Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#1

Post by Kpourdeilami » Tue, Jan 04, 2022, 12:45 AM UTC

I have been seeing a lot of posts on Reddit and other forums of mostly students setting up an AWS account only for them to be hacked and account owner being stuck with a significant bill.

Most likely scenario is hackers are trying leaked username/password pairs from other breaches against AWS and gaining access to those accounts.

They then spin up EC2 instances in all sorts of regions on the compromised accounts

PSA set up MFA on your account if you haven't already.

Some examples:

https://www.reddit.com/r/aws/comments/rv3lm5/i_lost_55k_from...

https://www.reddit.com/r/aws/comments/rvbncu/account_hacked_...

https://www.reddit.com/r/aws/comments/qx8i02/got_hacked_and_...

https://www.reddit.com/r/aws/comments/rv4mnq/my_account_was_...

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#2

Post by Aeolun » Tue, Jan 04, 2022, 12:57 AM UTC

I find it hard to believe AWS would try to suck blood from a stone. I’m willing to believe they get a 55k bill, but do they actually end up paying those?

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#3

Post by jackson1442 » Tue, Jan 04, 2022, 12:57 AM UTC

@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#4

Post by stevespang » Tue, Jan 04, 2022, 1:02 AM UTC

Aeolun wrote: post #2

I find it hard to believe AWS would try to suck blood from a stone. I’m willing to believe they get a 55k bill, but do they actually end up paying those?

No post body was provided.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#5

Post by NikolaeVarius » Tue, Jan 04, 2022, 1:03 AM UTC

Aeolun wrote: post #2

I find it hard to believe AWS would try to suck blood from a stone. I’m willing to believe they get a 55k bill, but do they actually end up paying those?

No.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#6

Post by smackeyacky » Tue, Jan 04, 2022, 1:07 AM UTC

jackson1442 wrote: post #3

@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.

You just reminded me to set up MFA on my root account so thanks!

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#7

Post by ujetin » Tue, Jan 04, 2022, 1:08 AM UTC

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account.

I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, it seems much more fun and startupish than aws, which appears to be all of the corporate stuff I left (AIMs etc). This is funny because I remember AWS being thought of as great for "just experimenting with stuff".

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#8

Post by smackeyacky » Tue, Jan 04, 2022, 1:09 AM UTC

I know it's easy to get lazy about checking your AWS billing dashboard but I do it once a week - you can set up alerts and whatnot but I find it easier just to go look at the current usage to make sure nothing has gone awry.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#9

Post by anduru_h » Tue, Jan 04, 2022, 1:13 AM UTC

Aeolun wrote: post #2

I find it hard to believe AWS would try to suck blood from a stone. I’m willing to believe they get a 55k bill, but do they actually end up paying those?

I think you can get refunded for fraudulent charges, like if you get hacked. But if you leave an instance running or screw up auto-scaling somehow, that's normally when the charges may tend to stick around. I believe they have a one strike policy, though that could have changed.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#10

Post by karanbhangui » Tue, Jan 04, 2022, 1:15 AM UTC

ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

love digitalocean for this