Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

61–70 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#61
post #45

Earlier quoted context omitted.

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

If you’re using Stripe or PayPal then yes it is the store owner who would be “picking up the bill”.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#62

Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…

I'm surprised MFA isn't mandated by default. It is in Azure:

https://docs.microsoft.com/en-us/azure/active-directory/fund...

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#64
post #29

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

That is not true, you can setup a budget, and billing alerts.

And these can then be turned off by the hacker.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#66
post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

It says here that closing your account isn't enough:

> Closing your account might not automatically terminate all your active resources. You might continue to incur charges for some of your active resources even after you close your account.

https://aws.amazon.com/premiumsupport/knowledge-center/termi...

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#67
This happened to me. I had a 9k bill and I got hacked and stuck with it on my personal account. I gave AWS $100k business and that did not matter through being a decision maker at a startup I work at. AWS does not care about your business unless you are going to IPO. True story. Feel free to message me at Sgargconsulting --> GMAIL

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#68
post #58

Earlier quoted context omitted.

Jeff Bezos did not become a billionaire by being user-friendly. Guess anyone trying to cancel their Amazon Prime subscription would agree.

>Guess anyone trying to cancel their Amazon Prime subscription would agree. The unsubscribe button was easy enough to find, but had to maybe go through 2 nag screens before letting me cancel. I guess it's not pro-user, but it's also not exactly a roadblock to me canceling.

Well, it's not a roadblock but it's a dark-pattern and user hostile. Just like the lack of spending limits on AWS.

Compare that to the experience of unsubscribing from netflix, for instance.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#69
post #45

Earlier quoted context omitted.

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

[deleted]

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#70

I know it's easy to get lazy about checking your AWS billing dashboard but I do it once a week - you can set up alerts and whatnot but I find it easier just to go look at the current usage to make sure nothing has gone awry.

I think the point is that someone could bankrupt the average hobbyist in an hour or two, if they were expected to pay it.
Post reply on HN