# Incidentes de seguridad relacionados a AWS

Estos incidentes ilustran la importancia de una gestión de seguridad adecuada en la nube.

1. <mark style="color:orange;">**Capital One Data Breach (2019)**</mark><mark style="color:orange;">:</mark> Uno de los incidentes más notorios involucró a Capital One, donde un atacante logró acceder a más de 100 millones de registros de clientes almacenados en AWS. Este ataque se realizó explotando una configuración mal configurada de un Web Application Firewall (WAF) en AWS, lo que permitió al atacante obtener credenciales con amplios permisos. Este incidente subraya la importancia de una configuración segura y el principio de mínimo privilegio.
2. <mark style="color:orange;">**Imperva Data Breach (2019)**</mark><mark style="color:orange;">:</mark> Imperva, una empresa de ciberseguridad, experimentó una brecha de seguridad que expuso datos de clientes debido a una configuración incorrecta de AWS S3. La brecha afectó a los datos de los clientes de Cloud Web Application Firewall (WAF) de Imperva, anteriormente conocido como Incapsula. Este incidente destaca los riesgos de no seguir las prácticas recomendadas para la seguridad de los buckets de S3.
3. <mark style="color:orange;">**Verizon Data Exposure (2017)**</mark><mark style="color:orange;">:</mark> Un incidente de exposición de datos de Verizon ocurrió cuando un bucket S3 de AWS, mal configurado y accesible públicamente, expuso aproximadamente 6 millones de registros de clientes. Aunque los datos no fueron robados por ciberdelincuentes, el incidente mostró cómo la visibilidad y el control adecuados sobre las configuraciones de los servicios en la nube son cruciales para la seguridad de los datos.

Estos incidentes destacan diferentes aspectos de la seguridad en la nube y la importancia de seguir las mejores prácticas de seguridad, como asegurar adecuadamente las configuraciones, aplicar el principio de mínimo privilegio y realizar auditorías y revisiones de seguridad regularmente. AWS proporciona herramientas y documentación para ayudar en la gestión de la seguridad, pero las organizaciones también deben tomar medidas proactivas para proteger sus recursos en la nube.

Te recomendamos estar al dia con el siguiente recurso:

{% embed url="<https://github.com/ramimac/aws-customer-security-incidents>" %}

<table><thead><tr><th width="174">Name</th><th width="141">Date</th><th width="166">Root Cause</th><th width="220">Escalation Vector(s)</th><th width="200">Impact</th><th width="599">Link to details</th></tr></thead><tbody><tr><td>Uber</td><td>2014, May</td><td>Github Gist (data analysis script) with AWS credentials</td><td>N/A</td><td>50,000 records, including names and driver’s licenses from S3 hosted database prunes</td><td><a href="https://www.reuters.com/article/uk-uber-tech-lyft-hacking-exclusive/exclusive-in-lawsuit-over-hacking-uber-probes-ip-address-assigned-to-lyft-exec-sources-idUKKCN0S20D020151008">Exclusive: In lawsuit over hacking, Uber probes IP address assigned to Lyft exec - sources </a>, <a href="https://magoo.medium.com/a-blameless-post-mortem-of-usa-v-joseph-sullivan-a137162f7fc9">A blameless post-mortem of USA v. Joseph Sullivan</a></td></tr><tr><td>Code Spaces</td><td>2014, June</td><td>AWS Console Credentials (Phishing?)