4 ms·

Is it really the hack that cost Capital One $270m, or the misconfigured server? While she's obviously in the wrong here, I doubt it makes sense to pin the whole

by sva_ 4y ago

Is it really the hack that cost Capital One $270m, or the misconfigured server? While she's obviously in the wrong here, I doubt it makes sense to pin the whole sum on her.

toss1 4y ago
OK, try these on for fit: "Is it really the theft that cost the person the valuables stored at home, or the fact that they didn't have live armed guards or didn't store it in a vault? While the thief is obviously in the wrong here, you doubt it makes sense to pin the whole sum on him." "Is it really the rapist that cost the person's life, or the fact that they weren't fully armed and were not at home after sunset? While the rapist/murderer is obviously in the wrong here, you doubt it makes sense to pin the whole sum on him." These are not accidents like parking a car at the edge of a cliff and forgetting to put it in gear and set the parking brake. These are deliberate premeditated actions by another party exploiting some weakness or error. Of course it helps to avoid weakness or errors, but the point of a civilized society is to not have to live like we're constantly under assault in an armed camp. The criminal is a criminal, and the entire amount rests on his/her head. That said, it is also appropriate for those who lost to analyze the losses and improve their situation. If there was already a spec or procedure to handle this, and it was not followed, then it would not be surprising to see some workers and managers retrained or sacked. But zero of this reduces the criminal's responsibility or liability. I suppose that if there is anyone to blame for shortcomings incurring costs, it is the criminal herself. Aside from deciding to do the crime in the first place, she also had bad enough opsec to get caught, and that will come with a price.
- ryanschneider 4y ago
  You can be both negligent _and_ preyed on by criminals. It doesn’t make the criminal any less criminal, but it also doesn’t make you any less negligent.
- skeeter2020 4y ago
  I'm confused... do your totured analogies identify Capital One as the victim? >> These are not accidents like parking a car at the edge of a cliff and forgetting to put it in gear and set the parking brake. They left S3 buckets parked on the edge of a cliff with (the personal information of) customers sitting in the passenger seat, and failed to stop them (from being publicly visible) with security. Sounds exactly like your example.
- jedberg 4y ago
  All of your analogies forget one important thing. Capital One was storing other people's data and acting in the role of the bank or vault. They have a duty to store those things securely. Or to put it another way, if someone breaks into the bank and steals your valuables from your deposit box, are you going to blame the thief, the bank, or both?
  - toss1 4y ago
    Good points - Capital One did have a duty to care more than just for their own data. My beef is with the comment that somehow the criminal is less responsible for the crime. It is not like they entrapped the person to do the crime.
    - jedberg 4y ago
      Assigning responsibility is always a moral judgement and different people will come up with different answers based on their own morality. If someone walks into the bank and the doors are wide open, no one is there, and the vault is just open, so they decide to grab some visible valuables, how much responsibility is actually on the thief? I mean obviously there is some responsibility, but how much is more of a moral judgement than anything else.
      - toss1 4y ago
        Fun example! Agree, it's all judgement, and there's clearly a broad spectrum. Some good example points on it might include: * Implemented all possible security measures, above and beyond reasonable, but were breached by a nation-state actor. * Took reasonable professional-standards measures, but were breached by professional thieves. * Took most standard measures, missed some, but were breached by a modestly skilled thief. * Were somewhat negligent and some people found an unlocked door and stole the goods. * Created an attractive nuisance, too tempting for some people to avoid, and some people looted the place. * Left the goods out on the sidewalk and were surprised when people helped themselves. In all but the last sidewalk example, I'd say the taker has full responsibility as a thief - an honest person would not get involved, and a skeptical person would wonder if it was a honeytrap. All but the last two examples require not only dishonesty, but also require specific planning and actions to get the goods. In all but the last two examples, I'd say that the taker is responsible for their acts, and nothing about the owner's actions mitigates that. That said, the protector of the goods also has full responsibility for taking appropriate measures for the reasonably foreseeable threats. I guess I'd put it as responsibility is not divided but added or multiplied by the parties.
destroy-2A 4y ago
Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it. The misconfiguration on a “firewall” sounds like AWS is deep into the capital one org tightly controlling the narrative. Whilst at the end of the day it was an EC2 that had access to all the accounts S3 buckets that was configured to pass out its role token to anyone that asked and the bucket itself had no protection against outside access with a compromised key. This to me sounds like absolute negligence for an FI and rightfully deserves the fine. Back when this attack was done the AWS service made it very complex to mitigate against this type of attack and since then AWS have scrambled to release a bunch of “features” to fix this like Aws:calledvia , s3:resourceaccount condition key, s3 block public access came out just before attack was made public I am sure there were others but this is what I can recall.
- Zombieball 4y ago
  > and the bucket itself had no protection against outside access with a compromised key Any advice on how to safeguard against this?
  - jhugo 4y ago
    Don't use static keys, and audit access to sensitive resources. If possible, use VPC endpoints and lock down the bucket to only allow access from them.
- addingnumbers 4y ago
  > Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it. Isn't there a third option, fully anonymous disclosure by a grey hat? Seems like the best outcome would be from showing it to a scrupulous journalist who protects sources, and it looks like you're discounting that.

