Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Well, it's just an AWS Account ID

mail.cloudsecurity.club

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Well, it's just an AWS Account ID

#21

Post by rollulus »

This briefly mentions something I’ve seen during work and never dared to explore: the various public (RDS) snapshots. Oh boy, some people either use very realistic test datasets or they accidentally made things public that shouldn’t be at all.

Re: Well, it's just an AWS Account ID

#22

Post by vasco »

metadat wrote: post #16
teractiveodular wrote: post #14

Earlier quoted context omitted.

No, enumeration would be if you can get the entire list of usernames somehow.

> No, enumeration would be if you can get the entire list of usernames somehow. It's still a form of enumeration. Once you know the generation scheme, you can always enumerate some form , perfect or otherwise.

Enumeration means a specific thing, that you get a full or paginated list of things and all you need to do is hit it. This isn't enumeration at all. It's like you saying you know the bucket keys to a hashtable so you can enumerate it by hitting them one by one, except in this case you don't even know the keys.

Re: Well, it's just an AWS Account ID

#24

Post by russell_h »

christina97 wrote: post #3

This seems wrong. Surely you can’t “Enumerate IAM Entities” with just the aAccount ID? So if a company has a user for every dev with username first.last, you could list all devs just by knowing the Account ID? Maybe the author misunderstood what “enumerate” means and meant to say that you can check if a given IAM entity exists under the account? Enumeration and bruteforce are very different things.

In security contexts the term “enumeration” is understood to mean “brute force”. You can Google “enumeration attack” to see a bunch of examples where this is explicitly defined.

Re: Well, it's just an AWS Account ID

#27

Post by teractiveodular »

vasco wrote: post #23
teractiveodular wrote: post #15

Earlier quoted context omitted.

Send targeted phishing mails.

I can already do that by sending them for root. This seems like trying to make something out of nothing.

Are you stuck in the 70s or something? I can't recall the last time I read email addressed to root.

Re: Well, it's just an AWS Account ID

#28

Post by vasco »

teractiveodular wrote: post #27
vasco wrote: post #23

Earlier quoted context omitted.

I can already do that by sending them for root. This seems like trying to make something out of nothing.

Are you stuck in the 70s or something? I can't recall the last time I read email addressed to root.

My friend, the main AWS account is called the root account and its username is root, so your zinger didn't zing.

Re: Well, it's just an AWS Account ID

#29

Post by g15jv2dp »

teractiveodular wrote: post #15
g15jv2dp wrote: post #12

Earlier quoted context omitted.

And then what?

Send targeted phishing mails.

How does knowing the AWS username allow you to send a more effective phishing email? Especially if the username is just the user's... name. That's public info.

Re: Well, it's just an AWS Account ID

#30

Post by yencabulator »

nikolay wrote: post #11

I consider anything that's not public knowledge to be a secret. When possible, try not to come up with anything that's guessable. I randomize even DB usernames in Terraform, not just the passwords. I do the same with schema names, etc. This requires sweat and tears, but it's always worth it. WordPress sucks, but the idea to have a custom table name prefix is not random, but a security consideration. But don't prefix…

Protip: Use random suffixes not prefixes, and you can retain tab completion.

The frobnicator service can get a database account name frobnicator_znwxhs1xehhoy. You can use a table name like accounts_c4acou45cbkre if you want.

Post reply on HN