9 ms·
Capital One attacker may have breached other major corporations
- panarky 7y agoKrebs claims "there is evidence to suggest we may hear similar disclosures from other companies soon". https://twitter.com/briankrebs/status/1156204409203908609 https://twitter.com/briankrebs/status/1156204409203908609
- kyrra 7y agoFrom the article, there are a few other company names listed in the screenshot (caveat: these are just based on filenames, it's not 100% clear that these are the exact companies, they just seem to match): 42lines.net, apperian.com, globalgarner.com, astem.net, ford, identiphy (not clear which), codecademy.com, safesocial.media, starofservice.us, unicreditgroup.eu There are other files in the dump, but it's not clear which companies they are.
- dmix 7y agoWell hopefully this turns into a helpful public service in the end since she didn't try to sell them or use them for fraud. So most will probably just get fixed, again I hope. But she was basically asking to go to jail and this could have easily gotten her some good money if she reported it responsibly. Either as an infosec worker or through vuln rewards programs.
- Scoundreller 7y agoHopefully she has foiled a malware attack or two in her past. Otherwise it’s not looking good for her future. She doesn’t sound like the most... neurotypical, and US courts really hate that.
- pdoconnell 7y agoinfoblox is a company that does DNS, DHCP, and IPAM management. I think the big concern there is that it is at least named to look like it is their CTO's files, so who knows what is in there.
- notus 7y agoI was low key kind of excited there was a female hacker making the headlines but looks like that isn't really the case.
- dopamean 7y agonot helpful or productive.
- deleted 7y ago[deleted]
- bagacrap 7y agoShe posted a lot of her technique on Twitter. If there were other breaches, they might have been copy cat attacks.
- whenchamenia 7y agoThose arent exactly novel techniques.
- dawhizkid 7y agoFrom the snippets of text I've seen in various articles, it just sounds like she was bored? I imagine she had worked for a number of years and saved up a decent amount of money and decided to leave her job, had nothing to do all day and just posted at a Starbucks working on personal projects, which ended up including hacking into large corporations...? Reminds me of my first manager, who was mid/late 30s and could've retired very comfortably long ago, and his primary motivation for working was because boredom, for him, would've been (in his words) a dangerous thing.
- OBLIQUE_PILLAR 7y ago"I imagine she had worked for a number of years and saved up a decent amount of money" This is incorrect.
- tinalumfoil 7y agoIs it paranoid to consider if this was a government actor? Boredom is plenty to keep someone from retiring, but digging into private customer data I'd think would take a pretty serious motivation. If I had the resources and wanted to wreck some havoc on the US economy data security (ie lack thereof) would certainly seem like a weak point worth prodding.
- mattnewton 7y agoI don’t think a government actor would put them on the same public github that is linked to their resume.. The only way I can see can see her being so smart and yet so dumb is if she didn’t think much of what she was doing.
- Scoundreller 7y agoProbably had moments of insight and lapses of insight at different times. It’s a roller-coaster that a lot of people can’t understand. Oh, and Capital One.
- ownagefool 7y ago
- poxrud 7y agoDoes anyone know how she gained the IAM role? Many comments mention her exploiting a misconfigured WAF to gain the role needed to access the S3 bucket, but that is not enough detail to understand the attack.
- shifty-key 7y agoWell let's look at some of the policies typically attached to a WAF (https://docs.aws.amazon.com/waf/latest/developerguide/access-control-identity-based.html https://docs.aws.amazon.com/waf/latest/developerguide/access...) Maybe instead of waf:* for the action, it was just * ? { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:*" ], "Resource": [ "arn:aws:waf::444455556666:webacl/112233d7c-86b2-458b-af83-51c51example" ] } ] }
- Scoundreller 7y agoIt sounds like that’s the critical detail that is unknown or deliberately being withheld. Probably lots of vulnerable setups out there unless C1 brewed its own, which doesn’t sound like it’s the case.
- howard941 7y agoWhat are the best practices when advising IT? iAm and SSO and windows authentication stuff are strange other worlds to this firmware dweeb
- foobiekr 7y agoThis is the only question that matters and the lack of information is interesting.
- spullara 7y agoIt sounds to me like she got access to an instance running on AWS and used its role to access S3. How she got access to that instance hasn't been revealed but likely to be vulnerable software running on it that would have been protected by the WAF. All assumptions but my guess is that the particular vulnerability exploited is probably not that relevant to people in general.
- ndarwincorn 7y agoTangentially related, half of those comments are yikes-tier.
- RankingMember 7y agoOof, I regret you posting this comment because I had to go look. Rampant litigation of gender pronouns, if me saying that saves someone else some time and brain melt.
- ndarwincorn 7y agoOne of many examples why not enabling comments if you have the option to is probably a good idea.
- rolltiide 7y agoWhy are so many people in that forum contradicting themselves? Like they say something criticizing the prior person's opinion on gender and then say something completely intolerant. Is this a running gag? I never seen people misunderstand a topic so... halfway? Its usually more like "okay I'm learning" or "I completely reject this line of reasoning", but these comments are like something else
- RankingMember 7y agoAs with so many internet comment sections, sometimes, rather than trying to understand, it's best for your own mental health if you close the window, throw your computer in the trash, and go for a walk.
