Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

271–280 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#271

Post by jcims »

40acres wrote: post #35

Generally it's not a good idea to sabotage your employer's clients, but I wonder how many engineers across the Big 3 US cloud providers have the know-how to exploit holes in how Forture 500 companies use their platforms.

If you include professional services in that list then the number is quite high. Also, keep in mind that many AWS services are composed of other AWS services, and in that composition there are services and infrastructure operating within AWS to manage it. All of that will operate on some type of maturity curve and sometimes be backed by an alarmingly small team.

So my recommendation is only use AWS services that have been included in compliance certifications that are important to you: https://aws.amazon.com/compliance/services-in-scope/

That of course doesn't mean you won't get hacked, but there's at least some evidence that the service is operated in accordance within AWS control standards, which are generally quite good and should minimize your exposure to rogue admins run amok.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#272

Post by ivl »

joekrill wrote: post #266

The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says: > No bank account numbers or Social Security numbers were compromised, other than: Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" - which is the primary reason folks are worried about this! To me, the…

I'm not sure I agree. The ", other than:" portion was also bolded, and the line

> We will notify affected individuals through a variety of channels.

Gives me some confidence the very small subset of individuals who should be worried about those much more exploitable leaks will be informed and offered assistance.

But as another Capital One customer I'm quite irked I can't just query a simple page to find out what data of mine was leaked, if any.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#273

Post by Ajedi32 »

floatingatoll wrote: post #236
yborg wrote: post #197

Earlier quoted context omitted.

I know that reading the actual linked content on HN is verboten, but the Bloomberg story says "Thompson was previously an Amazon Web Services employee. She last worked at Amazon in 2016, spokesman Grant Milne said. The breach described by Capitol One didn’t require insider knowledge, he said."

“Didn’t require” is a very precise way of stating a truth about the vulnerability that was exploited, while neither confirming nor denying whether her role at Amazon was in some way responsible for her discovering the vulnerability. (If I could query all AWS permissions for publicly exploitable permissions, that would comply, for example.)

The AWS spokesman quoted in the article also explicitly says it wasn't a vulnerability.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#274

Post by ryanlol »

Scoundreller wrote: post #117
ivyivy wrote: post #92

Earlier quoted context omitted.

Do you mean ingress? You probably wouldn’t want to allow ingress or egress, but the statement says connecting from a TOR exit node to CapitalOne, not the other way around.

Sometimes the best way to handle "bad" traffic is not to reject/block it, but to respond to it incredibly slowly, or divert to an uninteresting flaky phantom server, or reject every login attempt (even with correct credentials) to divert attacker's attention. The ingress was okay, but the egress flow was very very bad!

That seems like a great way to waste your own time accomplishing nothing.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#275

Post by kyrra »

joekrill wrote: post #266

The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says: > No bank account numbers or Social Security numbers were compromised, other than: Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" - which is the primary reason folks are worried about this! To me, the…

But the those 140k and 80k number are their own bullet points that I feel make them stand out more then the bold line. I feel like this is clear enough.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#276

Post by efdee »

damontal wrote: post #126
united893 wrote: post #89

Earlier quoted context omitted.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

Are Git and SVN really considered IDEs?

Are they even considered programs?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#278

Post by uxp100 »

notus wrote: post #105
united893 wrote: post #89

Earlier quoted context omitted.

Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume I won't link it here, but here's a screenshot of a snippet: https://i.imgur.com/NezWVKw.png

Oh cool I use the same LaTeX template as her for my resume. Mine is blue instead of pink though! https://github.com/posquit0/Awesome-CV

I feel modern CV is a little clumsy. Especially how it handles columns. You like this better? The example provided I don't love, but I'm not a designer, it looks good enough I think.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#279

Post by david_draco »

icelancer wrote: post #31
iancarroll wrote: post #10

I downloaded the indictment (edit: complaint, not indictment) from PACER: https://www.dropbox.com/s/z7u5rxcdajuvw6t/19718675504.pdf?dl...

Good lord. -Paige left code used in the "attack" on her GitHub. -Paige left text files with unencrypted data there, too. -Paige openly posted about it in an open (!!!) Slack channel and publicly named her VPN service of choice, which of course, matched access logs AND GitHub server logs. (Also tor, which the FBI agent was able to confirm and add yet another data point) -Paige said "I have a leak proof IPredator route…

Why do you use first name here instead of last?

No one calls Snowden just Edward, this comes across as a form of degrading women to girls.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#280

Post by samstave »

acdha wrote: post #264
samstave wrote: post #177

Earlier quoted context omitted.

i know, this was a few years ago, and these types of practices were still being developed out in the greater community (lambda didnt exist yet, dockeer was still nascient etc)

I’m sympathetic in that a lot of people started learning this on the fly but that was widely recognized as bad practice even before Amazon was founded and various patterns for doing it right were widely established. (If anyone needs me, I’m busy feeling old after remembering having this conversation with a new PHP developer in 1998)

Haha, agreed...

He was a remote worker and aparently had a poor handler on our end. I was head of ops not in dev, so i just had to deal with the fallout.

Post reply on HN