Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

31–40 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#31
post #29

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

That is not true, you can setup a budget, and billing alerts.

AFAIK setting a budget or alerts does not say "Not authorized to spend more than X amount, deny any spending over this limit". It will alert you, yes. (Also, not on by default)

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#32
post #29

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

That is not true, you can setup a budget, and billing alerts.

This does not stop the high bills from your account being hacked. Just reduces the amount before you notice. spinngin up gpu and ec2 resources until limits are hit in how many are created is an operation that takes seconds.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#33
post #29

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

That is not true, you can setup a budget, and billing alerts.

Can you set a "hard" budget? Like, never let me get more than $20/mo in services from AWS and after that just disable my account?

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#34
post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

AWS is great if you have a very large infrastructure budget. Playing around on a test AWS account where thousand dollars plus or minus is no big deal is a lot of fun. Playing around while trying to keep the bill under 10$ is just torture.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#35
MFA needs to be forced on by default for all new accounts created with the UI. It is utterly irresponsible for AWS to not do this. People always counter with "you should know better!" But AWS markets itself to college kids. People were all up in arms and Robinhood allowing 18 year olds to create accounts which could result in unbounded losses, but AWS somehow gets a pass?

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#36
post #16

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

If you were "hacked" (ie password reuse), the attacker can just relimit this.

AWS could simply require the user verify they have access to the card or other payment method on file.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#37

Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…

I don't feel that some kind of quota management or predictable pricing is a significant ask. Most people or orgs do not need instant and infinite scaling. And would rather a 1 hour outage while they sort things out rather than a $100,000 bill for a minor bug.

Don't use a "cloud" vendor then? Just use a VPS vendor.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#38
post #29

Earlier quoted context omitted.

That is not true, you can setup a budget, and billing alerts.

Can you set a "hard" budget? Like, never let me get more than $20/mo in services from AWS and after that just disable my account?

No, that's not possible.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#39
post #14

their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token

When setting up the token you can scan the QR with multiple devices. E.g YubiKey and Authenticator App. This at least allows for a backup in case one goes missing. I agree it is kind of incredible that multiple tokens are not supported.

Don't token limits reduce attack surface?

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#40

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

They should either add technical measures to prevent overcharging on these types of accounts, or amend the terms of service to explicitly say that the account owner is not liable for charges incurred by an unauthorised user who obtains user credentials.

I find it hard to fathom that a company which sells machine learning as a service cannot detect that an account sitting dormant for months, which suddenly spins up several large VMs, has been compromised.

It's unsatisfactory that the only recourse is hoping for a favourable exercise of discretion on Amazon's part to waive the charges.

Post reply on HN