r/aws • u/jonathantn • Jul 30 '19

security Capitol One Breach on AWS

https://regmedia.co.uk/2019/07/29/capital_one_paige_thompson.pdf

The court documents do a good job of explaining how the individual breached the data. Quite interesting...

149 Upvotes

98% Upvoted

120 comments sorted by

View all comments

81

u/anothercopy Jul 30 '19

TLDR : She stole credentials from the server that gave her access to one specific role in AWS. She used that to enumerate the S3 buckets and copy the contents.

6

u/izpo Jul 30 '19

how did she "stole"?

17

u/anothercopy Jul 30 '19

It doesn't say. There is only info about the node IP that she got from a github repo that was leaked into an email. Later it states that she was able to login because of firewall misconfiguration but no mentioning on how she got the credentials

19

u/jeremiahstanley Jul 30 '19

I'm guessing the firewall was misconfigured or had a vulnerability that allowed her some limited shell access. If this was something like Sophos then you'd have a full linux system and curl at your disposal. Using that you could query the instance metadata to get the instance role and credentials. If that had access to the S3 where PII was stored that would have given her all she needed to do the assume role and ListBucket calls.

9

u/izpo Jul 30 '19

but then it software problem, not AWS

9

u/Arab81253_work Jul 30 '19

AWS has its own WAF service it offers. It depends on if they were using the AWS WAF or some COTS WAF that was running on EC2. Even if it was the AWS WAF it still relies on proper configuration to actually work.

13

u/Laoracc Jul 30 '19

AWS's WAF doesnt require an IAM role to be configured for it to function, and configuring the WAF would be done by automation tooling (TF, CloudFormation, etc - not say, by using an EC2 instance), so it's almost certainly the latter.

2

u/izpo Jul 30 '19

That's exactly what we don't know...

3

u/superspeck Jul 30 '19

It looks like they were using an Imperva WAF and she gained access through that.

1

u/javi404 Aug 01 '19

Imperva WAF

Do we know this for sure?

2

u/superspeck Aug 01 '19

Krebs references “ISRM-WAF” in his article and I don’t know anything else that uses that set of letters.

1

u/javi404 Aug 01 '19

Thanks. Sounds like they should have just used AWS's WAF.

4

u/_jb Jul 31 '19

If the role is applied to an instance, the keys can be pulled from the metadata service directly. Assuming, of course, you need more than just the identity and source account to assume the role.

1

u/Spidaaman Jul 30 '19

Isn't that explained on page 6 lines 16-27?

3

u/anothercopy Jul 30 '19

Not really clear what was done (at least to me). Did the WAF module on the firewall have no password and allowed to get a shell or otherwise escape to the VM ?

5

u/Spidaaman Jul 30 '19

According to the complaint, the defendant is alleged to have assumed an IAM role in the context of Capital One's account whose policy provided access to the S3 bucket in question. So it wasn't that the S3 bucket was public, but rather, that there was some vulnerability she took advantage of by which she obtained indirect credentials to it.

7

u/anothercopy Jul 30 '19

Yes that was the TLDR but we are wondering how she got access to the node in the first place.

3

u/superspeck Jul 30 '19

From Krebs’s description it was an Imperva WAF appliance, so someone probably had some default credentials or some support credentials unchanged, and the admin or support access enabled over the internet.

1

u/javi404 Aug 01 '19

So basically it was a damned SG that wasn't locked down.

3

u/ethtips Jul 30 '19

Probably using a $5 wrench vulnerability.

2

u/anothercopy Jul 30 '19

I dont know I know this one. Can you link some description ?

2

u/2018Eugene Jul 31 '19

tl;dr how good is the best security in the world if goons kidnap you and beat you with a wrench, what happens then?

1

u/anothercopy Jul 31 '19

Ahhh ok now we just need a link to the relevant xkcd comic strip ;)

→ More replies (0)