Capital One’s breach was inevitable, because we did nothing after Equifax

Re:Capital One’s breach was inevitable, because we did nothi... by SmellyGeekBoy on Tuesday July 30, 2019 @11:13AM (#20565565)

> Good luck proving it was our fault not yours.

Seems like it would be incredibly easy to prove that an S3 bucket was misconfigured in such a way that the data was publicly accessible. In fact this has been the case in the recent high-profile cases that I can recall.

[ Parent | on HN ]

Re:Capital One’s breach was inevitable, because we did nothi... by giggzy2 on Saturday August 03, 2019 @06:51PM (#20603218)

The S3 bucket was not public.

The hacker got ephemeral keys by remotely exploiting the WAF. The WAF had no reason to have privileges to read from S3, that was a mistake.

I’m unclear if data in bucket was encrypted at rest but I guess if you get keys to read it’s a moot point.

[ Parent | on HN ]