Date created :
ADVERTISING
Seattle
The massive data breach at Capital One appeared to be an unsophisticated attack from a single hacker, raising questions about the security of the financial system and insider threats to cloud computing.
The motive behind the breach and extent of its impact remained unclear Tuesday, a day after FBI agents arrested 33-year-old former web engineer Paige Thompson and charged her with stealing data from more than 100 million credit card applications from the 10th largest US bank.
"The biggest surprise is the amateur nature of the attack," said John Dickson of the security consultancy Denim Group.
Dickson said it was "absolutely earth-shattering" that an individual attacker could gain access to that much data at one of the largest US financial institutions.
"This could have a major impact on confidence in the banking system."
The Capital One hack appears to be different from major breaches at the credit monitoring firm Equifax, internet giant Yahoo and other major incidents which have been attributed to sophisticated nation-state entities.
US authorities said Thompson, a former Amazon Web Services employee, was arrested on the basis of a tip after she boasted of accessing the data on the software sharing site GitHub as well as on Twitter and Slack.
Darren Hayes, a Pace University computer science professor specializing in cybersecurity, said the ability to quickly arrest and prosecute an attacker in this kind of case is unusual.
"Most of these cases are perpetrated by hackers in other countries," he said.
- 'Good people gone bad' -
Hayes said the incident highlights the risk of "insider" attacks when trusted employees turn to theft.
"It is challenging to catch good people gone bad, so a lot of banks look for that now" with artificial intelligence tools to detect anomalies in employee behavior, Hayes said.
Capital One said the incident affected some 100 million US customers and six million Canada, with as many as 140,000 US and one million Canadian social security numbers compromised.
Only some of the data was encrypted, but Capital One said it had no indication any of the data was transferred or sold where it could be damaging for customers.
Still, Hayes said he sees a risk of data loss that could end up compromising bank customers.
"My sense is that we are going to see a lot of class-action lawsuits and the company could be liable for a lot of damages," he said.
News of the Capital One breach comes after US credit monitoring agency Equifax last week agreed to pay up to $700 million to settle a similar incident that hit the company in 2017, affecting nearly 150 million customers.
New York State attorney general Letitia James said her office was opening up its own investigation.
"My office will begin an immediate investigation into Capital One's breach, and will work to ensure that New Yorkers who were victims of this breach are provided relief," James said.
- 'Easier target' -
Dylan Gilbert of the consumer group Public Knowledge said the news raises questions about security procedures by the large bank.
"Why didn't Capital One fully encrypt this data, and why didn't the company place this vast trove of personal information behind a properly configured firewall?" Gilbert said.
"Security is challenging and mistakes happen, but unfortunately for consumers, companies have no incentive to engage in cybersecurity best practices when punishment comes in the form of financial penalties that can be factored in as a mere cost of doing business."
Joseph Hall, chief technologist at the Center for Democracy & Technology, said the incident highlights the risk of depending too much on cloud computing, which stores vast amounts of data in servers.
"The fact that there is so much more data in the cloud makes it an easier target," Hall said.
"If cloud services are misconfigured it's relatively easy for someone walking by to take advantage of that."
Thompson's online resume indicates she left Amazon in 2016, and there was no indication the AWS cloud itself was to blame for the breach.
"AWS was not compromised in any way and functioned as designed," Amazon said in a statement.
"The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud."
Over months of discussions in online forums earlier this year, Paige Thompson acknowledged the personal challenges in her life: Suicidal thoughts, struggles to find employment and difficulties she had faced since transitioning to a woman years earlier.
But those who knew her were nonetheless stunned by what came next: The arrest of Ms. Thompson on Monday on charges that she had stolen the personal data of over 100 million Capital One customers.
Ms. Thompson, 33, had spent years lurching between a promising career as a software developer and a life of upheaval that alienated her from her friends. While she at times found community among fellow computer engineers, she on other occasions grew confrontational with them.
“It was just a lifelong thing for her,” said Sarah Stensberg, a former friend. “When she gets in these phases of intensity, she does really stupid things. She’ll push everyone away. She’ll write threatening emails. She’ll post things online about the things she’s doing.”
At one point, Ms. Stensberg said, she and her husband took Ms. Thompson to the hospital to get her into an inpatient treatment facility. Later, after having continued issues, Ms. Stensberg said she and her husband attempted to cut ties with Ms. Thompson.
“He always said she had a lot of potential to be very focused and do a lot in this world,” Ms. Stensberg said.
Despite the troubles, Ms. Thompson’s technical know-how helped her land a job at Amazon Web Services in 2015, according to her resume. She stayed there for a little more than a year.
No comments:
Post a Comment