Why the cliffhanger? Why not just finish your thought? As is, this story provides nothing other than showing the Amazon provided some helpful customer service.
$5,000 Security Breach
11–20 of 26 posts
Re: $5,000 Security Breach
#12The instance was spun up on April 2, but Heartbleed wasn't disclosed for almost a week later. I highly doubt anybody used the Heartbleed 0-day to access your account.
According to Cloudflare ( http://blog.cloudflare.com/answering-the-critical-question-c... ), exploiting heartbleed may actually be very difficult. So yeah, it's very unlikely for that to have happened.
Well, getting an SSL private key is difficult as they don't often get into memory and are quite long (difficult to get from 64k at a time). Whereas AWS credential keys are something that get into your servers RAM much more frequently and are shorter strings. So it could easily be remote memory exploitation. But more likely social engineering or some other easy path in.
Re: $5,000 Security Breach
#13>'They' spin up spot instances which isn't subject to Billing Alerts. You'll need to cancel those spot instances, revoke your AWS credentials, and change your account password," he said. This doesn't make sense at all. Amazon should let us if monthly bill > X send me a priority email and phone call. Why do they hide behind these dark patterns? I thought they were better than that.
[deleted]
Re: $5,000 Security Breach
#14>"'They' spin up spot instances which isn't subject to Billing Alerts. Spot Instances aren't subject to AWS Billing Alerts? Is this common knowledge?
I'm not sure it's true.
Re: $5,000 Security Breach
#15Earlier quoted context omitted.
According to Cloudflare ( http://blog.cloudflare.com/answering-the-critical-question-c... ), exploiting heartbleed may actually be very difficult. So yeah, it's very unlikely for that to have happened.
Well, getting an SSL private key is difficult as they don't often get into memory and are quite long (difficult to get from 64k at a time). Whereas AWS credential keys are something that get into your servers RAM much more frequently and are shorter strings. So it could easily be remote memory exploitation. But more likely social engineering or some other easy path in.
People accidentally send those keys off to Github all the time. I'd suspect that sort of thing.
Re: $5,000 Security Breach
#16Another reminder to be extra careful about checking in AWS credentials into version control. You never know when you might open source that repository and someone can easily yank it from Github.
Actually this is what happened to us... our AWS credentials had accidentally been put into Github for a hackathon project several months ago.
Coincidentally, the incident also occurred around the same time (April 1-2). We were hit with $13,000 worth of EC2 usage before we shut them down and changed our AWS key... We reported to Amazon, and they are working on a refund.
Re: $5,000 Security Breach
#17A similar thing happened to me when I made public a previously private repo on Amazon and forgot to scrub it for AWS key. Luckily I got an email from Amazon within 24 hours of the instances being started, and as such my bill was just $360, which in any case they waived off.
You might want to check your Github repos.
Re: $5,000 Security Breach
#18I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
Re: $5,000 Security Breach
#19Earlier quoted context omitted.
According to Cloudflare ( http://blog.cloudflare.com/answering-the-critical-question-c... ), exploiting heartbleed may actually be very difficult. So yeah, it's very unlikely for that to have happened.
Well, getting an SSL private key is difficult as they don't often get into memory and are quite long (difficult to get from 64k at a time). Whereas AWS credential keys are something that get into your servers RAM much more frequently and are shorter strings. So it could easily be remote memory exploitation. But more likely social engineering or some other easy path in.
Heartbleed only exposed SSL memory (like incoming or outcoming connections), but not other memory (particularly not program memory), containing AWS keys.
Re: $5,000 Security Breach
#20I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.