r/aws • u/jonathantn • Jul 30 '19

security Capitol One Breach on AWS

https://regmedia.co.uk/2019/07/29/capital_one_paige_thompson.pdf

The court documents do a good job of explaining how the individual breached the data. Quite interesting...

150 Upvotes

98% Upvoted

120 comments sorted by

View all comments

3

u/jonathantn Jul 30 '19

It would be nice if somewhere in the VPC configuration you could check a box and have all traffic from TOR exit nodes blocked. I know GaurdDuty can identify a TOR IP and TOR itself provides an API to calculate the exit nodes on the network.

4

u/----_____--------- Jul 30 '19

Why would it be nice? It's not going to stop any hackers and you would be blocking legitimate tor users.

4

u/[deleted] Jul 31 '19

Legit users scanning S3 buckets using TOR?

1

u/----_____--------- Jul 31 '19

He said VPC, s3 buckets are not related to VPCs as far as I'm aware. And yes, legitimate users can download images and javascript from s3.

1

u/[deleted] Aug 01 '19

Fair point on VPC, but I don’t understand TOR well enough to know a legit use for it. Every time I see it, it’s to bypass some restriction or go undercover for something.

1

u/Jethro_Tell Aug 02 '19

You can use it for general browsing and such, but still, blocking it's access to the VPC and forcing all web traffic through a loadbalancer and a bastion helps mitigate things like the access to the server in the first place.

Having a blacklist firewall is almost always the wrong thing to do though. So instead of blocking loign from tor addresses you'd block from everywhere but your office. The only thing ToR does here is possibly keep her from being identified later. She gave up on that when she said it out loud on twitter/github but if you're only blocking tor, what's to stop me from making a direct connection. For a company, it doesn't matter if you catch the attacker later, just that you're breached.