3 ms·

> Capital One, which is one of 30 institutions hacked by Thompson AKA: Capital One left customer data in a publically available s3 bucket. I'm not defending w

> Capital One, which is one of 30 institutions hacked by Thompson AKA: Capital One left customer data in a publically available s3 bucket. I'm not defending what this "hacker" did at all but this is 100% the company's fault. That $270M? That's from fines and settling a class action by their customers. Again, not defending the hacker but all the hacker really did was shine a light on this (doesn't appear they sold/used the data unless I'm missing something).

deleted 4y ago
[deleted]
yellow_lead 4y ago
Yeah the hack didn't cost them $270 million. Screwing up did.
deleted 4y ago
[deleted]
geoduck14 4y ago
I spoke with a CapitalOne employee after this hack who was involved in "cleaning up" the security. He wasn't allowed to discuss specifics, but he did share some fun facts: The hacker was very smart The hacker chained together "about 6 or 7" different exploits to get to the data. Note, this means it is much harder than "leaving an S3 bucket public" The hacker tried to sell the data, but couldn't find a buyer before being found out
- ransom1538 4y ago
  That is crazy to me. `hacker chained together "about 6 or 7" different exploits to get to the data` <- but somehow the hacker couldn't use $5 per month vpn?
  - ctvo 4y ago
    The hacker did use a VPN, but they also posted snippets of the stolen data online, possibly to brag or find potential buyers, that eventually led to their real identity. VPN isn't cruise control to anonymity. Being based in a country without an extradition treaty to the US probably offers much better protection e.g. Russia, China.
codedokode 4y ago
I find it suspicious too. As I understand, the fines are not for being a victim of a hack, but for not storing the data properly and securely. Therefore bank should have paid those fines even if it hadn't been hacked.
happyopossum 4y ago
> AKA: Capital One left customer data in a publically available s3 bucket That’s not what happened, that’s uninformed forums speculation that you’ve seen repeated often enough you assume it’s true. Krebs and one of Cloudflare’s PMs have both gone into some depth about this - it involved an SSRF attack against a non-public S3 bucket among other things. Krebs’ article is particularly interesting as it has screenshots of tweets from her describing the process. https://ejj.io/blog/capital-one https://ejj.io/blog/capital-one https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/ https://krebsonsecurity.com/2019/07/capital-one-data-theft-i...

deleted 4y ago

[deleted]

yellow_lead 4y ago

Yeah the hack didn't cost them $270 million. Screwing up did.

deleted 4y ago

[deleted]

geoduck14 4y ago

I spoke with a CapitalOne employee after this hack who was involved in "cleaning up" the security. He wasn't allowed to discuss specifics, but he did share some fun facts: The hacker was very smart The hacker chained together "about 6 or 7" different exploits to get to the data. Note, this means it is much harder than "leaving an S3 bucket public" The hacker tried to sell the data, but couldn't find a buyer before being found out

ransom1538 4y ago
That is crazy to me. `hacker chained together "about 6 or 7" different exploits to get to the data` <- but somehow the hacker couldn't use $5 per month vpn?
- ctvo 4y ago
  The hacker did use a VPN, but they also posted snippets of the stolen data online, possibly to brag or find potential buyers, that eventually led to their real identity. VPN isn't cruise control to anonymity. Being based in a country without an extradition treaty to the US probably offers much better protection e.g. Russia, China.

codedokode 4y ago

I find it suspicious too. As I understand, the fines are not for being a victim of a hack, but for not storing the data properly and securely. Therefore bank should have paid those fines even if it hadn't been hacked.

happyopossum 4y ago

> AKA: Capital One left customer data in a publically available s3 bucket That’s not what happened, that’s uninformed forums speculation that you’ve seen repeated often enough you assume it’s true. Krebs and one of Cloudflare’s PMs have both gone into some depth about this - it involved an SSRF attack against a non-public S3 bucket among other things. Krebs’ article is particularly interesting as it has screenshots of tweets from her describing the process. https://ejj.io/blog/capital-one https://ejj.io/blog/capital-one https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/ https://krebsonsecurity.com/2019/07/capital-one-data-theft-i...