Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

111–120 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#111

Post by jorblumesea »

shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Not sure if this is a reputable source: https://heavy.com/news/2019/07/paige-adele-thompson/

But sounds like she's an engineer that used to work in aws, specifically S3. If true, seems likely as she would have insider knowledge of existing attack vectors and possibly vulns. Maybe even using something we discovered while on the job.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#112

Post by QuinnyPig »

united893 wrote: post #89
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

Unlikely. S3 was publicly rebuilt in the wake of the 2017 S3pocalypse.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#113

Post by weiming »

ac29 wrote: post #62
girzel wrote: post #24

Dear "Seattle Woman": while you're in there, please dump Capital One's junk mail database, and set their address label printer on fire. Sincerely, another Seattle resident with a mailbox.

https://www.optoutprescreen.com/ should handle most of that. Yes, its legit [0]. [0] https://www.consumer.ftc.gov/articles/0148-prescreened-credi...

Most useful tool (has been for a decade+) to stop the junk credit advertisements that many people don't know about.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#114

Post by [deleted] »

Scoundreller wrote: post #88
violetviolence wrote: post #75

Earlier quoted context omitted.

What sort of rule or policy would you put into play to detect that a connection was a TOR node?

Tor node IPs are published, so you can just block that list. There's probably a way to detect them too, but I don't think an exit node can be secret.

[deleted]

Re: Capital One Says Breach Hit 100M Individuals in U.S

#115

Post by violetviolence »

kevinsundar wrote: post #9
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Given that they're on AWS and "The intrusion occurred through a misconfigured web application firewall that enabled access to the data" thats what im betting too.

Well, if it was a misconfigured WAF (which usually is just a reverse proxy with mod_proxy) to an application then you would not need to gain access to any Tokens, etc. all you would need to do is gain access to the server. Or be able to use that WAF as a proxy to gain access to other http bound resources?

From there any IAM role access the underlying server had, you would now have as well. And that would work with any sort of access (don't need root, etc.)

Re: Capital One Says Breach Hit 100M Individuals in U.S

#116

Post by Scoundreller »

joncrane wrote: post #110
cfors wrote: post #66

Earlier quoted context omitted.

They should not be letting egress traffic through to a Tor node.

Is there enough space in an S3 bucket access policy to include DENY rules for every known Tor IP address?

By the sounds of it, the s3 bucket was internally accessible only. But attacker connected through the corp's Web Application Firewall after grabbing the credentials to login to the S3 bucket.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#117

Post by Scoundreller »

ivyivy wrote: post #92
cfors wrote: post #66

Earlier quoted context omitted.

They should not be letting egress traffic through to a Tor node.

Do you mean ingress? You probably wouldn’t want to allow ingress or egress, but the statement says connecting from a TOR exit node to CapitalOne, not the other way around.

Sometimes the best way to handle "bad" traffic is not to reject/block it, but to respond to it incredibly slowly, or divert to an uninteresting flaky phantom server, or reject every login attempt (even with correct credentials) to divert attacker's attention.

The ingress was okay, but the egress flow was very very bad!

Re: Capital One Says Breach Hit 100M Individuals in U.S

#118

Post by dontbenebby »

teej wrote: post #96
hello_asdf wrote: post #80

Why am I finding out about this from the news and not an email from Capital One themselves? I wish there was legal liability to inform customers in the event of a data breach.

They are legally obligated, especially in California, to disclose part or all of this breach to customers. But that obligation is not immediate. Give it some time.

Do they need to notify those of us not located in California?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#119

Post by cfors »

runningdc wrote: post #109
cfors wrote: post #16

Earlier quoted context omitted.

Well, the main cloud Capital One uses is Amazon as far as I know. If you think about the attack vectors here, it was most definitely the virtual server that got attacked. If it was the cloud provider (Amazon), there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this…

Where did you see it was a leaked account?

Attacker had access to the account. It is in the complaint posted by user iancarroll.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#120

Post by vaesh »

joncrane wrote: post #107
cj wrote: post #68

Earlier quoted context omitted.

This is a legitimate risk. At a minimum, AWS Support has near complete read access to AWS accounts in connection with support cases. It would be interesting to hear from an AWS employee how access to customer information is controlled.

Metadata, yes. But not content. So they can see you have 200 c5.9xlarges running in 3 AZs in 3 subnets in one VPC, for example. But they can't see what you have on the volumes attached to those instances, what processes are running, etc.

I've had AWS support tell me exactly what processes are running on my instance. They do seem to have some visibility beyond metadata.
Post reply on HN