</td><td>Attacker created additional accounts/access keys</td><td>Wiped S3 buckets, EC2 instances, AMIs, EBS snapshots</td><td><a href="https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/">Hacker puts code spaces out of business</a></td></tr><tr><td>BrowserStack</td><td>2014, November</td><td>Shellshock on exposed, outdated prototype machine</td><td>Access keys on server, used to create IAM user, create EC2, and mount backup</td><td>Steal user data and email users</td><td><a href="http://archive.today/rsmmS">BrowserStack analysis</a></td></tr><tr><td>DNC Hack by the GRU</td><td>2016, June</td><td>Unknown, test clusters breached</td><td>EC2 Snapshots copied to attacker AWS accounts</td><td>Tableau and Vertica Queries</td><td><a href="https://www.politico.com/f/?id=00000168-6161-de11-af7d-ef7327ea0000">DEMOCRATIC NATIONAL COMMITTEE v. THE RUSSIAN FEDERATION</a></td></tr><tr><td>DataDog</td><td>2016, July</td><td>CI/CD AWS access key and SSH private key leaked</td><td>Attacker attempted to pivot with customer credentials</td><td>3 EC2 instances and subset of S3 buckets</td><td><a href="https://web.archive.org/web/20201128071102/https://www.datadoghq.com/blog/2016-07-08-security-notice/">2016-07-08 Security Notice</a></td></tr><tr><td>Uber</td><td>2016, October</td><td>~13 Hacked Uber credentials purchased for forum gave access to private Github Repo with AWS credentials</td><td>N/A</td><td>Names and driver’s license numbers of 600k drivers, PII of 57 million users in unencrypted manual backup</td><td><a href="https://web.archive.org/web/20210824171652/https://www.bloomberg.com/news/articles/2017-11-21/uber-concealed-cyberattack-that-exposed-57-million-people-s-data">Uber concealed cyberattack ...</a>, <a href="https://magoo.medium.com/a-blameless-post-mortem-of-usa-v-joseph-sullivan-a137162f7fc9">A blameless post-mortem of USA v. Joseph Sullivan</a></td></tr><tr><td>Lynda.com</td><td>2016, December</td><td>Private Github Repo with AWS credentials</td><td>N/A</td><td>User data for 9.5m users, attempted extortion</td><td><a href="http://archive.today/oU2ZL">2 Plead Guilty in 2016 Uber and Lynda.com Hacks</a></td></tr><tr><td>OneLogin</td><td>2017, May</td><td>AWS keys</td><td>Created EC2 instances</td><td>Accessed database tables (with encrypted data)</td><td><a href="https://web.archive.org/web/20210620180614/https://www.onelogin.com/blog/may-31-2017-security-incident">May 31, 2017 Security Incident</a></td></tr><tr><td>Politifact</td><td>2017, October</td><td>"Misconfigured cloud computing server"</td><td>N/A</td><td>Coinhive cryptojacking</td><td><a href="https://web.archive.org/web/20200806102838/https://www.washingtonpost.com/news/the-switch/wp/2017/10/13/hackers-have-turned-politifacts-website-into-a-trap-for-your-pc/">Hackers have turned Politifact’s website into a trap for your PC</a></td></tr><tr><td>DXC Technologies</td><td>2017, November</td><td>Private AWS key exposed via Github</td><td>244 EC2 instance started</td><td>Cryptomining</td><td><a href="https://web.archive.org/web/20210228215919/https://www.theregister.com/2017/11/14/dxc_github_aws_keys_leaked/">DXC spills AWS private keys on public GitHub</a></td></tr><tr><td>Drizly</td><td>2018</td><td>AWS Credentials committed to public github repo</td><td>N/A</td><td>Cryptojacking</td><td><a href="https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million">FEDERAL TRADE COMMISSION - Drizly Complaint</a></td></tr><tr><td>LA Times</td><td>2018, February</td><td>S3 global write access</td><td>N/A</td><td>Cryptojacking</td><td><a href="https://web.archive.org/web/20210413201832/https://www.tripwire.com/state-of-security/security-data-protection/la-times-website-cryptojacking-attack/">Coinhive cryptojacking added to homicide.latimes.com</a></td></tr><tr><td>Tesla</td><td>2018, February</td><td>Globally exposed Kubernetes console, Pod with AWS credentials</td><td>N/A</td><td>Cryptojacking</td><td><a href="https://www.wired.com/story/cryptojacking-tesla-amazon-cloud/">Hack Brief: Hackers Enlisted Tesla's Public Cloud to Mine Cryptocurrency</a></td></tr><tr><td>Chegg</td><td>2018, April</td><td>Former contractor abuses broadly shared root credential</td><td>Unknown</td><td>40 million users' data (from S3 bucket)</td><td><a href="https://www.ftc.gov/system/files/ftc_gov/pdf/2023151-Chegg-Complaint.pdf">FTC Complaint</a></td></tr><tr><td>imToken</td><td>2018, June</td><td>Email