A misconfigured firewall let an outsider copy Capital One data on about 106 million people

transcript

Three commands. That's all it took. Data on about 106 million people. Copied out of Capital One.

17 July 2019. Capital One's security inbox gets an email. There appears to be some leaked s3 data of yours. In someone's github. With a link.

The GitHub file named one Capital One server. A misconfigured firewall let outside commands reach it. And run. The file also listed more than 700 buckets of data.

Command one. Get security credentials for one cloud account. Command two. Use them to list the buckets. Command three. Copy out whatever that account could read. Capital One tested the commands. They worked.

But here's the twist. The copying wasn't new. The logs showed it on or about 22 March. Months earlier.

The listing came from Tor addresses, built to hide where traffic comes from. In normal business, that account never listed buckets. It took a stranger's email. Confirmed on 19 July.

About 100 million people in the US. About 6 million in Canada. The bank regulator fined Capital One 80 million dollars.

Whoever makes your server run commands gets everything its role can reach. Give each role only what it needs. Alert when it acts out of character.

Full story in the article.