3 ms·
FBI Report suggests something, probably an instance, was left opened to the world. Misconfigured firewall is what they said. It's unclear why the resource coul
by ownagefool 7y ago
FBI Report suggests something, probably an instance, was left opened to the world. Misconfigured firewall is what they said.
It's unclear why the resource couldn't widthstand attack, maybe it had known vulerable software, a weak password, I'm not sure it's been published, but something happened.
Whatever it is was able to assume the *-WAF-Role which had an amazing amount of access.
Given the name of the role and the stupid amount of access, I'd wager it was some shitty security product, but who knows. Maybe we'll find out.
- akamai 7y agomodsec
- october_sky 7y agoWhat's wrong with modsec?
- akamai 7y agoNothing. The problem here was not the waf, but the credential/role being compromised.
- ownagefool 7y agoApparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role. Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.
- ownagefool 7y agoDoubt it. Modsec wouldn't need access to all your data, would it? Something commercial that was bought by a ciso or security person who has no common sense, that asks to specifically be configured with access to that much data. That's my bet.
- Aperocky 7y agoWAF stands for Web Application Firewall - as to how much access this role have, that should be entirely up to Capital One.
- ownagefool 7y agoI'm aware. But actually, giving a hacked product access to all data forever is a terrible practice, thus you ask what would the motivation be of doing so. So either, it's epic fail for being so open with the role, or the role is for a product that asks for all data so it can scan and scrub, for example. i.e. Shitty security product. Also, sure, it's up to them, but should it be if they can't secure other peoples data?