AWS RDS Vulnerability Leads to AWS Internal Service Credentials

Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by vemv on Tuesday April 12, 2022 @09:43AM (#31002606)

> This is where my analysis and research ended, I did not attempt to enumerate any IAM permissions [...]

I'm simply curious, is this standard (or a popular) etiquette among security researchers?

[ Parent | on HN ]

Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by noasaservice on Tuesday April 12, 2022 @09:50AM (#31002719)

Pretty much, yep.

Once you get creds, you stop and report. You don't use, you don't enumerate, you dont do shit with them.

Getting and reporting is good faith. Getting and using is likely starting a felony case.

[ Parent | on HN ]