- codyb 7y agoThe people on the internet are not the people outside is how I always think of it. Too bad the internet denizens so frequently shape and mold the conversation.
- 7y ago
- rolltiide 7y agoso this attack is different because the culprit got caught? or am I missing something why isn't this just the usual "we got breached" "Collection #3 available on Empire.onion" "sign up for another $125"
- duxup 7y agoBasked on the slack comments and her behavior described in other stories ... it seems like she was struggling with life and ultimately chose some self destructive behavior. The lack of security seems like she all but wanted to get caught, or actually did.
- TearsInTheRain 7y agoI read she literally posted stolen data to github. Might as well have called up the FBI herself
- Kneecaps07 7y agoI wonder if she is this person - https://www.bleepingcomputer.com/news/security/two-more-windows-10-zero-day-poc-exploits-released-brings-total-to-4/ https://www.bleepingcomputer.com/news/security/two-more-wind... The person in that link, SandboxEscaper, made similar comments. For a week or two she was releasing some stuff and then stopped. She would often make some odd comments in her posts.
- rtempaccount1 7y agoIt's interesting that we're still in a place in 2019, where one motivated attacker, can compromise the security of major corporations, and access sensitive systems and data, and that those corporations don't realise/react to the breach until notified by external parties. For security to improve, there needs to be a "mess up tolerance" of more than one (i.e. if a single mistake/vulnerability causes a major loss, you're in trouble) Mistakes happen, vulnerabilities happen, security required defense in depth to be effective.
- oppositelock 7y agoAs someone responsible for Cloud security for the last several years at a couple of companies, I can tell you exactly how this happens. You, the sec-ops engineer, propose your pie-in the sky, compartmentalized fortress. There is no one security domain, but many, with barriers in between them, so that having one part of your org compromised leaves the rest intact. Then, you talk to your peers, and have many discussions of the form, "yes, that's secure, but it's really annoying to work with, and my engineers won't be able to monkey-patch the production environment to test stuff". you say, that's the point, the CTO says, you can't slow down dev. So, you come up with something that's as secure as you can make it within the limited ability you have to impose inconvenience. Then it comes to implementing the thing. You don't have time to implement everything yourself, so you delegate. Some people now have credentials to the production systems, and to ease their own debugging, or deployment, spin up little helper bastion instances, so they don't have to use 2FA each time to use SSH or don't have to deal with limited-time SSH cert authorities, or whatever. They roll out your fairly secure design, and forget about the little bastion they've left hanging around, open to 0.0.0.0 with the default SSH private key every dev checks into git. So, any former employee can get into the bastion. Now, that's what happens when someone designs something secure from the outset. When you start out with everything being in the default VPC, initially brought up by hand, with a subnet setting which default-assigns public IP addresses, you're basically boned, but that's where most companies which roll service in the cloud start.
- rolltiide 7y agodid anyone notice the landlord got arrested too? when you see it... https://www.seattletimes.com/business/seattle-woman-arrested-in-breach-of-capital-one-systems-millions-of-credit-applications/ https://www.seattletimes.com/business/seattle-woman-arrested... okay I'm dying laughing here, so much win and fail at the same time.
- JustSomeNobody 7y ago> While federal agents were sweeping the three-bedroom house where Thompson lives they discovered 20 firearms — both assault-style rifles and handguns — as well as firearm accessories, including bumpstocks, scopes, grips and ammunition, in another bedroom, according to a separate complaint filed against the homeowner, 66-year-old Park Quan. > Quan, who was convicted of being a felon in possession of explosives in 1983 and being a felon in possession of an unregistered machine gun in 1991, was arrested and charged Monday with being a felon in possession of a firearm, federal court records show. > In the 1983 criminal case, Quan and two co-conspirators were linked to a failed contract killing using a truck bomb made of dynamite, according to court records and news reports. The bomb, which the would-be victim found attached to the underside of his pickup in Ocean Shores, Grays Harbor County, had malfunctioned, The Seattle Times reported at the time. There are no words...
- VoiceOfWisdom 7y agoIf you are already a felon for owning a gun, why the hell would you own a bumpstock? Just go full giggle at that point.
- mieseratte 7y ago> Just go full giggle at that point. Well it's not as if you can just break into any old gun store or rural home and find a select-fire weapon.
- jdhn 7y agoJust put a lightning link into your AR style rifle, and voilà, you have a full auto gun.
- jedberg 7y agoThe thing that sticks out most to me is that from what’s been disclosed, she didn’t need any insider AWS knowledge or access to achieve these attacks.
- sealthedeal 7y agoif one individual can attain access to all of that data that "easily", it makes me flabbergasted at the type of data we and other countries are "acquiring" in our new age cyber warfare...
- ec109685 7y agoI wonder how Capital One could have been GDPR compliment. Surely they weren’t going into these S3 files and deleting customer data when asked to.