account compromise</td><td>Reset AWS account password</td><td>Minimal customer device data</td><td><a href="https://archive.ph/bRjXi">Disclosure of Security Incidents on imToken</a></td></tr><tr><td>Voova</td><td>2019, March</td><td>Stolen credentials by former employee</td><td>N/A</td><td>Deleted 23 servers</td><td><a href="https://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy-annihilates-23-of-his-ex-employers-aws-servers/">Sacked IT guy annihilates 23 of his ex-employer’s AWS servers</a></td></tr><tr><td>Capital One</td><td>2019, April</td><td>"Misconfigured WAF" that allowed for a SSRF attack</td><td>Over-privileged EC2 Role</td><td>100 million credit applications</td><td><a href="https://www.fugue.co/blog/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach">A Technical Analysis of the Capital One Cloud Misconfiguration Breach</a></td></tr><tr><td>JW Player</td><td>2019, September</td><td>Weave Scope (publicly exposed), RCE by design</td><td>N/A</td><td>Cryptojacking</td><td><a href="https://web.archive.org/web/20210828044334/https://medium.com/jw-player-engineering/how-a-cryptocurrency-miner-made-its-way-onto-our-internal-kubernetes-clusters-9b09c4704205">How A Cryptocurrency Miner Made Its Way onto Our Internal Kubernetes Clusters</a></td></tr><tr><td>Malindo Air</td><td>2019, September</td><td>Former employee insider threat</td><td>N/A</td><td>35 million PII records</td><td><a href="https://www.infosecurity-magazine.com/news/malindo-air-data-breach-was-inside/">Malindo Air: Data Breach Was Inside Job</a></td></tr><tr><td>Imperva</td><td>2019, October</td><td>“Internal compute instance” globally accessible, “Contained” AWS API key</td><td>N/A</td><td>RDS snapshot stolen</td><td><a href="https://web.archive.org/web/20210620143023/https://www.imperva.com/blog/ceoblog/">Imperva Security Update</a></td></tr><tr><td>Cameo</td><td>2020, February</td><td>Credentials in mobile app package</td><td>N/A</td><td>Access to backend infrastructure, including user data</td><td><a href="https://www.vice.com/en/article/akwj5z/cameo-app-exposed-private-videos-user-data-passwords">Celeb Shout-Out App Cameo Exposes Private Videos and User Data</a></td></tr><tr><td>Open Exchange Rates</td><td>2020, March</td><td>Third-party compromise exposing access key</td><td>N/A</td><td>User database</td><td><a href="https://nakedsecurity.sophos.com/2020/03/20/exchange-rate-services-customer-details-hacked-via-aws/">Exchange rate service’s customer details hacked via AWS</a></td></tr><tr><td>First Republic Bank</td><td>2020, March</td><td>Fired employee incompletely offboarded</td><td>N/A</td><td>System interruption</td><td><a href="https://www.breaches.cloud/incidents/first-republic/">First Republic Bank</a></td></tr><tr><td>Live Auctioneers</td><td>2020, July</td><td>Compromised third party software granting access to cloud environment</td><td>N/A</td><td>User database, including MD5 hashed credentials</td><td><a href="https://www.atg.wa.gov/live-auctioneers/">Washington State OAG - Live Auctioneers</a></td></tr><tr><td>Twilio</td><td>2020, July</td><td>S3 global write access</td><td>N/A</td><td>Magecart<a href="https://github.com/ramimac/aws-customer-security-incidents#2">2</a></td><td><a href="https://web.archive.org/web/20210813010417/https://www.twilio.com/blog/incident-report-taskrouter-js-sdk-july-2020">Incident Report: TaskRouter JS SDK Security Incident</a></td></tr><tr><td>Natures Basket responsible disclosure</td><td>2020, July</td><td>Hard-coded root keys in source code exposed via public S3 bucket</td><td>N/A</td><td>N/A</td><td><a href="https://web.archive.org/web/20200825004529/https://medium.com/@gchib/naturesbasket-aws-root-account-takeover-e4aa5c5e95e1">GotRoot! AWS root Account Takeover</a></td></tr><tr><td>Drizly</td><td>2020, July</td><td>Inactive Github account compromised via reused password, granting AWS credential access in source code</td><td>N/A</td><td>RDS Instance with 2.5 million users data exfiltrated</td><td><a href="https://archive.ph/p21Vk">FTC Takes Action Against Drizly and its CEO James Cory Rellas for Security Failures that Exposed Data of 2.5 Million Consumers</a></td></tr><tr><td>Cryptomining AMI</td><td>2020, August</td><td>Windows 2008 Server Community AMI</td><td>N/A</td><td>Monero miner</td><td><a href="https://web.archive.org/web/20210625192906/https://www.darkreading.com/cloud/cryptominer-found-embedded-in-aws-community-ami/d/d-id/1338713/">Cryptominer Found Embedded in AWS Community AMI</a></td></tr><tr><td>Animal Jam</td><td>2020, November</td><td>Slack compromise exposes AWS credentials</td><td>N/A</td><td>User database</td><td><a href="https://web.archive.org/web/20210122070047/https://www.theregister.com/2020/11/12/animal_jam_breached/">Kids' gaming website Animal Jam breached</a></td></tr><tr><td>Cisco</td><td>2020, December</td><td>Former employee with AWS access 5 months post-resignation</td><td>N/A</td><td>Deleted ~450 EC2 instances</td><td><a href="https://web.archive.org/web/20210304053727/https://www.zdnet.com/article/former-cisco-engineer-sentenced-to-prison-for-deleting-16k-webex-accounts/">Former Cisco engineer sentenced to prison</a></td></tr><tr><td>Juspay</td><td>2021, January</td><td>Compromised old, unrecycled Amazon Web Services (AWS) access key</td><td>N/A</td><td>Masked card data, email IDs and phone numbers</td><td><a href="https://web.archive.org/web/20210127001214/https://threatpost.com/data-from-august-breach-of-amazon-partner-juspay-dumped-online/162740/">Data from August Breach of Amazon Partner Juspay Dumped Online</a></td></tr><tr><td>20/20 Eye Care Network and Hearing Care Network</td><td>2021, January</td><td>Compromised credential</td><td>N/A</td><td>S3 buckets accessed then deleted</td><td><a href="https://www.databreaches.net/20-20-eye-care-network-and-hearing-care-network-notify-3253822-health-plan-members-of-breach-that-deleted-contents-of-aws-buckets/">20/20 Eye Care Network and Hearing Care Network notify 3,253,822 health plan members of breach that deleted contents of AWS buckets</a></td></tr><tr><td>Sendtech</td><td>2021, February</td><td>(Current or former employee) Compromised credentials</td><td>Created additional admin account</td><td>Accessed customer data in S3</td><td><a href="https://web.archive.org/web/20220923025502/https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---Sendtech-Pte-Ltd---220721.ashx?la=en">PERSONAL DATA PROTECTION COMMISSION Case No. DP-2102-B7884</a></td></tr><tr><td>LogicGate</td><td>2021, April</td><td>Compromised credentials</td><td>N/A</td><td>Backup files in S3 stolen</td><td><a href="https://web.archive.org/web/20210519233848/https://techcrunch.com/2021/04/13/logicgate-risk-cloud-data-breach/">Risk startup LogicGate confirms data breach</a></td></tr><tr><td>Ubiquiti</td><td>2021, April</td><td>Compromised credentials from IT employee Lastpass (alleged former employee insider threat)</td><td>N/A</td><td>root administrator access to all AWS accounts, extortion</td><td><a href="https://web.archive.org/web/20210731152054/https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirms-breach-response-iniquity/">Ubiquiti All But Confirms Breach Response Iniquity</a></td></tr><tr><td>Uran Company</td><td>2021, July</td><td>Compromised Drupal with API keys</td><td>N/A</td><td>Cryptomining</td><td><a href="https://topdigital.agency/clear-and-uncommon-story-about-overcoming-issues-with-aws/">Clear and Uncommon Story About Overcoming Issues With AWS</a></td></tr><tr><td>redoorz.com</td><td>2021, September</td><td>Access Key leaked via APK</td><td>N/A</td><td>Customer database stolen</td><td><a