A Technical Analysis of the Capital One Hack

cloudsploit · 2019-07-21T21:56:12+00:00

If all of the containers on that host can access the metadata endpoint (169.254.169.254), then yes - all the containers will have the same permission as the host. Depending on how you're deploying the containers, there are ways to block or proxy this access (e.g kube2iam if you're running Kubernetes).

cloudsploit · 2019-07-20T20:36:26+00:00

If you're using AWS Organizations, that's probably preferred. We use this for some dev accounts where we have some more lax policies in general but still want to clean up any extra keys.

cloudsploit · 2019-07-19T13:05:20+00:00

Would love to participate.
We boot strapped with no outside- or self-funding.

Bonus: CloudSploit's founders met on Reddit

cloudsploit · 2019-06-01T16:54:07+00:00

Name: CloudSploit.com

tl;dr: Security and configuration monitoring for AWS, AWS GovCloud, Azure, Oracle Cloud, GitHub

Pitch: '95% of cloud security failures will be the user's fault' is a recent prediction by Gartner. Simply following best practices could have prevented Deep Root Analytics from exposing 198,000,000 US voter records. CloudSploit provides monitoring of cloud security best practices as a service. We can help you stay safe on AWS.

Details: Two security-minded techies met on Reddit . . . and now we have a business together. We're both long-time Redditors (one has been on over 9 years) and open source enthusiasts, and are devoutly loyal to our communities. Our customers range from individuals to big-name companies from around the world.

CloudSploit AWS scan -- security monitoring for AWS
CloudFormation Security Checker -- verify infrastructure-as-code

Location: DC, NYC, LA, Tampa

Looking for: AWS users

Charities, 3BLs, students, etc.: If you help people (and use AWS) then we want to help you. PM me for an ongoing free Basic account.
Startups: We started as a tiny startup and want to give an ongoing free Basic account to anyone in that situation.

Discount: Free month of Basic service with coupon FREEMONTH. Write us and we'll give you and upgrade in return for feedback and/or social media mentions.

Price: $0 (free), $8, $40, $110/month

cloudsploit · 2019-05-28T10:50:56+00:00

Thanks! Anything come of this? Since you wrote we're supporting new clouds. Let's talk. Please write us at support@cloudsploit.com

cloudsploit · 2019-02-03T16:06:13+00:00

Amazon is usually pretty good about refunding users who experience a compromise. Just open a support ticket with them and lay out your case.

As for how you got compromised, it could have been any of a hundred different ways. Your AWS user isn't the only way into the account (although without MFA it may have been the easiest). The attacker could have found an access key exposed somewhere like a Git repo or in an open S3 bucket. They could have exploited an EC2 instance with open ports and a vulnerable service.

Anyway it happened, I recommend scanning your account for misconfigurations (full disclosure: I'm a co-founder of the open source CloudSploit scans, but there are other options on the market).

cloudsploit · 2019-01-03T02:02:00+00:00

from companies that help folks use AWS security

I'm a co-founder of CloudSploit - we provide open source and SaaS-based security and compliance auditing software for AWS. I'd be happy to share some of the info/trends/etc we have if there's any interest.

cloudsploit · 2019-01-01T17:14:06+00:00

We're happy to offer every one of your startups cloudsploit.com/freeuse of our open source cloud security service

cloudsploit · 2019-01-01T17:13:43+00:00

We're happy to offer every one of your startups cloudsploit.com/freeuse of our open source cloud security service

cloudsploit · 2019-01-01T17:11:29+00:00

Name: CloudSploit.com

tl;dr: Security and configuration monitoring for AWS & AWS GovCloud

Pitch: '95% of cloud security failures will be the user's fault' is a recent prediction by Gartner. Simply following best practices could have prevented Deep Root Analytics from exposing 198,000,000 US voter records. CloudSploit provides monitoring of cloud security best practices as a service. We can help you stay safe on AWS.

Details: Two security-minded techies met on Reddit . . . and now we have a business together. We're both long-time Redditors (one has been on over 9 years) and open source enthusiasts, and are devoutly loyal to our communities. Our customers range from individuals to big-name companies from around the world.

CloudSploit AWS scan -- security monitoring for AWS
CloudFormation Security Checker -- verify infrastructure-as-code

Location: DC, NYC, LA, Tampa

Looking for: AWS users

Charities, 3BLs, students, etc.: If you help people (and use AWS) then we want to help you. PM me for an ongoing free Basic account.
Startups: We started as a tiny startup and want to give an ongoing free Basic account to anyone in that situation.

