relied on virtualization would’ve had bizarre case insensitivity and naming rules. I’ve lost track of servers in Azure because the name suddenly changed to all uppercase ave their search is case sensitive but whatever back-end isn’t.

Isn't case insensitivity a Win32 thing only? I would not expect it to impact stuff in Hyper-V or the windows kernel. AFAIK for example NTFS is case-sensitive.

NTFS supports case-sensitivity, but if you have case-sensitive distinctions in a directory that's marked case-insensitive, bad things happen. (Those bad things are probably entirely deterministic, theoretically-predictable, and documented in one of Raymond Chen's big books of Windows sadness, but that doesn't mean I want to deal with them as a mere mortal.)

Re: Bucketsquatting is finally dead

#174

Post by equinumerous »

ian_d wrote: post #66

The _really_ fun bucket squatting attacks are when the cloud providers themselves use deterministic names for "scratch space" buckets. There was a good DC talk about it at DC32 for AWS, although actual squatting was tough because there was a hash they researchers couldn't reverse (but was consistent for a given account?): https://www.youtube.com/watch?v=m9QVfYVJ7R8 GCP, however, has does this to itself multiple times…

That was an amazing talk, thanks for sharing! I could see the writing on the wall as soon as I saw the bucket names were predictable. Bucket squatting + public buckets + time of check/time of use in the CloudFormation service = deploying resources in any AWS account with enough persistence. I'm surprised this existed in AWS for so long without being flagged by AWS Security.

Re: Bucketsquatting is finally dead

#175

Post by benguild »

If you try to create a new iOS/macOS software project and sign it with a "com.apple." prefix in the bundle ID, Apple's system blocks it… for example.

It's pretty clear this type of ID'ing is an issue in general, unfortunately. Companies often protect themselves as a band-aid but not others in the same situations since the problems aren't frequent enough to warrant a design change. So, when it does become a problem, it could end up being a deep one.

Re: Bucketsquatting is finally dead

#178

Post by icedchai »

mhurron wrote: post #123
a2tech wrote: post #94

Earlier quoted context omitted.

AWS support seems to be struggling. I just came to help a new customer who had a rough severance with their previous key engineer. The root account password was documented, but the MFA went to his phone. We've tried talking to everyone we can, opening tickets, chats, trying to talk to their assigned account rep, etc, no one can remove the MFA. So right now luckily they have other admin accounts, but we straight up ca…

Amazons assistance for account issues to organizations if an employee did anything individually is honestly horrible. They treat it like the organization is attempting to commandeer someone else's account so all the privacy protections you expect for your own stuff is applied no matter how much you can prove it is not some other individuals account. The best part is the billing issues that arise from that. In your ex…

You would think they'd have a standard way to recover this, like mailing a one-time password to the account's billing address.

Re: Bucketsquatting is finally dead

#180

Post by Arrowmaster »

zikduruqe wrote: post #114
NetMageSCW wrote: post #107

Earlier quoted context omitted.

What happens when someone loses their phone?

You print the MFA QR code, and give it to an executive that locks it up in a safe or offsite storage. In a past life, we printed the MFA QR code and the head of finance put it into a safe.

You know that QR code is just text you can read right? It's just an otpauth:// URI you can copy and paste into most password managers.

We even have these amazing things that securely share passwords or other secret data between multiple authorized users.

Seriously just scan the QR code and put it in any password manager that supports TOTP and it will start outputing codes.

Post reply on HN