Scourge · July 29 2019

The Scourge of the Misconfigured Cloud

Chronicle

On 29 July 2019 Capital One announced that a former AWS engineer had exploited a misconfigured web application firewall to steal data on about 106 million customers and applicants in the US and Canada. The trick was an SSRF: the firewall was persuaded to query the cloud metadata service and hand over temporary credentials. The alarm was raised by a GitHub user who emailed the bank on 17 July after seeing the data posted online. The attacker was convicted in 2022.

Lesson learned

It made everyone aware of the risk of SSRF against cloud metadata, and pushed AWS to introduce IMDSv2, which requires a session token.

Prayer of reparation

O 169.254.169.254, secret address of every cloud, answer only those with the right token and never a firewall talked into it by trickery. Amen.

How it is remembered

Remembered by enforcing IMDSv2, giving cloud roles only the permissions they strictly need and actually reading reports that come from outside.