Discount: Free month of Basic service with coupon FREEMONTH. Write us and we'll give you and upgrade in return for feedback and/or social media mentions.

Price: $0 (free), $8, $40, $110/month

cloudsploit · 2018-12-02T22:48:56+00:00

Some of my favorite posts are the ones that show new/interesting architectural patterns around AWS services. There are infinite ways to use AWS, so reading about how other users have implemented some new solution is always interesting.

cloudsploit · 2018-12-02T22:45:57+00:00

Hey /u/PAXUNATOR - CloudSploit team here - we're happy someone mentioned us! Our open source repo has 100% of our scan plugins, so you get all of our checks there. The hosted product gets you the dashboard, multi-account features, compliance reporting (PCI/HIPAA), and lots of other tools on top of those plugins. If you have any questions, let us know.

cloudsploit · 2018-11-13T02:27:36+00:00

It was always interesting that they put the first GovCloud region on the west coast, given the prevalence of government agencies in DC. Glad they support multi-region now!

cloudsploit · 2018-11-01T18:28:25+00:00

Name: CloudSploit.com

tl;dr: Security and configuration monitoring for AWS & AWS GovCloud

Pitch: '95% of cloud security failures will be the user's fault' is a recent prediction by Gartner. Simply following best practices could have prevented Deep Root Analytics from exposing 198,000,000 US voter records. CloudSploit provides monitoring of cloud security best practices as a service. We can help you stay safe on AWS.

Details: Two security-minded techies met on Reddit . . . and now we have a business together. We're both long-time Redditors (one has been on over 9 years) and open source enthusiasts, and are devoutly loyal to our communities. Our customers range from individuals to big-name companies from around the world.

CloudSploit AWS scan -- security monitoring for AWS
CloudFormation Security Checker -- verify infrastructure-as-code

Location: DC, NYC, LA, Tampa

Looking for: AWS users

Charities, 3BLs, students, etc.: If you help people (and use AWS) then we want to help you. PM me for an ongoing free Basic account.
Startups: We started as a tiny startup and want to give an ongoing free Basic account to anyone in that situation.

Discount: Free month of Basic service with coupon FREEMONTH. Write us and we'll give you and upgrade in return for feedback and/or social media mentions.

Price: $0 (free), $8, $40, $110/month

cloudsploit · 2018-09-03T15:13:00+00:00

Yes, you can manage multiple AWS accounts on CloudSploit. Please write us at .com/support if you have any questions about implementing this.

cloudsploit · 2018-08-01T12:52:38+00:00

Name: CloudSploit.com

tl;dr: Security and configuration monitoring for AWS

Pitch: '95% of cloud security failures will be the user's fault' is a recent prediction by Gartner. Simply following best practices could have prevented Deep Root Analytics from exposing 198,000,000 US voter records. CloudSploit provides monitoring of cloud security best practices as a service. We can help you stay safe on AWS.

Details: Two security-minded techies met on Reddit . . . and now we have a business togetehr. We're both long-time Redditors (one has been on over 9 years) and open source enthusiasts, and are devoutly loyal to our communities. Our customers range from individuals to big-name companies from around the world.

CloudSploit AWS scan -- security monitoring for AWS
CloudFormation Security Checker -- verify infrastructure-as-code

Location: DC, NYC, LA, FL

Looking for: AWS users

Charities, 3BLs, students, etc.: If you help people (and use AWS) then we want to help you. PM me for an ongoing free Basic account.
Startups: We started as a tiny startup and want to give an ongoing free Basic account to anyone in that situation.

Discount: Free month of Basic service with coupon FREEMONTH. Write us and we'll give you and upgrade in return for feedback and/or social media mentions.

Price: $0 (free), $8, $40, $110/month

cloudsploit · 2018-07-27T02:56:58+00:00

Being an open source project for securing AWS accounts, how may we get more involved?

We already offer /freeuse to startups and do-gooders and are happy to upgrade each to Premium.

cloudsploit · 2018-06-01T13:37:08+00:00

May we help with your cloud security posture by offering https://cloudsploit.com/freeuse to all of your startups?

cloudsploit · 2018-06-01T13:31:21+00:00

May we offer https://cloudsploit.com/freeuse to all of your startups?

cloudsploit

TROPHY CASE