href="https://web.archive.org/web/20211130202805/https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---Commeasure-Pte-Ltd---15092021.pdf?la=en">PERSONAL DATA PROTECTION COMMISSION Case No. DP-2009-B7057</a></td></tr><tr><td>HPE Aruba</td><td>2021, October</td><td>Unknown exposure of Access Key</td><td>N/A</td><td>Potential access to network telemetry and contact trace data</td><td><a href="https://www.arubanetworks.com/support-services/security-bulletins/central-incident-faq/">Aruba Central Security Incident</a></td></tr><tr><td>Kaspersky</td><td>2021, November</td><td>Compromised SES token from third party</td><td>N/A</td><td>Phishing attacks</td><td><a href="https://www.bleepingcomputer.com/news/security/kasperskys-stolen-amazon-ses-token-used-in-office-365-phishing/">Kaspersky's stolen Amazon SES token used in Office 365 phishing</a></td></tr><tr><td>Onus</td><td>2021, December</td><td>Log4Shell vulnerability in Cyclos server</td><td>AmazonS3FullAccess creds (and DB creds) in Cyclos config</td><td>2 million ONUS users’ information including EKYC data, personal information, and password hash was leaked.</td><td><a href="https://cystack.net/research/the-attack-on-onus-a-real-life-case-of-the-log4shell-vulnerability">The attack on ONUS – A real-life case of the Log4Shell vulnerability</a></td></tr><tr><td>Flexbooker</td><td>2021, December</td><td>Unknown</td><td>Unknown</td><td>3.7M first and last names, email addresses, phone numbers, "encrypted" passwords</td><td><a href="https://therecord.media/booking-management-platform-flexbooker-leaks-3-7-million-user-records/">Booking management platform FlexBooker leaks 3.7 million user records</a></td></tr><tr><td>npm</td><td>2022, April</td><td>Third party OAuth token compromise granting private repository access, containing AWS keys</td><td>Unknown</td><td>100k users data (from 2015)</td><td><a href="https://github.blog/2022-05-26-npm-security-update-oauth-tokens/">npm security update: Attack campaign using stolen OAuth tokens</a></td></tr><tr><td>Uber</td><td>2022, September</td><td>Contractor account compromise leading to AWS credential discovery on a shared drive</td><td>Unknown</td><td>N/A</td><td><a href="https://www.uber.com/newsroom/security-update/">Uber - Security update</a></td></tr><tr><td>Lastpass</td><td>2022, October</td><td>Stole source code and accessed development environment via compromised developer account (an IAM User)</td><td>Unknown pivot point into production environment. Later compromise of a privileged engineer's personal machine to gain access to decryption keys for stolen data</td><td>Internal and customer data broadly compromised, including backups of MFA database</td><td><a href="https://support.lastpass.com/help/incident-2-additional-details-of-the-attack">Notice of Recent Security Incident</a>,<a href="https://support.lastpass.com/help/incident-2-additional-details-of-the-attack">Incident 2 – Additional details of the attack</a></td></tr><tr><td>Teqtivity (Uber Vendor)</td><td>2022, December</td><td>Unknown</td><td>Unknown</td><td>"AWS backup server" with device and user information</td><td><a href="https://www.teqtivity.com/breach-notification-statement">Breach Notification Statement</a>, <a href="https://www.bleepingcomputer.com/news/security/uber-suffers-new-data-breach-after-attack-on-vendor-info-leaked-online/">Uber suffers new data breach after attack on vendor, info leaked online</a></td></tr><tr><td>CommuteAir</td><td>2023, January</td><td>Publicly Exposed Jenkins with hardcoded credentials</td><td>N/A</td><td>2019 FAA No Fly List</td><td><a href="https://maia.crimew.gay/posts/how-to-hack-an-airline/">how to completely own an airline in 3 easy steps</a>, <a href="https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/">U.S. airline accidentally exposes ‘No Fly List’ on unsecured server</a></td></tr></tbody></table>