6 ms·

Sacked IT guy annihilates 23 of his ex-employer’s AWS servers

24 points by kaboro 8y ago

LinuxBender 8y ago
AWS have services to back up your data. Anything that a human or automation can touch can be obliterated instantly. This includes your live, staging and disaster recovery sites. Important data must be backed up where humans and automation can't remove it. A vaulting policy / data retention policy is also useful.
- PHGamer 8y ago
  does aws actually have that. everythings an API on aws right? so couldnt someone just send the delete backup command to whatever backup service aws has?
  - toomuchtodo 8y ago
    You send your backups to another AWS account, that has distinct access credentials another responsible party holds (separation of duties), and policies that inhibit the backup source account from deleting or modifying the backups in the target account. You should practice restores. You should be able to stand your infra back up from anywhere with an Internet connection.
    - autotune 8y ago
      Data protection account is a good idea, but if your main IT person is malicious before such an account gets implemented it won’t matter.
      - toomuchtodo 8y ago
        Trust but verify. Having a third party audit and provide findings (if you’re not technically capable as an owner) is cheaper than going out of business.
ccnafr 8y ago
Source: https://www.mirror.co.uk/news/uk-news/computer-geek-nicknamed-speedy-accused-13893130 https://www.mirror.co.uk/news/uk-news/computer-geek-nickname... Sophos is just re-hashing the DM report. I hate blog spam.
- dang 8y ago
  Ok, we changed to that from http://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy-annihilates-23-of-his-ex-employers-aws-servers/ http://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy-ann..., in keeping with the guidelines' call for original sources (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html).
malux85 8y ago
No 2FA? Totally Incompetent.
- jpomykala 8y ago
  He just used his account ¯\_(ツ)\_/¯

24 points by kaboro 8y ago

AWS have services to back up your data. Anything that a human or automation can touch can be obliterated instantly. This includes your live, staging and disaster recovery sites. Important data must be backed up where humans and automation can't remove it. A vaulting policy / data retention policy is also useful.

PHGamer 8y ago
does aws actually have that. everythings an API on aws right? so couldnt someone just send the delete backup command to whatever backup service aws has?
- toomuchtodo 8y ago
  You send your backups to another AWS account, that has distinct access credentials another responsible party holds (separation of duties), and policies that inhibit the backup source account from deleting or modifying the backups in the target account. You should practice restores. You should be able to stand your infra back up from anywhere with an Internet connection.
  - autotune 8y ago
    Data protection account is a good idea, but if your main IT person is malicious before such an account gets implemented it won’t matter.
    - toomuchtodo 8y ago
      Trust but verify. Having a third party audit and provide findings (if you’re not technically capable as an owner) is cheaper than going out of business.

ccnafr 8y ago

Source: https://www.mirror.co.uk/news/uk-news/computer-geek-nicknamed-speedy-accused-13893130 https://www.mirror.co.uk/news/uk-news/computer-geek-nickname... Sophos is just re-hashing the DM report. I hate blog spam.

dang 8y ago
Ok, we changed to that from http://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy-annihilates-23-of-his-ex-employers-aws-servers/ http://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy-ann..., in keeping with the guidelines' call for original sources (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html).

malux85 8y ago

No 2FA? Totally Incompetent.

jpomykala 8y ago
He just used his account ¯\_(ツ)\_/¯