Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

51–60 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#51

Post by Uehreka »

INTPenis wrote: post #35
ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

It's valuable info to any pentester. Security by obscurity is still one layer of security.

But there’s a reason people advise against security by obscurity: the obscurity can go away at any time and once it does it’s unrecoverable.

So sure, maybe pat yourself on the back today that on top of your other measures, no one outside your org and AWS knows your Account ID. But if it gets out at some point, those other measures should be foiling your pentesters on their own. In fact, to better test that this is the case, you should probably give the pentesters your account ID so you can be informed regarding your security in this scenario.

Re: How to find the AWS account ID of any S3 bucket

#52

Post by elcomet »

laserlight wrote: post #38
abadpoli wrote: post #31

Earlier quoted context omitted.

It’s not defense in depth to build your security model off of false assumptions, it’s just bad security.

I don't understand your reasoning. Neither my name nor where I live nor my phone number nor my license plate are secrets. Yet I don't go around wearing a t-shirt with my personally identifying information printed on it. What am I missing?

If you assume it is a secret, you might start to use it as an access key, or similar things. That's where the error is. You should assume it is public (but avoid publishing it yourself of course, that's defense in depth)

Re: How to find the AWS account ID of any S3 bucket

#53

Post by btown »

jameshart wrote: post #28
ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

AWS account IDs aren’t secret, but the identity of who owns particular S3 bucket names is meant to be. If you get an email apparently from AWS that correctly names an S3 bucket and the associated account ID, are you more likely to take it seriously than an email that just names a bucket?

More generally, this opens up all sorts of threat models for espionage and alternative data. A private bucket called project-foobar-logs-staging might have its existence known in an index but never have been known to be associated with Baz Corp's publicly-known image buckets - but with this disclosure, a database will become available making that association possible. And it will be possible to monitor if and when project-foobar-logs-prod gets provisioned. Not to mention that state-level actors would love to see an enumerable list of projects their rivals are working on, and if any of them happen to have been secured only by obscurity in the past.

Edge cases, to be sure, but certainly nontrivial.

Re: How to find the AWS account ID of any S3 bucket

#54

Post by sroussey »

abadpoli wrote: post #9
busymom0 wrote: post #5

Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://community.cloudflare.com/t/api-zone-id/355566 > The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to…

AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.

Oh, there are other things... like a compromised chrome extension that only looks for your accountID being used and sends back credentials.

Knowing an accountId tells you where to focus your efforts. You got through one hoop (of many).

Re: How to find the AWS account ID of any S3 bucket

#55

Post by fnordpiglet »

ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

They’re not a secret, in fact it’s what you use to share the identity of one account with another, possibly third party’s account. It’s a secret in the way your personal email address is. You may not advertise it on 4chan, but you definitely share it to limited audiences. Once you’ve shared it it’s no longer an actual secret. Indeed, as has been noted, aws itself doesn’t treat your account id as a secret and freely shares it within aws, logs it in plain text, uses it for operations with human operators, internal reporting, etc. It’s an identifier, it’s discoverable, shareable, and leaks all over the place.

This is not the stuff secrets are made of.

Trying to eek some sort of security story out of hiding account ids plays right into security through obscurity. As it’s not treated as a secret the most you’re doing is obscuring the attack surface of your infrastructure. IAM doesn’t allow anyone to use the knowledge of your account ID to grant any privilege not specifically granted within the account itself via two way grants. Holes in your IAM policies aren’t protected by hiding the account ID, they’re protected by closing the holes.

Re: How to find the AWS account ID of any S3 bucket

#56

Post by sroussey »

efitz wrote: post #41
jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

Well, that assumes that the ID is cryptographically random. Perhaps that is a bad assumption.

Re: How to find the AWS account ID of any S3 bucket

#57

Post by supriyo-biswas »

jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

This is because, I assume, the AWS policy execution has a number of “operators” and “operands”, and in this case, you’re using the StringLike operand on the account ID string.

Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] now, although other types of side channels such as speculative execution side channels on CPUs (Meltdown, Spectre) already made waves at the time of discovery, and before that we had power analysis[2] and Magnetostriction detection, and constant time cryptography (this one is a field of its own, so I omit references.)

[1] https://en.m.wikipedia.org/wiki/Side-channel_attack [2] https://en.m.wikipedia.org/wiki/Power_analysis

Re: How to find the AWS account ID of any S3 bucket

#58

Post by sroussey »

fnordpiglet wrote: post #55
ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

They’re not a secret, in fact it’s what you use to share the identity of one account with another, possibly third party’s account. It’s a secret in the way your personal email address is. You may not advertise it on 4chan, but you definitely share it to limited audiences. Once you’ve shared it it’s no longer an actual secret. Indeed, as has been noted, aws itself doesn’t treat your account id as a secret and freely s…

Yes, but I do use random email addresses (that look like passwords) to stop correlation, concerted credential stuffing (that might lock me out for a time), etc. And if it pops up in a compromised server no one will know that email address is mine.
Post reply on HN