Hacker News Reader

Comment by sva_ | Hacker News Reader

Is it really the hack that cost Capital One $270m, or the misconfigured server? While she's obviously in the wrong here, I doubt it makes sense to pin the whole sum on her.

View on HN

Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it. The misconfiguration on a “firewall” sounds like AWS is deep into the capital one org tightly controlling the narrative. Whilst at the end of the day it was an EC2 that had access to all the accounts S3 buckets that was configured to pass out its role token to anyone that asked and the bucket itself had no protection against outside access with a compromised key. This to me sounds like absolute negligence for an FI and rightfully deserves the fine. Back when this attack was done the AWS service made it very complex to mitigate against this type of attack and since then AWS have scrambled to release a bunch of “features” to fix this like Aws:calledvia , s3:resourceaccount condition key, s3 block public access came out just before attack was made public I am sure there were others but this is what I can recall.

> and the bucket itself had no protection against outside access with a compromised key

Any advice on how to safeguard against this?

Don't use static keys, and audit access to sensitive resources.

If possible, use VPC endpoints and lock down the bucket to only allow access from them.

> Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it.

Isn't there a third option, fully anonymous disclosure by a grey hat?

Seems like the best outcome would be from showing it to a scrupulous journalist who protects sources, and it looks like you're discounting that.

OK, try these on for fit:

"Is it really the theft that cost the person the valuables stored at home, or the fact that they didn't have live armed guards or didn't store it in a vault? While the thief is obviously in the wrong here, you doubt it makes sense to pin the whole sum on him."

"Is it really the rapist that cost the person's life, or the fact that they weren't fully armed and were not at home after sunset? While the rapist/murderer is obviously in the wrong here, you doubt it makes sense to pin the whole sum on him."

These are not accidents like parking a car at the edge of a cliff and forgetting to put it in gear and set the parking brake.

These are deliberate premeditated actions by another party exploiting some weakness or error. Of course it helps to avoid weakness or errors, but the point of a civilized society is to not have to live like we're constantly under assault in an armed camp.

The criminal is a criminal, and the entire amount rests on his/her head.

That said, it is also appropriate for those who lost to analyze the losses and improve their situation. If there was already a spec or procedure to handle this, and it was not followed, then it would not be surprising to see some workers and managers retrained or sacked. But zero of this reduces the criminal's responsibility or liability.

I suppose that if there is anyone to blame for shortcomings incurring costs, it is the criminal herself. Aside from deciding to do the crime in the first place, she also had bad enough opsec to get caught, and that will come with a price.

You can be both negligent _and_ preyed on by criminals. It doesn’t make the criminal any less criminal, but it also doesn’t make you any less negligent.

I'm confused... do your totured analogies identify Capital One as the victim?

>> These are not accidents like parking a car at the edge of a cliff and forgetting to put it in gear and set the parking brake.

They left S3 buckets parked on the edge of a cliff with (the personal information of) customers sitting in the passenger seat, and failed to stop them (from being publicly visible) with security.

Sounds exactly like your example.

All of your analogies forget one important thing. Capital One was storing other people's data and acting in the role of the bank or vault. They have a duty to store those things securely.

Or to put it another way, if someone breaks into the bank and steals your valuables from your deposit box, are you going to blame the thief, the bank, or both?

Good points - Capital One did have a duty to care more than just for their own data.

My beef is with the comment that somehow the criminal is less responsible for the crime. It is not like they entrapped the person to do the crime.

Assigning responsibility is always a moral judgement and different people will come up with different answers based on their own morality.

If someone walks into the bank and the doors are wide open, no one is there, and the vault is just open, so they decide to grab some visible valuables, how much responsibility is actually on the thief?

I mean obviously there is some responsibility, but how much is more of a moral judgement than anything else.

Fun example!

Agree, it's all judgement, and there's clearly a broad spectrum. Some good example points on it might include:

* Implemented all possible security measures, above and beyond reasonable, but were breached by a nation-state actor.

* Took reasonable professional-standards measures, but were breached by professional thieves.

* Took most standard measures, missed some, but were breached by a modestly skilled thief.

* Were somewhat negligent and some people found an unlocked door and stole the goods.

* Created an attractive nuisance, too tempting for some people to avoid, and some people looted the place.

* Left the goods out on the sidewalk and were surprised when people helped themselves.

In all but the last sidewalk example, I'd say the taker has full responsibility as a thief - an honest person would not get involved, and a skeptical person would wonder if it was a honeytrap.

All but the last two examples require not only dishonesty, but also require specific planning and actions to get the goods. In all but the last two examples, I'd say that the taker is responsible for their acts, and nothing about the owner's actions mitigates that.

That said, the protector of the goods also has full responsibility for taking appropriate measures for the reasonably foreseeable threats.

I guess I'd put it as responsibility is not divided but added or multiplied by the parties.

Reply on news.ycombinator.com