Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

311–319 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#311

Earlier quoted context omitted.

> The whole point of moving to a cloud provider it allow the quick setup and deployment of new projects/products There is nothing approaching quick setup and deployment at large banks. Not Citibank, but previously worked for a financial firm that sold a copy of it's back office fund administration stack. Large, on site deployment. It would take a month or two to make a simple DNS change so they could locate the servi…

Yep, sounds like a bank to me. I worked at one of the big 4 for 6 years (way too long, I know) and the experience was horrible. It once took us a full year (no exaggeration) to get a single server allocated...and my group was actually one of the well funded teams

Funding wasn't a problem for the client in my story. They were happy to spend money. I think the initial contract was for X million USD that would have covered something like 5000 support hours on our end (was based on time spent, not per incident) and then after, it was like 300 USD per hour.

Separate project, I know I was billed out at 500 USD per hour 10 years ago. That was working with an exchange. Initially a joint venture, my company decided to divest itself. We sold all the source for the system that we developed and theyd be running to the exchange. We clearly documented our "build" process and requirements. The core part of the system (and as far as I know the only part that ever went live) was a Python app that used very specific modules, but we also had some patches that were submitted upstream, but not yet in public distributions. So, we were very explicit that you need exactly these versions of Python, these explicit versons of the libs and you need to apply our patches to the libs. We had also only developed and tested on a specific version of linux, and made the indication they should use the same, or we couldnt guarantee the software.

Well, we handed all of the source and documentation to the exchange. They, in turn, hired an outside consulting group. For the life of them, they could not get it to work. First question asked was: did you follow the instructions? Response was "of course, do you think we're idiots?"

The assertion that they followed the instructions exactly sent me down around a 3 week debugging session, attempting to reproduce the issues they were having in our office. Starting from scratch and the exact instructions I had written up for them (I was the only author of the Python app that was failing), I could not reproduce the issue.

After 3 weeks of back and forth, escalations on all sides and some thinly veiled accusations of sabotage, I went on site, sat down with the consultant, told him to start from scratch and show me what he'd been doing.

First thing I notice is that he installs the latest version of Python, and latest version of all the extra libs we needed. He'd completely ignored all of our instructions despite telling us the exact opposite!

It took all of 15 minutes to identify and correct the issue. Ended up billing close to 40K USD in support because the contractor didnt follow instructions and, well, lied (intentional or not) about having done so. Never heard a peep about it from management about the hours or questioning the resolution, and as far as I know the exchange paid the bill without question, even in the height of the aftermath of the 2008 crash.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#312
post #96

Earlier quoted context omitted.

They are legally obligated, especially in California, to disclose part or all of this breach to customers. But that obligation is not immediate. Give it some time.

Do they need to notify those of us not located in California?

YMMV, but all 50 U.S. states require some sort of notice for security breaches.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#313

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Misconfigured WAF - see my comment elsewhere here. Correction: according to the complaint, the defendant is alleged to have assumed an IAM role in the context of Capital One's account whose policy provided access to the S3 bucket in question. So it wasn't that the S3 bucket was public, but rather, that there was some vulnerability she took advantage of by which she obtained indirect credentials to it. (Complaint, pag…

Might have been an SSRF exploit if the WAF was accepting parameter values that were then used to expose IAM credentials via the EC2 metadata service. See https://ejj.io/blog/capital-one for a good write-up.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#314

Earlier quoted context omitted.

If this is true, this is a great reason for people to stop using S3 or to start doing daily bucket audits. Or you know, not store PII in the cloud poorly.

Really, sensitive data should not be stored unencrypted. It just shouldn't.

Or on S3, because unencrypted is just an API call away.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#316

Is it just me or is there no mention from Capital One WHERE customers can go to 1) check if they were affected by this breach and 2) what customers who are affected should do?? great way to start the day...

What to do? Freeze your credit!

https://krebsonsecurity.com/2018/09/credit-freezes-are-free-...

Not just for this breach but for all the past and current ones we don’t know about and future ones that will happen.

The real problem is there is zero security/identity management in our financial systems which is beyond nuts in this day and age.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#318
post #276

Earlier quoted context omitted.

Are they even considered programs?

yes, they are programs. They, like most of the truly important software, don't have a UI, but they run none the less.

My point was going to be that these are concepts and protocols rather than programs, and that you would use an actual program (eg TortoiseGit) to actually use it.

But then I read your comment and realised in *nix the program is actually called "git". So I concede :-)

Re: Capital One Says Breach Hit 100M Individuals in U.S

#319
post #285

Earlier quoted context omitted.

Maybe drs shouldn't prescribe meds in such doses if they have such harmful effects?

It's really tough, because not treating gender dysphoria properly can be much more dangerous. It's a severe disorder thats made much, much worse by discrimination. It really seems like a lot of cases of gender dysphoria is more society driven. Younger trans or non-binary kids I know seem to be quite a bit happier than trans folks I know in their 30's. Gender is not inherently tied to sex, and variation in gender expr…

I recommend researching and listening to the growing group of young people (mostly women) who are talking about their experience with desistance.
Post reply on HN