News for hackers. Stuff that matters.

A comment on Former Cisco engineer pleads guilty to causing Webex account chaos.

Re:Former Cisco engineer pleads guilty to causing Webex acco... by anonu on Sunday August 30, 2020 @12:27PM (#24323856)
Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
[ Parent | on HN ]
Re:Former Cisco engineer pleads guilty to causing Webex acco... by user5994461 on Sunday August 30, 2020 @02:02PM (#24324596)
Set the termination protection flag on critical instances (like databases), then they cannot be deleted programmatically. This works really really well.
[ Parent | on HN ]
Re:Former Cisco engineer pleads guilty to causing Webex acco... by dragonwriter on Sunday August 30, 2020 @02:10PM (#24324654)
> Set the termination protection flag on critical instances (like databases), then they cannot be deleted programmatically.

Well, not accidentally, but the flag itself can be cleared programmatically, so protected instances can definitely still be maliciously deleted programmatically, if the actor has sufficient access.

[ Parent | on HN ]
Re:Former Cisco engineer pleads guilty to causing Webex acco... by user5994461 on Sunday August 30, 2020 @02:18PM (#24324726)
Oh really? I thought the only way was to go to the web UI and and select instances to remove the flag.
[ Parent | on HN ]
Re:Former Cisco engineer pleads guilty to causing Webex acco... by dragonwriter on Sunday August 30, 2020 @02:25PM (#24324780)
Quick googling found CLI instructions (for both the generic and powershell CLIs), and those are just wrappers around the APIs.
[ Parent | on HN ]
Re:Former Cisco engineer pleads guilty to causing Webex acco... by dragonwriter on Sunday August 30, 2020 @12:32PM (#24323889)
> Aren't there protections in AWS

For this, in general, the answer is: (1) yes, IAM permissions, and (2) yes, if you configure them, and they often have a cost.

> Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?

If Cisco asked, probably. But some things are inherently non-trivial to recover from once you've allowed them to happen. AWS can help, but they aren't magic.

[ Parent | on HN ]
Re:Former Cisco engineer pleads guilty to causing Webex acco... by WrtCdEvrydy on Sunday August 30, 2020 @01:29PM (#24324312)
Deletion Protection is amazing, but the true way to fix this is to use IAM roles, and groups.

Remove the user that is being terminated from the group and 'voila', it is safe.

[ Parent | on HN ]