Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

191–200 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#191

Post by [deleted] »

dopylitty wrote: post #173
elliekelly wrote: post #127

Earlier quoted context omitted.

Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.

There are many different automated systems for checking for misconfigurations in your AWS organization. Capital One even developed a very popular one (Cloud Custodian). Like most automated configuration checkers or monitoring systems they rely on being configured by experts because at their default settings they are mainly a source of annoying alerts that end up auto-filed to email folders you never look in because t…

[deleted]

Re: Capital One Says Breach Hit 100M Individuals in U.S

#193

Post by bifrost »

jorblumesea wrote: post #111
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Not sure if this is a reputable source: https://heavy.com/news/2019/07/paige-adele-thompson/ But sounds like she's an engineer that used to work in aws, specifically S3. If true, seems likely as she would have insider knowledge of existing attack vectors and possibly vulns. Maybe even using something we discovered while on the job.

If this is true, this is a great reason for people to stop using S3 or to start doing daily bucket audits. Or you know, not store PII in the cloud poorly.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#194

Post by rcw4256 »

grier wrote: post #184

What was Slack's role in all of this? They appear to have turned over historical images and chat logs, not just for the person indicted, but even others in the same channel. Did the FBI ask nicely or was there actually some formal process?

The complaint doesn't make it clear what happened in this specific case, but Slack's general policy is here: https://slack.com/user-data-request-policy

Re: Capital One Says Breach Hit 100M Individuals in U.S

#195

Post by git-pull »

elliekelly wrote: post #186
olmec wrote: post #182

Earlier quoted context omitted.

Why would it be illegal to not have a mailbox? It's your property. Do whatever you please.

Mailboxes live in this weird property-right limbo (that I don’t know really anything about) where the homeowner buys it but it is “property of” the US Postal Service. I found this[1] Supreme Court case that sort of touches on how the property rights work. [1] https://supreme.justia.com/cases/federal/us/453/114/

I don't think that's what they're saying though. They're talking about what the mailbox while it's in use. I didn't find anything mentioning boxes being property of the USPS, they use the term "authorized repository." When it's in use, it's still property of the private entity, but it's usage is subject to the rules of USPS. (I'm not a lawyer)

My understanding it they can remove the USPS box (looking at what postal workers said on Quora), but they wouldn't be part of the mail system anymore. I guess they could have mail forwarded to a new box, or else it'd be undeliverable.

https://www.nytimes.com/1981/06/26/us/justices-upholds-law-p...

> Writing for the majority, Associate Justice William H. Rehnquist said that no one was required to receive mail or to have a mailbox but that once a postal customer provides a box for receiving mail he implicitly agrees to abide by postal regulations on its use.

Audio/transcript: https://www.oyez.org/cases/1980/80-608

Re: Capital One Says Breach Hit 100M Individuals in U.S

#196

Post by kapilvt »

october_sky wrote: post #178
kapilvt wrote: post #128

Earlier quoted context omitted.

so I wrote the majority of cloud custodian and still maintain it. I no longer work at capitalone (since jan 2019). afaics the suspect ( https://www.linkedin.com/in/paige-t-704a29188/ ) worked at AWS 3 years ago is also irrelevant which its why its not part of the filing. the best link for understanding what happened is actually the court case filing not the media reports. https://www.justice.gov/usao-wdwa/press-relea…

Thanks for writing Cloud Custodian. What are you working on these days?

Still working on custodian, k8s integration up next. else atm. trying to ensure that the next 20 years of opensource are open.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#197

Post by yborg »

united893 wrote: post #89
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

I know that reading the actual linked content on HN is verboten, but the Bloomberg story says

"Thompson was previously an Amazon Web Services employee. She last worked at Amazon in 2016, spokesman Grant Milne said. The breach described by Capitol One didn’t require insider knowledge, he said."

Re: Capital One Says Breach Hit 100M Individuals in U.S

#198

Post by c3534l »

icelancer wrote: post #31
iancarroll wrote: post #10

I downloaded the indictment (edit: complaint, not indictment) from PACER: https://www.dropbox.com/s/z7u5rxcdajuvw6t/19718675504.pdf?dl...

Good lord. -Paige left code used in the "attack" on her GitHub. -Paige left text files with unencrypted data there, too. -Paige openly posted about it in an open (!!!) Slack channel and publicly named her VPN service of choice, which of course, matched access logs AND GitHub server logs. (Also tor, which the FBI agent was able to confirm and add yet another data point) -Paige said "I have a leak proof IPredator route…

I hope the reality is that criminals are really dumb and not that we only catch the really dumb ones.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#199

Post by klarrimore »

shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

The suspect had previously worked for AWS as well.
Post reply on HN