Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#71

Post by dzhiurgis »

guywhocodes wrote: post #13
ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

I shutdown the credit card i was using. They're intentionally making it hard and I decided it was less work to update payment methods on everything else.

Good point. I probably should replace all the credit cards I have with temporary ones...

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#72

Post by stephbu »

thejosh wrote: post #16
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

If you were "hacked" (ie password reuse), the attacker can just relimit this.

Just as likely as basic credential compromise is lateral attacks on compute resources from vulnerabilities such as Log4J.

Enabling MFA, restricting intra/inter-VPC access, removing hard-coding credentials from configuration files/source etc., switching to SSO/removing user accounts with passwords, creating and applying restricted IAM roles, and applying those reduced privileges to EC2/ECS/EKS instances are all things that and should be done as soon as possible. (Non-exhaustive, but illustrative list)

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#73

Post by gruez »

toomanydoubts wrote: post #68
gruez wrote: post #58

Earlier quoted context omitted.

>Guess anyone trying to cancel their Amazon Prime subscription would agree. The unsubscribe button was easy enough to find, but had to maybe go through 2 nag screens before letting me cancel. I guess it's not pro-user, but it's also not exactly a roadblock to me canceling.

Well, it's not a roadblock but it's a dark-pattern and user hostile. Just like the lack of spending limits on AWS. Compare that to the experience of unsubscribing from netflix, for instance.

> Well, it's not a roadblock but it's a dark-pattern and user hostile. Just like the lack of spending limits on AWS.

Yeah I explicitly say it wasn't pro user. I was more disputing the "Jeff Bezos did not become a billionaire" (presumably by making it hard to cancel prime) part.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#74

Post by [deleted] »

46756e wrote: post #45
cortesoft wrote: post #41

Earlier quoted context omitted.

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

[deleted]

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#75

Post by Kranar »

46756e wrote: post #45
cortesoft wrote: post #41

Earlier quoted context omitted.

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

This is just untrue though, my company has to eat the cost of fraudulent transactions and the burden is squarely on us to prevent it.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#76

Post by Retric »

oneplane wrote: post #42
notreallyserio wrote: post #36

Earlier quoted context omitted.

AWS could simply require the user verify they have access to the card or other payment method on file.

That is super impractical when you run 200 AWS accounts in production.

The option to set a limit doesn’t require you to set one. Assure lets users have a limit without any significant issues.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#77

Post by toomanydoubts »

gruez wrote: post #73
toomanydoubts wrote: post #68

Earlier quoted context omitted.

Well, it's not a roadblock but it's a dark-pattern and user hostile. Just like the lack of spending limits on AWS. Compare that to the experience of unsubscribing from netflix, for instance.

> Well, it's not a roadblock but it's a dark-pattern and user hostile. Just like the lack of spending limits on AWS. Yeah I explicitly say it wasn't pro user. I was more disputing the "Jeff Bezos did not become a billionaire" (presumably by making it hard to cancel prime) part.

Well, I didn't really mean to say that what made him a billionaire was making it hard to cancel amazon prime, that was just an example I came up with that demonstrates Amazon general stance on user-friendliness.

Still, I'm not sure I understand what you're trying to dispute. If we agree with both premises(1. Bezos is a billionaire and 2. Amazon products aren't usually user-friendly), than I maintain my position that the expression "Jeff Bezos did not become a billionaire by being user-friendly" evaluates to true.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#78

Post by zinekeller »

technion wrote: post #62
staticassertion wrote: post #22

Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…

I'm surprised MFA isn't mandated by default. It is in Azure: https://docs.microsoft.com/en-us/azure/active-directory/fund...

That link looks like MFA can be disabled but this chart shows otherwise (baseline versus opt-in enhanced): https://docs.microsoft.com/en-us/azure/active-directory/fund...

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#79

Post by gruez »

toomanydoubts wrote: post #77
gruez wrote: post #73

Earlier quoted context omitted.

> Well, it's not a roadblock but it's a dark-pattern and user hostile. Just like the lack of spending limits on AWS. Yeah I explicitly say it wasn't pro user. I was more disputing the "Jeff Bezos did not become a billionaire" (presumably by making it hard to cancel prime) part.

Well, I didn't really mean to say that what made him a billionaire was making it hard to cancel amazon prime, that was just an example I came up with that demonstrates Amazon general stance on user-friendliness. Still, I'm not sure I understand what you're trying to dispute. If we agree with both premises(1. Bezos is a billionaire and 2. Amazon products aren't usually user-friendly), than I maintain my position that…

fair enough.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#80

Post by derefr »

karmasimida wrote: post #50
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

Limiting billing is ambiguous. The computation spent is spent, unless AWS can predict how much you are going to cost by even initiating certain operation, which is not going to be straightforward for all the services they provided.

In theory, all IaaS services could be built like an Ethereum node:

1. fill an account with abstract "multi-resource usage credits" (or gas);

2. have each API call specify how many credits the caller is willing to spend from their account on the operation (a gas limit);

3. operations in progress are tracked using real-time resource accounting (= distributed tracing, but cheap-as-possible at the expense of granularity);

4. any operation that goes over-budget is cancelled (even if it completed successfully, the user doesn't get the benefit of that completion), with the user being charged exactly the limit they specified.

(Yes, that means that the IaaS eats the overhead costs of any additional processing they did before noticing and stopping the workload going beyond its limit. This incentivizes the IaaS to optimize their scheduling, at all levels of the stack, to minimize the amount of "overhang" work it allows.)

And yes, to be clear, this would "infect" every layer of every service. If the IaaS provided a DBaaS, the DB's query planning and execution layers would need to know about these limits and accounting mechanisms. Etc.

I'm not saying it's practical. But it's definitely possible, with no foreknowledge of cost.

Post reply on HN