The WAF That Open-Sourced the Bank: Deconstructing Capital One’s AWS Cloud Breach
A factual, bite-sized breakdown of the landmark 2019 Capital One security incident. This case study details how a misconfigured EC2-hosted WAF, an unconstrained IAM role, and the vulnerabilities of AWS IMDSv1 allowed an attacker to siphon over 100 million customer records—and how it fundamentally reshaped AWS identity security.
In 2019, a former cloud software engineer breached Capital One’s AWS environment, compromising over 100 million customer records.The Entry: The attacker exploited an unpatched Server-Side Request Forgery (SSRF) flaw in an open-source Web Application Firewall (WAF) running on an EC2 instance.The Privilege: The compromised EC2 instance had an attached IAM role with excessive read permissions to AWS S3.The Extraction: Querying the AWS Instance Metadata Service (IMDSv1) via SSRF leaked the role’s temporary STS credentials. The attacker used standard AWS CLI commands to sync and exfiltrate over 700 S3 buckets of sensitive financial data.The Fallout: Over $80 million in regulatory fines, hundreds of millions in remediation costs, and an industry-wide push by AWS to release IMDSv2, which requires session-oriented token headers to neutralize SSRF metadata theft
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article