Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

221–230 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#221

Post by giancarlostoro »

mc32 wrote: post #162
united893 wrote: post #89

Earlier quoted context omitted.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

If you put data in the cloud, make sure you encrypt with keys only you have even when they promise all sorts of assurances of oversight and process in addition to “we use AES”.

This right here. Take away any outsiders ability to access things. I also feel AWS and the rest should be able to notify you when files untouched en masse for years are being accessed and it should set off alarms like crazy. If not acted upon then its the issue of whoever got those emails.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#222

Post by faissaloo »

danellis wrote: post #218

This spooked me. I thought I recognized the name, and then I remembered she had recently contacted me out of the blue on meetup.com to ask if I was interested in doing some urban exploration. I said yes, but we never got around to picking a day. Now I'm kind of glad we didn't!

I'd be kinda bummed I didn't

Re: Capital One Says Breach Hit 100M Individuals in U.S

#223

Post by giancarlostoro »

kevin_thibedeau wrote: post #97
united893 wrote: post #89

Earlier quoted context omitted.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

Looks well qualified to run the coding bootcamp in her prison.

Only facing up to 5 years apparently. I wonder if that will change over time. Considering her hack is worse than what Aaron Swartz hacked (not PII) I cant believe she only gets 5 years.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#224

Post by giancarlostoro »

danellis wrote: post #218

This spooked me. I thought I recognized the name, and then I remembered she had recently contacted me out of the blue on meetup.com to ask if I was interested in doing some urban exploration. I said yes, but we never got around to picking a day. Now I'm kind of glad we didn't!

Few years back the FBI arrested people carding throughout the country. Turns out I knew two. One was just good at social engineering but not a dev by any means, I knew him from the private server community.

The other was someone I followed on Tumblr. I was shocked about him being arrested. He was pretty popular on Tumblr and me and him would chat on TinyChat from time to time.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#225

Post by gnicholas »

teej wrote: post #96
hello_asdf wrote: post #80

Why am I finding out about this from the news and not an email from Capital One themselves? I wish there was legal liability to inform customers in the event of a data breach.

They are legally obligated, especially in California, to disclose part or all of this breach to customers. But that obligation is not immediate. Give it some time.

According to the Daily Mail article linked above, they've known since mid-July. They could have issued a statement today if they wanted to. I can understand why they didn't do it earlier, to minimize the number of press cycles with their name attached to this incident.

But if this were my credit card company, I would be pretty irked to be finding out about it weeks after the company knew, from the news.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#226

Post by andeebe »

Hi all. To anyone concerned that Capital One holds your personal data, you can find out if they do by using our free tool. Hope this helps

Apple https://apps.apple.com/gb/app/tap-my-data/id1436042237?mt=8%...

Android https://play.google.com/store/apps/details?id=io.taprewards....

And if you're personal data has been involved in the Capital One breach. Find out what steps you should take next (TLDR):

• Change your usernames and passwords

• Keep an eye on your bank accounts and credit report

• Be wary of any emails regarding the breach

https://tapmydata.com/my-personal-data-has-been-involved-in-...

Re: Capital One Says Breach Hit 100M Individuals in U.S

#228

Post by icelancer »

c3534l wrote: post #198
icelancer wrote: post #31

Earlier quoted context omitted.

Good lord. -Paige left code used in the "attack" on her GitHub. -Paige left text files with unencrypted data there, too. -Paige openly posted about it in an open (!!!) Slack channel and publicly named her VPN service of choice, which of course, matched access logs AND GitHub server logs. (Also tor, which the FBI agent was able to confirm and add yet another data point) -Paige said "I have a leak proof IPredator route…

I hope the reality is that criminals are really dumb and not that we only catch the really dumb ones.

It's both, if that helps.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#229

Post by icelancer »

Nbadal wrote: post #214
grier wrote: post #184

What was Slack's role in all of this? They appear to have turned over historical images and chat logs, not just for the person indicted, but even others in the same channel. Did the FBI ask nicely or was there actually some formal process?

Some of the conversation occurred on her Slack server, which as of an hour or two ago was still completely open/public via an invite linked shared on Meetup. The entire server chat log is a few Google searches away.

Right. It was an open Slack group. It's likely the Special Agent is the source of those logs and photos; no need for Slack to confirm anything except for metadata to authenticate the logs (if that's even necessary for yet another nail in the coffin).

Re: Capital One Says Breach Hit 100M Individuals in U.S

#230

Post by x0x0 »

bagels wrote: post #217
QuinnyPig wrote: post #112

Earlier quoted context omitted.

Unlikely. S3 was publicly rebuilt in the wake of the 2017 S3pocalypse.

What does this refer to?

Some S3 eng accidentally dropped a big chunk of the servers that were the s3 equivalent of an hdfs nameserver, ie mapping blob name to location info, as part of an unrelated config change.

While attempting to recover, the s3 team discovered and/or decided the nameserver needed a full restart. That's when they discovered the info in the nameserver had grown so large since the last full restart years previous that it took far longer than expected to restart the nameserver. Right around that point in time my guess is they realized just how shit their morning was going to be. And their afternoon.

Somewhere in there, they realized that their health dashboard depended on s3 working.

Though to be fair, as an aws customer, we -- along with the rest of internet -- were well aware that stuff was badly broken.

I feel terribly for whoever did this, because IIRC, he or she just fat fingered part of a command in a standard playbook, and the config script had no safeguards. I personally took down a company you've heard of in the exact same way; I knocked all pops off the internet because the config script had a hard requirement around certain values that was neither communicated to me nor checked. And I was trying to figure out wtf I did to a system that I was not particularly familiar with while receiving forwarded texts from the CEO about cascading datacenter down alerts.

Post reply on HN