Amazon Web Services finds no 'significant issues' at other companies allegedly breached by Paige Thompson

AWS, which serves millions of cloud customers, said it will be more proactive in helping clients detect misconfiguations.

If the alleged Capital One hacker also took information from dozens of other companies, as investigators suspect, then Amazon Web Services isn’t aware of it, according to the cloud computing giant.

The company outlined its findings in a letter to Sen. Ron Wyden, D-Ore., who had sought more detail on how a reported misconfiguration in Capital One’s AWS server would have made it possible for a single individual to steal information about more than 100 million people.

The letter said AWS is not aware of any breaches at other “noteworthy” customers, cautioning that there “may have been small numbers of these that haven’t been escalated to us.” This follows court filings indicating government investigators are probing whether the accused hacker, Paige Thompson, also took data from more than 30 other companies, along with Capital One.

Wyden asked whether any vulnerabilities in the AWS cloud service — which serves millions of customers – contributed to the data breach. Specifically, the senator wanted to know if the hacker had exploited a “server-side request forgery (SSRF) vulnerability” — a bug that allows attackers to trick misconfigured servers into revealing information they should not.

“As Capital One outlined in their public announcement, the attack occurred due to a misconfiguration error at the application layer of a firewall installed by Capital One, exacerbated by permissions set by Capital One that were likely broader than intended,” Stephen Schmidt, the chief information security officer for AWS, said in an Aug. 13 response to Wyden.

“After gaining access through the misconfigured firewall and having broader permissions to access resources, we believe a SSRF attack was used (which was one of several ways an attacker could have potentially gotten access to data once they got in through the misconfigured firewall),” Schmidt said.

AWS said it has contacted customers that may have been affected and that none have reported “any significant issues.”

The company offers “clear guidance” on securing cloud infrastructure and provides clients with how-to-guides and professional services for setting up protections, the letter said.

AWS said it intends to be more proactive following the Capital One incident. Last week, the company started scanning public IP addresses to try to detect misconfigurations. It won’t be clear to AWS if a server truly is misconfigured, but if something looks amiss, Schmidt said, the cloud provider “will err on the side of over-communicating.”

AWS also will do more to ensure its anomaly detection services are “more broadly adopted and accessible in every geographic region” where the company operates, he said.

How Amazon Web Services uses AI to be a security ‘force multiplier’

Amazon CSO Stephen Schmidt says AI is transforming the way the company does security reviews and incident response.

Capital One hacker Paige Thompson got too light a sentence, appeals court rules

Alleged Capital One hacker Paige Thompson to be released before trial

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure