Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

11–20 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#11

Post by otterley »

otterley wrote: post #3

Anyone have a copy of the complaint handy? I'd love to read the Government's allegations in more detail. (Edited: complaint, not indictment.)

DOJ press release:

https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arr...

""" A former Seattle technology company software engineer was arrested today on a criminal complaint charging computer fraud and abuse for an intrusion on the stored data of Capital One Financial Corporation, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, made her initial appearance in U.S. District Court in Seattle today and was ordered detained pending a hearing on August 1, 2019.

According to the criminal complaint, THOMPSON posted on the information sharing site GitHub about her theft of information from the servers storing Capital One data. The intrusion occurred through a misconfigured web application firewall that enabled access to the data. On July 17, 2019, a GitHub user who saw the post alerted Capital One to the possibility it had suffered a data theft. After determining on July 19, 2019, that there had been an intrusion into its data, Capital One contacted the FBI. Cyber investigators were able to identify THOMPSON as the person who was posting about the data theft. This morning agents executed a search warrant at THOMPSON’s residence and seized electronic storage devices containing a copy of the data. """

Re: Capital One Says Breach Hit 100M Individuals in U.S

#12

Post by [deleted] »

shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

[deleted]

Re: Capital One Says Breach Hit 100M Individuals in U.S

#13

Post by [deleted] »

kevinsundar wrote: post #5
jammygit wrote: post #4

> Capital One Financial Corp. lost data from as many as tens of millions of credit card applications after a Seattle woman hacked into a cloud-computing company server > The cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers I can’t tell whether the company virtual server got hacked or whether the cloud provider was who got breached. Hopefully just the vm

They're on AWS so I doubt the cloud provider got hacked, it would have been a much bigger news story. https://aws.amazon.com/solutions/case-studies/innovators/cap...

[deleted]

Re: Capital One Says Breach Hit 100M Individuals in U.S

#14

Post by UnoriginalGuy »

shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Kind of like the AT&T "hack" wherein just changing the url leaked other customers info.

They were still successfully prosecuted though. And AT&T received no punishment.

When a company says jump the USG asks how high.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#15

Post by otterley »

shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

Misconfigured WAF - see my comment elsewhere here.

Correction: according to the complaint, the defendant is alleged to have assumed an IAM role in the context of Capital One's account whose policy provided access to the S3 bucket in question. So it wasn't that the S3 bucket was public, but rather, that there was some vulnerability she took advantage of by which she obtained indirect credentials to it.

(Complaint, page 6, lines 14-27.)

Re: Capital One Says Breach Hit 100M Individuals in U.S

#16

Post by cfors »

jammygit wrote: post #4

> Capital One Financial Corp. lost data from as many as tens of millions of credit card applications after a Seattle woman hacked into a cloud-computing company server > The cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers I can’t tell whether the company virtual server got hacked or whether the cloud provider was who got breached. Hopefully just the vm

Well, the main cloud Capital One uses is Amazon as far as I know.

If you think about the attack vectors here, it was most definitely the virtual server that got attacked. If it was the cloud provider (Amazon), there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this sort of scenario shouldn't ever happen.

This is a huge blow for the public cloud and financial services companies, unfortunately.

Edit: Seemingly a WAF firewall issue. I wonder what happened. These rules should be applied automatically for Capital One using Cloud Custodian [0], so a config issue definitely occurred somewhere.

Final edit: A leaked account with access to IAM permissions. Good lord was occam's razor correct here.

[0] https://github.com/cloud-custodian/cloud-custodian

Re: Capital One Says Breach Hit 100M Individuals in U.S

#17

Post by ryanmarsh »

otterley wrote: post #11
otterley wrote: post #3

Anyone have a copy of the complaint handy? I'd love to read the Government's allegations in more detail. (Edited: complaint, not indictment.)

DOJ press release: https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arr... """ A former Seattle technology company software engineer was arrested today on a criminal complaint charging computer fraud and abuse for an intrusion on the stored data of Capital One Financial Corporation, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, made her initial appearance in U.S. District Court…

intrusion occurred through a misconfigured web application firewall

The affidavit states “exfiltrating and stealing information, including credit card applications and other documents”.

She used a particular role to exfill from an S3 bucket. Not sure how she got the creds for the role she used to execute List Buckets, etc...

Affidavit shows the accused was an employee at the unnamed cloud vendor (clearly AWS at this point) from 2015 - 2016.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#18

Post by daenz »

shiftpgdn wrote: post #6

> hacked into a cloud-computing company server, federal prosecutors in Seattle said > the cloud-computing company, on whose servers Capital One rented space, wasn’t identified in court papers. Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

If the Seattle "Paige T." is the person with a public Linkedin profile, their recent job history includes "Systems Engineer" at AWS. That could be connected with the breach.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#19

Post by encoderer »

If I came across an s3 bucket with my credit application details and I could delete it, I would probably do it and then report to their security team. It’s MY data security they’re being casual with.

It occurs to me now that if I did that it would likely be a crime because of the harm to the company. The irony.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#20

Post by thinkmassive »

otterley wrote: post #11
otterley wrote: post #3

Anyone have a copy of the complaint handy? I'd love to read the Government's allegations in more detail. (Edited: complaint, not indictment.)

DOJ press release: https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arr... """ A former Seattle technology company software engineer was arrested today on a criminal complaint charging computer fraud and abuse for an intrusion on the stored data of Capital One Financial Corporation, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, made her initial appearance in U.S. District Court…

Sounds less like intrusion and more like accidental exposure by Capital One.
Post reply on HN