Capital One cast study

What Happened

On July 19, 2019, Capital One announce that an outside individual gained unauthorized access and obtained certain types of personal information about Capital One credit card customers and individuals who had applied for our credit card products. Paige A. Thompson download around 30GB of Capital One data from amazon S3 bucket those contain approx 140k of SNI.

Technical Facts

• The attacker exploited likely an instance and it attach an IAM role with a misconfigured firewall. It presumably had a software vulnerability or was vulnerable due to to a credential exposure.
• The attacker compromised the server and extracted out its IAM role credentials. These ephemeral credentials allow AWS API calls. Role credentials are rotated automatically by AWS, and much more secure than static credentials. But with persistent access you can obviously update credentials as needed.
• Those credentials (an IAM role with ‘WAF’ in the title) allowed listing S3 buckets and read access to at least some of them. This is how the attacker exfiltrated the files.
• Some buckets (maybe even all) were apparently encrypted, and a lot of the data within those files (which included credit card applications) was encrypted or tokenized. But the impact was still severe.
• The attacker exfiltrated the data and then discussed it in Slack and on social media.
• Someone in contact with the attacker saw that information, including attack details in GitHub. This person reported it to Capital One through their reporting program.
• Capital One immediately involved the FBI and very quickly closed the misconfigurations. They also began their own investigation. They were able to determine exactly what happened very quickly, likely through CloudTrail logs. Those contained the commands issued by that IAM role from that server (which are very easy to find). They could then trace back the associated IP addresses. There are many other details on how they found the attacker in the complaint, and it looks like Capital One did quite a bit of the investigation themselves. So misconfigured firewall (Security Group?) > compromised instance > IAM role credential extraction > bucket enumeration > data exfiltration. Followed by a rapid response and public notification.

What’s the impact

Based on analysis to date, this event affected approximately 100 million individuals in the United States and approximately 6 million in Canada.

Beyond the credit card application data, the individual obtained portions of credit card customer data, including:

Customer status data, e.g., credit scores, credit limits, balances, payment history, contact information. Fragments of transaction data from a total of 23 days during 2016, 2017 and 2018. This information has been shared on Capital One’s website, servicing portal, press release and 8K filing.

The individual also obtained the following data:

• About 140,000 Social Security numbers of our credit card customers.
• About 80,000 linked bank account numbers of our secured credit card customers.