News for hackers. Stuff that matters.

A comment on Well, it's just an AWS Account ID. Parent comment

Re:Well, it's just an AWS Account ID by teractiveodular on Wednesday July 10, 2024 @12:27AM (#40923705)
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by metadat on Wednesday July 10, 2024 @01:24AM (#40923962)
A.k.a. .. enumeration.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by teractiveodular on Wednesday July 10, 2024 @01:34AM (#40923995)
No, enumeration would be if you can get the entire list of usernames somehow.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by metadat on Wednesday July 10, 2024 @01:37AM (#40924007)
> No, enumeration would be if you can get the entire list of usernames somehow.

It's still a form of enumeration.

Once you know the generation scheme, you can always enumerate some form, perfect or otherwise.

[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by vasco on Wednesday July 10, 2024 @02:40AM (#40924288)
Enumeration means a specific thing, that you get a full or paginated list of things and all you need to do is hit it. This isn't enumeration at all. It's like you saying you know the bucket keys to a hashtable so you can enumerate it by hitting them one by one, except in this case you don't even know the keys.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by jadengeller on Wednesday July 10, 2024 @01:50AM (#40924061)
If there are rate limits, or if the search space is vast, this is notably more limited (even if arguably still enumeration)
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by g15jv2dp on Wednesday July 10, 2024 @01:24AM (#40923955)
And then what?
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by teractiveodular on Wednesday July 10, 2024 @01:35AM (#40924001)
Send targeted phishing mails.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by ramon156 on Wednesday July 10, 2024 @02:43AM (#40924299)
Our company got hit with this. I guess there's no way to recover from this other than do our best to block these.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by vasco on Wednesday July 10, 2024 @02:41AM (#40924295)
I can already do that by sending them for root. This seems like trying to make something out of nothing.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by teractiveodular on Wednesday July 10, 2024 @04:16AM (#40924778)
Are you stuck in the 70s or something? I can't recall the last time I read email addressed to root.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by vasco on Wednesday July 10, 2024 @07:51AM (#40925880)
My friend, the main AWS account is called the root account and its username is root, so your zinger didn't zing.
[ Parent | on HN ]
Re:Well, it's just an AWS Account ID by g15jv2dp on Wednesday July 10, 2024 @08:05AM (#40925975)
How does knowing the AWS username allow you to send a more effective phishing email? Especially if the username is just the user's... name. That's public info.
[ Parent | on HN ]