I don't trust in the U.S. justice system to handle every crime and person as it should but for us, context is important: This person's Twitter is 0xA3A97B6C, y'all can go there and get a better picture of the situation.
Capital One Says Breach Hit 100M Individuals in U.S
91–100 of 319 posts
Re: Capital One Says Breach Hit 100M Individuals in U.S
#92Earlier quoted context omitted.
How's that a fail?
They should not be letting egress traffic through to a Tor node.
Do you mean ingress? You probably wouldn’t want to allow ingress or egress, but the statement says connecting from a TOR exit node to CapitalOne, not the other way around.
Re: Capital One Says Breach Hit 100M Individuals in U.S
#93I was there when C1 negotiated that deal with Amazon and they swore it couldn't happen but of course, we all know that's false.
Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment
The problem with AWS (and other cloud providers) is that it's nearly impossible to properly configure an environment because of how many different methods there are to gain access to resources.
Capital One has been all in on AWS and has dedicated an immense amount of time and money to developing systems for managing their AWS resources (Cloud Custodian for instance) and yet they still couldn't protect their data. What chance is there that anyone else could?
Re: Capital One Says Breach Hit 100M Individuals in U.S
#94Dear "Seattle Woman": while you're in there, please dump Capital One's junk mail database, and set their address label printer on fire. Sincerely, another Seattle resident with a mailbox.
I took down the mailbox at my house and now use my business address for all my mail, because bulk junk mail doesn't get delivered to business addresses. Targeted credit offers do still get delivered, unfortunately. But the amount of junk mail in general is about 10% of what it was.
Works well, though I do often get accused of being a Unibomber type when I tell people they can't send mail to my house address because I removed my mailbox. The bank that holds my mortgage also came calling because the USPS declared my lot "vacant" to HUD after I did it, and that confused everybody.
Re: Capital One Says Breach Hit 100M Individuals in U.S
#95The New York Times has also picked up the story: https://www.nytimes.com/2019/07/29/business/capital-one-data...
Re: Capital One Says Breach Hit 100M Individuals in U.S
#96Why am I finding out about this from the news and not an email from Capital One themselves? I wish there was legal liability to inform customers in the event of a data breach.
They are legally obligated, especially in California, to disclose part or all of this breach to customers. But that obligation is not immediate. Give it some time.
Re: Capital One Says Breach Hit 100M Individuals in U.S
#97> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.
Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png
Looks well qualified to run the coding bootcamp in her prison.
Re: Capital One Says Breach Hit 100M Individuals in U.S
#98Earlier quoted context omitted.
"there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this sort of scenario shouldn't ever happen." ROTFLMAO....you have clearly never worked for a bank, no offense mate. Capital left this shit in plain text on an S3 bucket, I guarantee you
If you took ten seconds to look at the posted source note above, you would see Cloud Custodian has a policy to enforce bucket encryption.
Bucket encryption doesn't protect against anything except someone getting access to the hard drives underlying S3 and somehow recovering data.
If you've somehow left access to a bucket open the odds are that you also have it configured to let anyone with access to the bucket decrypt the files. AWS calls this server side encryption, where S3 automatically encrypts and decrypts files for you. You can also do client side encryption, of course, but it's much more difficult to manage because you have to deal with keys in your application.
Re: Capital One Says Breach Hit 100M Individuals in U.S
#99Earlier quoted context omitted.
DOJ press release: https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arr... """ A former Seattle technology company software engineer was arrested today on a criminal complaint charging computer fraud and abuse for an intrusion on the stored data of Capital One Financial Corporation, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, made her initial appearance in U.S. District Court…
Sounds less like intrusion and more like accidental exposure by Capital One.
It sounds like an internal threat to me (she was an employee at Amazon).
Re: Capital One Says Breach Hit 100M Individuals in U.S
#100Capital One's response: