Capital One Says Breach Hit 100M Individuals in U.S • Hacker News Board

Re: Capital One Says Breach Hit 100M Individuals in U.S

#171

Post by PopePompus » Tue, Jul 30, 2019, 3:29 AM UTC

nodesocket wrote: post #153

PopePompus wrote: post #141

Earlier quoted context omitted.

I'd rather see the hammer applied to the companies that allow the data to be stolen.

From what I read in the complaint, it wasn't as blatantly bone headed as other breaches. Seemed to be an IAM permission issue related to AWS WAF. This argument is constantly made on HN and it is analogous to; you left your back door open at your house, and instead of arresting and prosecuting the robber, we are going to arrest you. Sure, I made a mistake and left my back door open, but that doesn't give the robber th…

I think it's more like I left the back door of your house open, without ever having permission to access your house, and you got robbed because of that.

I admit the Equifax situation was worse. The people whose data was lost by Capitol One probably at least have some sort of business relationship with that company (for example, they may have applied for a credit card). I had no business relationship with Equifax at all, yet apparently information about me was leaked. I don't buy anything on credit, so I don't give a tinker's damn what my credit score is. Equifax provides no value to me whatsoever, yet I now have to worry about information they collected about me with no authorization from me. I'd like that company to be sued into bankruptcy.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#172

Post by lemax » Tue, Jul 30, 2019, 3:29 AM UTC

razorwolf wrote: post #130

_bfhp wrote: post #91

I don't trust in the U.S. justice system to handle every crime and person as it should but for us, context is important: This person's Twitter is 0xA3A97B6C, y'all can go there and get a better picture of the situation.

So much evidence of mental illness there (see also Facebook). I hope this person gets help, but given their claim to also be in the country illegally (Tuvalu), who knows. I was ready to think this person was being set up by someone who didn't like her, given how exposed she was to being identified, but the Twitter and FB posts strongly suggest a vulnerable person making poor decisions instead.

Given that Ms. Thompson is transgender [0], it's likely a lot was stacked against her emotionally. 40% of trans-identifying individuals to attempt suicide [1]. This is a disappointing omission from the reporting and the road that lies ahead for Ms. Thomson in the hands of the federal prison system is surely horrifying.

[0] https://twitter.com/0xA3A97B6C/status/1152518528907354112 [1] https://transequality.org/sites/default/files/docs/usts/USTS...

Re: Capital One Says Breach Hit 100M Individuals in U.S

#173

Post by dopylitty » Tue, Jul 30, 2019, 3:34 AM UTC

elliekelly wrote: post #127

lettergram wrote: post #90

Earlier quoted context omitted.

Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment

Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.

There are many different automated systems for checking for misconfigurations in your AWS organization. Capital One even developed a very popular one (Cloud Custodian). Like most automated configuration checkers or monitoring systems they rely on being configured by experts because at their default settings they are mainly a source of annoying alerts that end up auto-filed to email folders you never look in because this is agile and we can rationalize the alert rules in the next iteration (we won't). They can also auto apply actions. Have fun debugging your Cloud Formation stack that failed because the automated checker system terminated the instance without notifying anyone because it was missing a required tag.

As useless as these checkers are, the main problem is that there are so many different ways to gain access to resources that it's almost impossible to have a system that's useful to the business while also provably secure either manually or automatically.

Don't forget even AWS themselves created a "managed" policy for some minor service which accidentally gave users root access in the account: https://medium.com/ymedialabs-innovation/an-aws-managed-poli...

Re: Capital One Says Breach Hit 100M Individuals in U.S

#174

Post by pizza » Tue, Jul 30, 2019, 3:36 AM UTC

mandelbrotwurst wrote: post #101

Rebelgecko wrote: post #78

Earlier quoted context omitted.

FYI, getting a $125 check from Equifax is contingent on most of the people that are eligible to get one not actually requesting it. It'll probably be less

Yeah, there's only $31M allocated for those payouts :/

Incredible, ~147 million people's data was exposed and they've only allocated 248,000 people's worth of checks. That's 0.17% of the victims..

Re: Capital One Says Breach Hit 100M Individuals in U.S

#175

Post by thinkmassive » Tue, Jul 30, 2019, 3:37 AM UTC

thinkmassive wrote: post #20

otterley wrote: post #11

Earlier quoted context omitted.

DOJ press release: https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arr... """ A former Seattle technology company software engineer was arrested today on a criminal complaint charging computer fraud and abuse for an intrusion on the stored data of Capital One Financial Corporation, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, made her initial appearance in U.S. District Court…

Sounds less like intrusion and more like accidental exposure by Capital One.

I stand corrected. It sounds like she exploited a vulnerability that allowed her to assume an IAM role with access, rather than the S3 public permissions I previously assumed.

https://news.ycombinator.com/item?id=20560594

Re: Capital One Says Breach Hit 100M Individuals in U.S

#176

Post by DangitBobby » Tue, Jul 30, 2019, 3:39 AM UTC

mandelbrotwurst wrote: post #101

Rebelgecko wrote: post #78

Earlier quoted context omitted.

FYI, getting a $125 check from Equifax is contingent on most of the people that are eligible to get one not actually requesting it. It'll probably be less

Yeah, there's only $31M allocated for those payouts :/

So less than 5% of the settlement goes to people affected? Yes, that seems reasonable...

Re: Capital One Says Breach Hit 100M Individuals in U.S

#177

Post by samstave » Tue, Jul 30, 2019, 3:42 AM UTC

scarface74 wrote: post #155

samstave wrote: post #70

Earlier quoted context omitted.

I recall a newbie dev at our company some years back accidentally posted creds in code to github. I have talked about this here before - but - we had paid for 200 repos.. problem was he made a new repo, which became 201 - which since we had only paid for 200, github auto makes the next one public. Bots slurp these and hunt... They used those creds to launch like 1700 gpu machines across the globe for a bitcoin mining…

It doesn’t matter. There is never a reason for credentials to be anywhere near your repository. If you’re running locally, you should have your credentials in your home directory (via aws configure). If you are running your code on AWS either on an EC2 instance, lambda, or Docker you should be using the role associated with the execution environment. Every SDK that I have used let’s you use a constructor without a pa…

i know, this was a few years ago, and these types of practices were still being developed out in the greater community (lambda didnt exist yet, dockeer was still nascient etc)

Re: Capital One Says Breach Hit 100M Individuals in U.S

#178

Post by october_sky » Tue, Jul 30, 2019, 3:44 AM UTC

kapilvt wrote: post #128

cfors wrote: post #16

Earlier quoted context omitted.

Well, the main cloud Capital One uses is Amazon as far as I know. If you think about the attack vectors here, it was most definitely the virtual server that got attacked. If it was the cloud provider (Amazon), there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this…

so I wrote the majority of cloud custodian and still maintain it. I no longer work at capitalone (since jan 2019). afaics the suspect ( https://www.linkedin.com/in/paige-t-704a29188/ ) worked at AWS 3 years ago is also irrelevant which its why its not part of the filing. the best link for understanding what happened is actually the court case filing not the media reports. https://www.justice.gov/usao-wdwa/press-relea…

Thanks for writing Cloud Custodian. What are you working on these days?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#179

Post by earthshot » Tue, Jul 30, 2019, 3:45 AM UTC

grayed-down wrote: post #170

I'll be spec'ing a project soon where I think the organization's data should be self hosted. I'm going to show them this piece.

I'm sure you'll be unable to find any examples of self-hosted data being hacked, hit by malware, or otherwise attacked.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#180

Post by yub » Tue, Jul 30, 2019, 3:48 AM UTC

PopePompus wrote: post #171

nodesocket wrote: post #153

Earlier quoted context omitted.

From what I read in the complaint, it wasn't as blatantly bone headed as other breaches. Seemed to be an IAM permission issue related to AWS WAF. This argument is constantly made on HN and it is analogous to; you left your back door open at your house, and instead of arresting and prosecuting the robber, we are going to arrest you. Sure, I made a mistake and left my back door open, but that doesn't give the robber th…

I think it's more like I left the back door of your house open, without ever having permission to access your house, and you got robbed because of that. I admit the Equifax situation was worse. The people whose data was lost by Capitol One probably at least have some sort of business relationship with that company (for example, they may have applied for a credit card). I had no business relationship with Equifax at a…

The closest analogy would be that you gave me your house key so I could go in and water your plants while you’re on vacation (signing up for an account), but someone grabbed the key off my counter because I left my back door unlocked. The folks who had their information leaked in this instance had signed up for accounts with C1.