by sva_ 4y ago

Is it really the hack that cost Capital One $270m, or the misconfigured server? While she's obviously in the wrong here, I doubt it makes sense to pin the whole sum on her.

toss1 4y ago

OK, try these on for fit: "Is it really the theft that cost the person the valuables stored at home, or the fact that they didn't have live armed guards or didn't store it in a vault? While the thief is obviously in the wrong here, you doubt it makes sense to pin the whole sum on him." "Is it really the rapist that cost the person's life, or the fact that they weren't fully armed and were not at home after sunset? While the rapist/murderer is obviously in the wrong here, you doubt it makes sense to pin the whole sum on him." These are not accidents like parking a car at the edge of a cliff and forgetting to put it in gear and set the parking brake. These are deliberate premeditated actions by another party exploiting some weakness or error. Of course it helps to avoid weakness or errors, but the point of a civilized society is to not have to live like we're constantly under assault in an armed camp. The criminal is a criminal, and the entire amount rests on his/her head. That said, it is also appropriate for those who lost to analyze the losses and improve their situation. If there was already a spec or procedure to handle this, and it was not followed, then it would not be surprising to see some workers and managers retrained or sacked. But zero of this reduces the criminal's responsibility or liability. I suppose that if there is anyone to blame for shortcomings incurring costs, it is the criminal herself. Aside from deciding to do the crime in the first place, she also had bad enough opsec to get caught, and that will come with a price.

ryanschneider 4y ago
You can be both negligent _and_ preyed on by criminals. It doesn’t make the criminal any less criminal, but it also doesn’t make you any less negligent.
skeeter2020 4y ago
I'm confused... do your totured analogies identify Capital One as the victim? >> These are not accidents like parking a car at the edge of a cliff and forgetting to put it in gear and set the parking brake. They left S3 buckets parked on the edge of a cliff with (the personal information of) customers sitting in the passenger seat, and failed to stop them (from being publicly visible) with security. Sounds exactly like your example.
jedberg 4y ago
All of your analogies forget one important thing. Capital One was storing other people's data and acting in the role of the bank or vault. They have a duty to store those things securely. Or to put it another way, if someone breaks into the bank and steals your valuables from your deposit box, are you going to blame the thief, the bank, or both?
- toss1 4y ago
  Good points - Capital One did have a duty to care more than just for their own data. My beef is with the comment that somehow the criminal is less responsible for the crime. It is not like they entrapped the person to do the crime.
  - jedberg 4y ago
    Assigning responsibility is always a moral judgement and different people will come up with different answers based on their own morality. If someone walks into the bank and the doors are wide open, no one is there, and the vault is just open, so they decide to grab some visible valuables, how much responsibility is actually on the thief? I mean obviously there is some responsibility, but how much is more of a moral judgement than anything else.
    - toss1 4y ago
      Fun example! Agree, it's all judgement, and there's clearly a broad spectrum. Some good example points on it might include: * Implemented all possible security measures, above and beyond reasonable, but were breached by a nation-state actor. * Took reasonable professional-standards measures, but were breached by professional thieves. * Took most standard measures, missed some, but were breached by a modestly skilled thief. * Were somewhat negligent and some people found an unlocked door and stole the goods. * Created an attractive nuisance, too tempting for some people to avoid, and some people looted the place. * Left the goods out on the sidewalk and were surprised when people helped themselves. In all but the last sidewalk example, I'd say the taker has full responsibility as a thief - an honest person would not get involved, and a skeptical person would wonder if it was a honeytrap. All but the last two examples require not only dishonesty, but also require specific planning and actions to get the goods. In all but the last two examples, I'd say that the taker is responsible for their acts, and nothing about the owner's actions mitigates that. That said, the protector of the goods also has full responsibility for taking appropriate measures for the reasonably foreseeable threats. I guess I'd put it as responsibility is not divided but added or multiplied by the parties.

destroy-2A 4y ago

Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it. The misconfiguration on a “firewall” sounds like AWS is deep into the capital one org tightly controlling the narrative. Whilst at the end of the day it was an EC2 that had access to all the accounts S3 buckets that was configured to pass out its role token to anyone that asked and the bucket itself had no protection against outside access with a compromised key. This to me sounds like absolute negligence for an FI and rightfully deserves the fine. Back when this attack was done the AWS service made it very complex to mitigate against this type of attack and since then AWS have scrambled to release a bunch of “features” to fix this like Aws:calledvia , s3:resourceaccount condition key, s3 block public access came out just before attack was made public I am sure there were others but this is what I can recall.

Zombieball 4y ago
> and the bucket itself had no protection against outside access with a compromised key Any advice on how to safeguard against this?
- jhugo 4y ago
  Don't use static keys, and audit access to sensitive resources. If possible, use VPC endpoints and lock down the bucket to only allow access from them.
addingnumbers 4y ago
> Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it. Isn't there a third option, fully anonymous disclosure by a grey hat? Seems like the best outcome would be from showing it to a scrupulous journalist who protects sources, and it looks like you're discounting that.