Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

301–310 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#301

Post by lanstin »

floatingatoll wrote: post #298
Ajedi32 wrote: post #273

Earlier quoted context omitted.

The AWS spokesman quoted in the article also explicitly says it wasn't a vulnerability.

Do you consider an access control misconfiguration to be a vulnerability? Does Amazon? Point stands; they’re being very careful to say that there aren’t any CVEs, but they are also very carefully not saying whether she abused the privileges of her role to identify misconfigurations more rapidly than she could have otherwise.

Detailed knowledge of a system gives you all kinds of knowledge about how to exploit it. You don't need special access if you know X% of users misconfigure feature Y.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#302

Post by lanstin »

efdee wrote: post #276
damontal wrote: post #126

Earlier quoted context omitted.

Are Git and SVN really considered IDEs?

Are they even considered programs?

yes, they are programs. They, like most of the truly important software, don't have a UI, but they run none the less.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#303

Post by lanstin »

bifrost wrote: post #193
jorblumesea wrote: post #111

Earlier quoted context omitted.

Not sure if this is a reputable source: https://heavy.com/news/2019/07/paige-adele-thompson/ But sounds like she's an engineer that used to work in aws, specifically S3. If true, seems likely as she would have insider knowledge of existing attack vectors and possibly vulns. Maybe even using something we discovered while on the job.

If this is true, this is a great reason for people to stop using S3 or to start doing daily bucket audits. Or you know, not store PII in the cloud poorly.

Really, sensitive data should not be stored unencrypted. It just shouldn't.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#304

Post by floatingatoll »

lanstin wrote: post #301
floatingatoll wrote: post #298

Earlier quoted context omitted.

Do you consider an access control misconfiguration to be a vulnerability? Does Amazon? Point stands; they’re being very careful to say that there aren’t any CVEs, but they are also very carefully not saying whether she abused the privileges of her role to identify misconfigurations more rapidly than she could have otherwise.

Detailed knowledge of a system gives you all kinds of knowledge about how to exploit it. You don't need special access if you know X% of users misconfigure feature Y.

It's not about knowing that X% are misconfigured, it's about whether special access or circumstances led to locating them more efficiently than the general public could have.

Special access can make the difference between "locating X% of misconfigured users in a single admin panel query" and "locating X% of misconfigured users by scanning every S3 bucket in existence without being caught".

Or to draw a weak analogy, knowing that a closed-source PRNG algorithm is defective does not necessarily help locate all keys generated by it, but having access to force it to generate numbers for you (or to study its source code) absolutely does help.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#306

Post by x0x0 »

mywittyname wrote: post #270
x0x0 wrote: post #230

Earlier quoted context omitted.

Some S3 eng accidentally dropped a big chunk of the servers that were the s3 equivalent of an hdfs nameserver, ie mapping blob name to location info, as part of an unrelated config change. While attempting to recover, the s3 team discovered and/or decided the nameserver needed a full restart. That's when they discovered the info in the nameserver had grown so large since the last full restart years previous that it t…

If you don't mind me asking, what was the punishment for what you did?

Just taking the company dark and being personally embarrassed. There was no punishment, though there was a lot of teasing. Also spending 4-ish weeks cleaning up the mess that was made.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#307

Post by rectalogic »

roseway4 wrote: post #50
shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Per the complaint, it doesn't sound like the bucket was exposed to the world. Rather, security credentials were "obtained": > Capital One determined that the first command, when executed, obtained security credentials for an account named XXXX-WAF-Role, that in turn, enabled access to certain of Capital One's folders at the Cloud Computing Company. Unsure how one would obtain credentials for an IAM Role, but the abov…

If it's an instance role and you are on the EC2 instance, then "curl http://169.254.169.254/latest/meta-data/iam/security-credent... will return the credentials.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#308

Post by pravinva »

Graham24 wrote: post #245
mc32 wrote: post #162

Earlier quoted context omitted.

If you put data in the cloud, make sure you encrypt with keys only you have even when they promise all sorts of assurances of oversight and process in addition to “we use AES”.

If you put data in the cloud... assume it is no longer private.

As opposed to on your computer connected to the internet?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#309

Post by rasz »

amyjess wrote: post #300
rasz wrote: post #247

Earlier quoted context omitted.

I wonder if it could be an effective legal defense for her, akin to plot of Soderbergh Side Effects (2013). "not guilty by reason of insanity" due to hormonal treatment, there are precedents https://www.charlotteobserver.com/news/local/crime/article64... https://ps.psychiatryonline.org/doi/full/10.1176/appi.ps.53.... https://www.mercurynews.com/2012/08/21/man-acquitted-after-a...

As a transgender person, I can tell you that estradiol absolutely cannot induce insanity. At the absolute most , it can screw with your emotions in the same exact ways as PMS (and PMS is indeed caused by hormonal fluctuations). The idea that it's on the same level as ambien is absurd.

NGRI is just a legal term covering committing a crime while not in full possession of ones faculties, not limited to the put me in the cuckoo house stuff people tend to associate with the word.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#310

Post by lawnchair_larry »

JudgeWapner wrote: post #250
lawnchair_larry wrote: post #151

Earlier quoted context omitted.

Data security professionals don’t make these decisions, random developers do. And they do what is easiest.

At most large companies, IT sets the policy and developers are required to work within that policy. I've worked at about 10 jobs. The only one where devs could write their own ticket was a startup

IT doesn’t have any involvement when it comes to S3 buckets at any company I’ve seen. Anything in a cloud tenancy is devops acting with autonomy. Sometimes they have a security person review it, but many companies don’t do that, and the ones that do have way more moving parts than their security engineers are capable of reviewing, so stuff gets through.

Even then, it’s unlikely that a security person would recommend compartmentalizing this particular data set. Any application that needs access to some of it probably needs access to all of it, and it makes little difference if you compromise a server and get one key or if you get 30 keys. The trust boundaries haven’t moved, so it would increase cost without really mitigating any threats.

Post reply on HN