231–240 of 319 posts
This spooked me. I thought I recognized the name, and then I remembered she had recently contacted me out of the blue on meetup.com to ask if I was interested in doing some urban exploration. I said yes, but we never got around to picking a day. Now I'm kind of glad we didn't!
Earlier quoted context omitted.
Miss the LevelMoney folks... Yeah AWS can’t protect you against a misconfigured environment
Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.
Earlier quoted context omitted.
Looks well qualified to run the coding bootcamp in her prison.
Only facing up to 5 years apparently. I wonder if that will change over time. Considering her hack is worse than what Aaron Swartz hacked (not PII) I cant believe she only gets 5 years.
Violation of copyright would appear to be a significantly worse offense according to present US law.
Earlier quoted context omitted.
FYI, getting a $125 check from Equifax is contingent on most of the people that are eligible to get one not actually requesting it. It'll probably be less
Yeah, there's only $31M allocated for those payouts :/
Earlier quoted context omitted.
I think the point is: unless the hacker is already aware of how to sell PII of this nature and how to move "good money" then a hack like this is for naught. Reading the mistakes made in the hack itself makes me wonder if black markets and money laundering are a skill they posses.
I think you could just sign up on one of the onion drug/fraud markets for ~$500 vendor deposit and put up a listing for those profiles at like $5-10 a pop. If you were lazy you could just hit up an existing vendor and ask them to sell your data in batches. I’m not saying this would be a good idea, but it certainly wouldn’t be very difficult.
This will just intensely increase the scrutiny of where the data came from and they'd likely be caught anyway, unless they did a very clean job security-wise. Which very few people seem to be able to do when the feds really want you.
Moving to Russia or another country without extradition treaties would probably be a good first step of that plan.
Earlier quoted context omitted.
Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png
I know that reading the actual linked content on HN is verboten, but the Bloomberg story says "Thompson was previously an Amazon Web Services employee. She last worked at Amazon in 2016, spokesman Grant Milne said. The breach described by Capitol One didn’t require insider knowledge, he said."
(If I could query all AWS permissions for publicly exploitable permissions, that would comply, for example.)
Earlier quoted context omitted.
Only facing up to 5 years apparently. I wonder if that will change over time. Considering her hack is worse than what Aaron Swartz hacked (not PII) I cant believe she only gets 5 years.
> worse than what Aaron Swartz hacked (not PII) Violation of copyright would appear to be a significantly worse offense according to present US law.
In point of fact, the prosecutor on Swartz case (Stephen Heymann) had previous authored an article describing how the Internet age allowed crime to scale, enabling hackers to commit thousands of criminal acts per second. It's my personal belief that Heymann wanted to use Swartz' case as a validation of this belief.
(Source: The Idealist: Aaron Swartz and the Rise of Free Culture on the Internet, ISBN 978-1476767727)
> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.
Misconfigured WAF - see my comment elsewhere here. Correction: according to the complaint, the defendant is alleged to have assumed an IAM role in the context of Capital One's account whose policy provided access to the S3 bucket in question. So it wasn't that the S3 bucket was public, but rather, that there was some vulnerability she took advantage of by which she obtained indirect credentials to it. (Complaint, pag…
Earlier quoted context omitted.
They should not be letting egress traffic through to a Tor node.
Is there enough space in an S3 bucket access policy to include DENY rules for every known Tor IP address?
Earlier quoted context omitted.
"there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this sort of scenario shouldn't ever happen." ROTFLMAO....you have clearly never worked for a bank, no offense mate. Capital left this shit in plain text on an S3 bucket, I guarantee you
If you took ten seconds to look at the posted source note above, you would see Cloud Custodian has a policy to enforce bucket encryption.
There, I gave you more than 10 seconds. Trying keeping up.