Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#41

Post by cortesoft »

staticassertion wrote: post #22

Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#42

Post by oneplane »

notreallyserio wrote: post #36
thejosh wrote: post #16

Earlier quoted context omitted.

If you were "hacked" (ie password reuse), the attacker can just relimit this.

AWS could simply require the user verify they have access to the card or other payment method on file.

That is super impractical when you run 200 AWS accounts in production.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#43

Post by Sebb767 »

halotrope wrote: post #19
blibble wrote: post #14

their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token

When setting up the token you can scan the QR with multiple devices. E.g YubiKey and Authenticator App. This at least allows for a backup in case one goes missing. I agree it is kind of incredible that multiple tokens are not supported.

You actually can't mix hardware tokens and OTP apps. You're only option is to scan the code twice and skip hardware tokens entirely (which is quite reasonable, as the recovery for an app would be easier than for a failed/lost hardware token).

Note, though, that the new SSO login actually supports MFA in a normal way.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#44

Post by notreallyserio »

oneplane wrote: post #42
notreallyserio wrote: post #36

Earlier quoted context omitted.

AWS could simply require the user verify they have access to the card or other payment method on file.

That is super impractical when you run 200 AWS accounts in production.

Does AWS require distinct billing accounts for each project? I use GCP, I can attach the same account to multiple projects. (It also lacks this basic billing limit feature, unfortunately.)

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#45

Post by 46756e »

cortesoft wrote: post #41
staticassertion wrote: post #22

Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#46

Post by toomanydoubts »

caslon wrote: post #37
Gigachad wrote: post #30

Earlier quoted context omitted.

I don't feel that some kind of quota management or predictable pricing is a significant ask. Most people or orgs do not need instant and infinite scaling. And would rather a 1 hour outage while they sort things out rather than a $100,000 bill for a minor bug.

Don't use a "cloud" vendor then? Just use a VPS vendor.

Should I just rewrite and host stuff like S3, RDS, ECS, Route53, Cloudwatch, Cloudfront, Lambda, etc. just because I want a spending limit?

Your argument makes no sense at all. You may feel like using production-ready hosted cloud services and still want a spending limit. Renting a single VPS might not solve all your issues.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#47

Post by oneplane »

ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

Depends on your needs, scale and experience. If the product doesn't suit you, it's worthless (or very expensive depending on perspective).

If you just want 'a server', then AWS isn't the place to go to.

To elaborate a bit more: I tend to draw the line on IaC. For example: if you're doing GitOps with Terraform and Atlantis, then go for AWS. If not, you're probably not at the point where it makes sense anyway.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#48

Post by jetrink »

thejosh wrote: post #16
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

If you were "hacked" (ie password reuse), the attacker can just relimit this.

There's still a lot they could do around that though, e.g. requiring that billing details be re-entered upon change or sending an email alerting the user with instructions to secure the account if it was not authorized.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#49

Post by oneplane »

jackson1442 wrote: post #3

@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.

You can create rootless organisation-managed child accounts. This is a solved problem.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#50

Post by karmasimida »

spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

Limiting billing is ambiguous. The computation spent is spent, unless AWS can predict how much you are going to cost by even initiating certain operation, which is not going to be straightforward for all the services they provided.
Post reply on HN