151–160 of 319 posts
I wonder why data security professionals don't practice compartmentalization. 100 million accounts should not be accessible from one account. It should be like watertight compartments in a ship. Breaching one doesn't sink the ship.
Earlier quoted context omitted.
Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png
Oh cool I use the same LaTeX template as her for my resume. Mine is blue instead of pink though! https://github.com/posquit0/Awesome-CV
> She is charged with a single count of computer fraud and faces a maximum penalty of five years in prison and a $250,000 fine. Her lawyer declined to comment. We need to start putting the hammer down on these people; maximum five years, meaning she/he will probably do one year. The US needs to start making examples and these people and increase penalties.
I'd rather see the hammer applied to the companies that allow the data to be stolen.
This argument is constantly made on HN and it is analogous to; you left your back door open at your house, and instead of arresting and prosecuting the robber, we are going to arrest you. Sure, I made a mistake and left my back door open, but that doesn't give the robber the right to break in and steal my stuff. It is lacking a moral compass and sense of right and wrong. There needs to be consequences for bad behavior.
Earlier quoted context omitted.
Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment
Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.
I used to work on an auditing and monitoring platform, there really are too many vectors.
Earlier quoted context omitted.
Per the complaint, it doesn't sound like the bucket was exposed to the world. Rather, security credentials were "obtained": > Capital One determined that the first command, when executed, obtained security credentials for an account named XXXX-WAF-Role, that in turn, enabled access to certain of Capital One's folders at the Cloud Computing Company. Unsure how one would obtain credentials for an IAM Role, but the abov…
I recall a newbie dev at our company some years back accidentally posted creds in code to github. I have talked about this here before - but - we had paid for 200 repos.. problem was he made a new repo, which became 201 - which since we had only paid for 200, github auto makes the next one public. Bots slurp these and hunt... They used those creds to launch like 1700 gpu machines across the globe for a bitcoin mining…
Every SDK that I have used let’s you use a constructor without a parameter and can get your credentials from the config file/role.
> She is charged with a single count of computer fraud and faces a maximum penalty of five years in prison and a $250,000 fine. Her lawyer declined to comment. We need to start putting the hammer down on these people; maximum five years, meaning she/he will probably do one year. The US needs to start making examples and these people and increase penalties.
Most federal cases are about negotiating the sentence, and win a public defender she is probably screwed. She’ll spend more time in prison than the average rapist.
Earlier quoted context omitted.
Metadata, yes. But not content. So they can see you have 200 c5.9xlarges running in 3 AZs in 3 subnets in one VPC, for example. But they can't see what you have on the volumes attached to those instances, what processes are running, etc.
I've had AWS support tell me exactly what processes are running on my instance. They do seem to have some visibility beyond metadata.
Internally we also talk to AWS support. They absolutely don't have much visibility into our accounts at all - much to my frustrations. They only see metadata - even for internal accounts.
The only teams that have some access to such information is security team, or when you Grant access explicitly to the other person via standard AWS auth mechanism (IAM)
Earlier quoted context omitted.
Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment
Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.
Earlier quoted context omitted.
Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment
Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.
Earlier quoted context omitted.
If you took ten seconds to look at the posted source note above, you would see Cloud Custodian has a policy to enforce bucket encryption.
Bucket encryption doesn't protect against anything except someone getting access to the hard drives underlying S3 and somehow recovering data. If you've somehow left access to a bucket open the odds are that you also have it configured to let anyone with access to the bucket decrypt the files. AWS calls this server side encryption, where S3 automatically encrypts and decrypts files for you. You can also do client sid…