Hacker News Reader

Comment by nsagent | Hacker News Reader

Exfiltrating 300TB of customer data without 23andMe noticing seems like negligence. Shouldn't there have been some alarms?

View on HN

“Hey Bob— why is our AWS bill so high this month… oh shit”

You joke but one of many organizations weakest points is lack of prompt alerting. I think the FBI recently put out a list of weakest points and this was maybe number 4 or 5 on the list. I’ll do some googling and see if I can find it.

This is a forum of engineers and builders - if a lot of data were being exfiltrated from your cloud accounts right now, would you know? What would your response plan look like? Maybe this could be a good way for all orgs to review those practices and make sure they have a plan.

we've caught a few "oops I almost spent a million dollars" through cost alerting on AWS. Unfortunately, the time resolution for billing isn't great. I will say, much to my surprise, AWS comped us for the money we wasted even when it was our own fault.

I think if you're likely to not notice spending a million bucks right away, you're the kind of firm amazon wants to hang on to.

Lol. "Hey Bob - why are we in the news for a breach?" Seems closer given the news reporting and their tardy response.

if its not cred stuffing, a few GB per day per IP to defeat volume anomalies. you would hope 23andme would have detection/controls on customer storage to flag new geo locations since there is no way they spoofed each customer's destination. or an authorization flow to even access the data with an audit trail/approval flow for god accounts.

Reply on news.ycombinator.com