Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tragic story – AWS hacked account

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Tragic story – AWS hacked account

#21

Post by TheJCDenton »

First, i'm sorry for your son.

I've been hacked a few years ago. But it was in the several tens of thousand of dollars (for me in a matter of hours). I've deactivated my account while the hacker was using it.

It took a stressful week to settle the matter with AWS. And not at any point i've been in a position to influence anything. I was just there for the ride. In the end they erased the debt.

A few years after that, i've reactivated my account. Some leftover resources were there, so i cleaned but i missed some, resulting in another charge, less expensive. I've requested to be reimbursed. First they objected, but then with some references to the previous incident i gave them they complied.

Do not give up. Do not pay.

Re: Tragic story – AWS hacked account

#22

Post by londons_explore »

quickthrower2 wrote: post #19
londons_explore wrote: post #8

Earlier quoted context omitted.

Not paying a debt and walking away isn't a criminal offence. Signing up again under a different name to continue using the service you have been banned from could be considered fraud by misrepresentation, which in most places is a fairly serious criminal offence (even though it is very unlikely to be prosecuted in this case).

What if you start a corp and that corp signs up?

Ask a real lawyer...

Re: Tragic story – AWS hacked account

#23

Post by jakozaur »

1. If you put credit card, do chargeback and put your card on hold. Do not accept payment unless your lawyer tell you to do so.

2. Hire a lawyer. Make sure lawyer is competent in objecting all collection agencies.

3. Make it go viral. Try to reach out community to make story around it, like https://twitter.com/quinnypig

Re: Tragic story – AWS hacked account

#24

Post by rl1987 »

ashtadmir wrote: post #6
londons_explore wrote: post #5

As far as I know, AWS does not take debts to court. Just remove the credit card from the account and let them suspend it indefinitely. Beware that you will lose anything you had stored on the account. If you really need Amazon, set up a new account with a new email address, although I'd stay away from AWS.

It would be helpful if you explain why you would stay away from aws.

Cybercrime aside, AWS is almost always not worthwhile for small business or individual use. Issues like opaque billing, devops complexity and vendor lock-in go away immediately if you switch to Digital Ocean or one of the many simpler and cheaper cloud providers. Unless you are building something that is specific to AWS, relying on AWS as individual/small company is like buying enterprise router from Cisco or Fortinet for your home network - technically nothing is stopping you from doing so, but it's an overkill.

Re: Tragic story – AWS hacked account

#25

Post by hvgk »

nouxious wrote: post #3
donkarma wrote: post #2

I would try to get a different support agent first and see if their tone changes

I had 6 agents in total. They were all tone deaf. It feels like I am corresponding with a bot.

If it’s any consolation the enterprise support guys aren’t any better.

Threatening to move to Azure is about the only move that works.

Re: Tragic story – AWS hacked account

#26

Post by spacemanmatt »

trs8080 wrote: post #18
verifyitnow wrote: post #7

It is called recurring payment scam. Amazon chose to extend credit by letting your account build up instead of suspending your account. You did not ask for a thousands of dollars credit line. I would write a letter to your state attorney generals office telling them that scamazon web services is running a recurring payment scam in your state. Probably the AWS managers running this are foreigners and dont give a shit…

> Probably the AWS managers running this are foreigners and dont give a shit about this country's laws. Incredible.

Ask someone from Bopal, it's unbelievable that a corporation would disrespect the local law where they do business.

Re: Tragic story – AWS hacked account

#27

Post by anpat »

verifyitnow wrote: post #7

It is called recurring payment scam. Amazon chose to extend credit by letting your account build up instead of suspending your account. You did not ask for a thousands of dollars credit line. I would write a letter to your state attorney generals office telling them that scamazon web services is running a recurring payment scam in your state. Probably the AWS managers running this are foreigners and dont give a shit…

Please don’t use someone else’s tough situation to further your tirade.

Re: Tragic story – AWS hacked account

#29

Post by isbvhodnvemrwvn »

BOOSTERHIDROGEN wrote: post #28

Sorry for your lost. For others, how do I prevent this? Any tips? Thanks.

- use a hardware MFA device like Yubikey (note: you can only register one hardware device, because AWS fucked up their implementation)

- if you can't use hardware MFA for whatever reason, use TOTP (this allows backing up your MFA)

- don't use the root account for anything other than creating less privileged users (ideally create an admin user that can do that, and never use your root account anymore, and only use the admin account to set up users)

- the other users should use the principle of least privilege (only access to actions X, Y to resources Z, Ż, Ź)

- if you can at all get rid of using access keys (e.g. via using roles), then do so

- if you can't, never share them with anybody (don't commit it to git repos, that's for sure)

The two first points are crucial, and I've never heard of an account fully compromised without sharing access keys that had MFA set up.

For more details:

https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practi...

Re: Tragic story – AWS hacked account

#30

Post by traceroute66 »

jakozaur wrote: post #23

1. If you put credit card, do chargeback and put your card on hold. Do not accept payment unless your lawyer tell you to do so. 2. Hire a lawyer. Make sure lawyer is competent in objecting all collection agencies. 3. Make it go viral. Try to reach out community to make story around it, like https://twitter.com/quinnypig

> If you put credit card, do chargeback and put your card on hold.

I'm sorry, but this is poor advice.

As per the Visa website, definition of a chargeback:

     "A chargeback (otherwise known as a dispute) is a way for your bank that issued your card to reclaim money from the retailer’s bank when you do not get the goods or services you paid for, including if the retailer or supplier has gone out of business."
Therefore:

     - If the cardholder knowingly signed up to AWS, then this is not a vaild reason for a chargeback.
     - If the cardholder knowingly activated chargeable AWS services, then this is not a vaild reason for a chargeback.
     - If AWS delivered the activated chargeable AWS services as requested, then this is not a valid reason for a chargeback.
     - In AWS case, did the cardholder take sufficient steps to secure their account (most banks these days have a security clause in their agreements).
The correct and only way to solve this is through entering discussions with AWS. And, if you are insistent on spending money on lawyers, don't waste the lawyer's time on card chargebacks, get the lawyer to engage with AWS Legal instead.

Don't abuse / misuse credit card chargebacks. It only ends up making life more difficult for the rest of us because the only thing that will happen is banks and card issuers will make people jump through even more hoops to "prove it".

Post reply on HN