Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

61–70 of 187 posts

Re: Bucketsquatting is finally dead

#61

Post by BCM43 »

8organicbits wrote: post #58
INTPenis wrote: post #12

I started treating long random bucketnames as secrets years ago. Ever since I noticed hackers were discovering buckets online with secrets and healthcare info. This is where IaC shines.

~As far as I know, bucket names are public via certificate transparency logs.~ There are tools for collecting those names. Besides you'd leak the subdomain to (typically) unencrypted DNS when you do a lookup and maybe via SNI. Edit: crossout incorrect info

I'm pretty sure buckets use star certs and thus the individual bucket names won't be in the transparency logs.

Re: Bucketsquatting is finally dead

#62

Post by throwaway173738 »

xmcqdpt2 wrote: post #54
mwalser wrote: post #51

Earlier quoted context omitted.

And the naming restrictions and maximum name lengths are all over the place: https://learn.microsoft.com/en-us/azure/azure-resource-manag... Storage accounts are one of the worst offenders here. I would really like to know what kind of internal shenanigans are going on there that prevent dashes to be used within storage account names.

I wonder if it's related to the fact that Windows as such weird rules about allowed file names. Like not directly obviously, more like culturally inside microsoft.

I’m pretty sure Azure was built out with Hyper-V, which was built into the Windows kernel. So everything that relied on virtualization would’ve had bizarre case insensitivity and naming rules.

I’ve lost track of servers in Azure because the name suddenly changed to all uppercase ave their search is case sensitive but whatever back-end isn’t.

Re: Bucketsquatting is finally dead

#63

Post by hallway_monitor »

noahmasur wrote: post #60
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

You can always use plus-addressing if your email provider supports that. AWS considers plus-addressed root emails to be unique.

Doesn’t solve the SSO issue though unless you change your login email

Re: Bucketsquatting is finally dead

#66

Post by ian_d »

The _really_ fun bucket squatting attacks are when the cloud providers themselves use deterministic names for "scratch space" buckets. There was a good DC talk about it at DC32 for AWS, although actual squatting was tough because there was a hash they researchers couldn't reverse (but was consistent for a given account?): https://www.youtube.com/watch?v=m9QVfYVJ7R8

GCP, however, has does this to itself multiple times because they rely so heavily on project-id, most recently just this February: https://www.sentinelone.com/vulnerability-database/cve-2026-...

Re: Bucketsquatting is finally dead

#67

Post by embedding-shape »

ffsm8 wrote: post #48
juliangmp wrote: post #42

Earlier quoted context omitted.

It was honestly a downgrade i ended up just putting the 4 digits I had before at the end of my username cause surprise the name was taken immediately

I haven't logged in since . I wonder if they'll delete my account eventually - as I essentially don't have a username because of that

> I wonder if they'll delete my account eventually

Just some days ago I received warning from Discord that they'll delete my account since I haven't logged in for two years.

> Your Discord account has been inactive for over 2 years, and is scheduled to be deleted on $DATE. But don’t worry! Dust off the cobwebs and prevent your account from being deleted just by logging in.

Re: Bucketsquatting is finally dead

#68

Post by embedding-shape »

8organicbits wrote: post #58
INTPenis wrote: post #12

I started treating long random bucketnames as secrets years ago. Ever since I noticed hackers were discovering buckets online with secrets and healthcare info. This is where IaC shines.

~As far as I know, bucket names are public via certificate transparency logs.~ There are tools for collecting those names. Besides you'd leak the subdomain to (typically) unencrypted DNS when you do a lookup and maybe via SNI. Edit: crossout incorrect info

> Besides you'd leak the subdomain to (typically) unencrypted DNS when you do a lookup and maybe via SNI.

"Leak" is maybe a bit over-exaggerated, although if someone MitM'd you they definitely be able to see it. But "leak" makes it seem like it's broadcasted somehow, which obviously it isn't.

Re: Bucketsquatting is finally dead

#69

Post by jorams »

ffsm8 wrote: post #48
juliangmp wrote: post #42

Earlier quoted context omitted.

It was honestly a downgrade i ended up just putting the 4 digits I had before at the end of my username cause surprise the name was taken immediately

I haven't logged in since . I wonder if they'll delete my account eventually - as I essentially don't have a username because of that

Your account has almost certainly been assigned a new username already. From the same link:

> Starting March 4, 2024, Discord will begin assigning new usernames to users who have not chosen one themselves. If your username still has a discriminator (username*#0000*), Discord will begin assigning you a new, unique username as soon as March 4, 2024. We will try to assign you a unique username that is similar to your current username.

Re: Bucketsquatting is finally dead

#70

Post by dec0dedab0de »

nawgz wrote: post #59
etothet wrote: post #55

Speaking of unique names within AWS, I learned the other day that even after you delete an AWS account, you can’t reuse the root user email addresses (it’s documented, but I wasn’t aware). Someone at my org used their main company email address for a root user om an account we just closed and a 2nd company email for our current account. We are past the time period where AWS allows for reverting the account deletion.…

Help me understand why you would delete your AWS account if the company and email address are unchanged - I can’t see the motivation. And on the flip side I can easily see why not allowing email addresses to be used again is a reasonable security stance, email addresses are immutable and so limiting them only to one identity seems logical. Sounds quite frustrating for this user of course but I guess it sounds a bit s…

what if you stopped using AWS for a while, then came back?
Post reply on HN