What We Can Learn from the Capital One Hack
Summary: A former Amazon employee was arrested and charged with stealing more than 100 million consumer credit applications from Capital One, and reporting based on interviews with roughly a dozen security experts indicates the breach came from a misconfigured open-source ModSecurity web application firewall hosted on AWS. The intruder used a Server Side Request Forgery attack to trick the firewall into relaying requests to the AWS metadata service, which returned temporary credentials from a role with permissions to list and read every file in the affected S3 buckets.
Why it matters: The attack method was well understood for years and SSRF detection rules are not shipped by default in the WAF that was exploited, so the exposure came down to an over-permissive role and a configuration error rather than a novel flaw. Cloudflare's Evan Johnson is quoted calling SSRF the most serious vulnerability facing organizations that use public clouds, and AWS said the intrusion was caused by a customer misconfiguration, not its infrastructure.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026