Capital One: a firewall setting and cloud credentials

Yesterday Capital One announced a breach affecting about 100 million people in the US and 6 million in Canada, mostly credit card applications. Court papers describe the method: a misconfigured web application firewall could be tricked into making requests on the attacker’s behalf, which reached the cloud server’s metadata service and obtained credentials. Those credentials could read storage buckets full of data.

This is called server-side request forgery, and in the cloud it can turn a small mistake into a big one.

• Give servers the smallest permissions. A firewall doesn’t need to read all your storage.
• Block or restrict access to the metadata service from applications that don’t need it.
• Validate outbound requests your apps make based on user input.
• Alert on unusual access to storage, like one role listing every bucket.