Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

121–130 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#121

Post by violetviolence »

dopylitty wrote: post #93
lettergram wrote: post #90

Earlier quoted context omitted.

Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment

The problem with AWS (and other cloud providers) is that it's nearly impossible to properly configure an environment because of how many different methods there are to gain access to resources. Capital One has been all in on AWS and has dedicated an immense amount of time and money to developing systems for managing their AWS resources (Cloud Custodian for instance) and yet they still couldn't protect their data. Wha…

The whole point of moving to a cloud provider it allow the quick setup and deployment of new projects/products as well as trying to limit your costs. With that sort of open-ended system, unless everyone is always thinking security first and okay with the inevitable slow downs associated with a highly locked down system then you will more than likely always run the risk of this sort of situation.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#122

Post by elliekelly »

technothrasher wrote: post #94
girzel wrote: post #24

Dear "Seattle Woman": while you're in there, please dump Capital One's junk mail database, and set their address label printer on fire. Sincerely, another Seattle resident with a mailbox.

I took down the mailbox at my house and now use my business address for all my mail, because bulk junk mail doesn't get delivered to business addresses. Targeted credit offers do still get delivered, unfortunately. But the amount of junk mail in general is about 10% of what it was. Works well, though I do often get accused of being a Unibomber type when I tell people they can't send mail to my house address because I…

> I took down the mailbox at my house

Serious question... is this legal?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#124

Post by dmix »

heartbreak wrote: post #104
dmix wrote: post #33

Earlier quoted context omitted.

They really do send out a whole lotta junk mail, even here in Canada. I don't see other banks doing that.

Having a bigger marketing budget than everyone else is Capital One’s approach to banking.

Their mobile apps are top notch though. I used a card in the past and it came with free credit scoring and the mobile apps were better designed (UI and performance) than most. At least here in my country.

It even had automatic categorization of spending in a Mint.com style.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#125

Post by WalterBright »

girzel wrote: post #24

Dear "Seattle Woman": while you're in there, please dump Capital One's junk mail database, and set their address label printer on fire. Sincerely, another Seattle resident with a mailbox.

CO finally stopped sending me junk mail after I'd send back their offers with "stop sending me these" written in red crayon across the application form. I did it for months.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#126

Post by damontal »

united893 wrote: post #89
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

Are Git and SVN really considered IDEs?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#127

Post by elliekelly »

lettergram wrote: post #90
KirinDave wrote: post #85

I was there when C1 negotiated that deal with Amazon and they swore it couldn't happen but of course, we all know that's false.

Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment

Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#128

Post by kapilvt »

cfors wrote: post #16
jammygit wrote: post #4

> Capital One Financial Corp. lost data from as many as tens of millions of credit card applications after a Seattle woman hacked into a cloud-computing company server > The cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers I can’t tell whether the company virtual server got hacked or whether the cloud provider was who got breached. Hopefully just the vm

Well, the main cloud Capital One uses is Amazon as far as I know. If you think about the attack vectors here, it was most definitely the virtual server that got attacked. If it was the cloud provider (Amazon), there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this…

so I wrote the majority of cloud custodian and still maintain it. I no longer work at capitalone (since jan 2019). afaics the suspect (https://www.linkedin.com/in/paige-t-704a29188/) worked at AWS 3 years ago is also irrelevant which its why its not part of the filing.

the best link for understanding what happened is actually the court case filing not the media reports. https://www.justice.gov/usao-wdwa/press-release/file/1188626...

so this isn't a case of s3 bucket being public/wide open, its a case of a waf iam permissions being overly broad if I'm parsing the filing correctly. Its unclear how the waf product was hacked/bypassed and its credentials obtained.

wrt to custodian in this equation, its not really related afaics, custodian has lots of filters to help determine stuff like is my ec2 or anything with iam role (lambda, etc) overly permissive wrt to permissions (check-permissions filter). it also has the ability to filter individual statements and access on any resource (s3, lambda, etc there are many) with an embedded iam policy on a fine grained basis (allow y accounts but not x accounts) to protect against account level access (cross-account filter). And the ability on ec2 via guard duty alerts to auto remediate (suspend, memory snapshot, yank role, volume snapshot). its used by lots of users/enterprises across the governance, security, cost-optimization domains because its flexible and supports many clouds.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#129

Post by slowdog »

united893 wrote: post #89
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

Pretty much doubt there'd be much insider knowledge, guessing in 2015 a L4(entry) System engineer is going to be pretty much spending 80% of their time building new regions by hand...

Not much really there to learn

Re: Capital One Says Breach Hit 100M Individuals in U.S

#130

Post by razorwolf »

_bfhp wrote: post #91

I don't trust in the U.S. justice system to handle every crime and person as it should but for us, context is important: This person's Twitter is 0xA3A97B6C, y'all can go there and get a better picture of the situation.

So much evidence of mental illness there (see also Facebook). I hope this person gets help, but given their claim to also be in the country illegally (Tuvalu), who knows.

I was ready to think this person was being set up by someone who didn't like her, given how exposed she was to being identified, but the Twitter and FB posts strongly suggest a vulnerable person making poor decisions instead.

Post reply on HN