3 ms·
Exfiltrating 300TB of customer data without 23andMe noticing seems like negligence. Shouldn't there have been some alarms?
by nsagent 3y ago
Exfiltrating 300TB of customer data without 23andMe noticing seems like negligence. Shouldn't there have been some alarms?
- TecoAndJix 3y agoif its not cred stuffing, a few GB per day per IP to defeat volume anomalies. you would hope 23andme would have detection/controls on customer storage to flag new geo locations since there is no way they spoofed each customer's destination. or an authorization flow to even access the data with an audit trail/approval flow for god accounts.
- jdjxhwvsh 3y ago“Hey Bob— why is our AWS bill so high this month… oh shit”
- rsaxvc 3y agoLol. "Hey Bob - why are we in the news for a breach?" Seems closer given the news reporting and their tardy response.
- SamuelAdams 3y agoYou joke but one of many organizations weakest points is lack of prompt alerting. I think the FBI recently put out a list of weakest points and this was maybe number 4 or 5 on the list. I’ll do some googling and see if I can find it. This is a forum of engineers and builders - if a lot of data were being exfiltrated from your cloud accounts right now, would you know? What would your response plan look like? Maybe this could be a good way for all orgs to review those practices and make sure they have a plan.
- dekhn 3y agowe've caught a few "oops I almost spent a million dollars" through cost alerting on AWS. Unfortunately, the time resolution for billing isn't great. I will say, much to my surprise, AWS comped us for the money we wasted even when it was our own fault.
- extraduder_ire 3y agoI think if you're likely to not notice spending a million bucks right away, you're the kind of firm amazon wants to hang on to.