2 ms·
> AKA: Capital One left customer data in a publically available s3 bucket That’s not what happened, that’s uninformed forums speculation that you’ve seen repea
by happyopossum 4y ago
> AKA: Capital One left customer data in a publically available s3 bucket
That’s not what happened, that’s uninformed forums speculation that you’ve seen repeated often enough you assume it’s true.
Krebs and one of Cloudflare’s PMs have both gone into some depth about this - it involved an SSRF attack against a non-public S3 bucket among other things. Krebs’ article is particularly interesting as it has screenshots of tweets from her describing the process.
https://ejj.io/blog/capital-one https://ejj.io/blog/capital-one
https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/ https://krebsonsecurity.com/2019/07/capital-one-data-theft-i...