News for hackers. Stuff that matters.
Re:It's now possible to find the AWS Account ID for any S3 B... by sylens on Monday February 26, 2024 @12:34PM (#39514226)
While I wouldn't publicly hand out my account IDs as a general practice, I think you have to expect that some of them will be disclosed at some point. As more third party vendors and SaaS platforms move away from IAM users and access keys to using role assumption as the preferred method of integration (as they should!), the account ID of at least the account you use as their integration point is now known by another party, who have their own dependencies, vulnerabilities, etc.
Re:It's now possible to find the AWS Account ID for any S3 B... by SamuelAdams on Monday February 26, 2024 @04:23PM (#39516911)
This is what I’m curious to learn. What can an attacker do with an AWS account ID? How is that any different from knowing someone’s email address?
Re:It's now possible to find the AWS Account ID for any S3 B... by quickthrower2 on Monday February 26, 2024 @07:45PM (#39518674)
Useful social engineering datapoint
Re:It's now possible to find the AWS Account ID for any S3 B... by sylens on Monday February 26, 2024 @04:46PM (#39517098)
If the account and its resources are properly configured - not much.

But that can be easier said than done for many organizations, especially when you have lots of different teams configuring their own environments.

Re:It's now possible to find the AWS Account ID for any S3 B... by coredog64 on Monday February 26, 2024 @09:30PM (#39519418)
Once I have an AWS account ID, my next trick is to grant cross-account bucket policies to discover role names in the account.
Re:It's now possible to find the AWS Account ID for any S3 B... by baby_souffle on Tuesday February 27, 2024 @12:26AM (#39520463)
How does this work?
Re:It's now possible to find the AWS Account ID for any S3 B... by fcoelho on Tuesday February 27, 2024 @07:16AM (#39523143)
If you put a role ARN in the principal section of a bucket policy, AWS will check if the role exists and fail the policy update request if not. Even if it's not in the same account. Don't know if there's another way but you can manually enumerate roles from there