25 ms·
Gigabytes of user data from hack of Patreon donations site dumped online
- jtokoph 11y agoHas anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of username/password would be completely safe, but if access tokens were leaked, then many users could have their Facebook data mined.
- iLoch 11y agoAll they have to do is expire their secret key and all the access tokens will be invalidated.
- florianletsch 11y agoAre Facebook access tokens vulnerable to such an attack? If I remember correctly, at least Google tokens wouldn't be: The application receives a token from Google. With that token, a new session token is created. This session token expires and can only be renewed with the application token and the correct redirect URL. If Facebook uses a similar scheme, tokens would be useless without the running application renewing session tokens.
- methodover 11y agoNothing like that happens with Facebook, if I recall correctly. Once you have an access token you're good to go until it expires.
- steckerbrett 11y agoThat's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
- icebraining 11y agoHow do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
- rplnt 11y agoThen they didn't do it seriously enough? Either they are not hacked or they can find the person responsible (rogue employee, etc..).
- reidrac 11y agoI guess we could argue that if you get security seriously enough you don't get hacked. EDIT: I was being sarcastic. This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process_of_secur.html https://www.schneier.com/essays/archives/2000/04/the_process...
- raverbashing 11y agoThis is the funniest thing I read today on HN, congratulations
- atmosx 11y agoNo actually we don't. Security, if taken seriously is a set of policies related to software and hardware (in the post-Snowden era). Applying patches like grsecurity, running services through chroot jails, installing IDS systems and reporting tools makes a system (every system) extremely inflexible. Updates become nightmare. Tuning a system to avoid false positives might take a forever and then the topology/setup/clients/users change. Back to square one again! New tech like docker or any kind of virtualization are out of question. You probably don't want PHP, Python or Ruby applications. Do you really need JS. Can you debug all the libraries the developers used? Is their responsibility or no, to audit every new shiny framework for security?! Are they going to pay for it? Is it worth it? The personnel, even the managers, must go through a lot when the systems are secure. More often then than not, people consider standard security measures exaggerations, so they more often than not try to avoid all the hassle. Can you cope with these people, time and again? And sometimes even taking extreme measures might not be enough[1]. We keep adding layers upon layers at all levels: Development, Sys-admin (now Devops), etc. Can audit every piece of software that comes into the stack? Of course not. You either have a security team that breaks everyone's balls with audits and strict policies that will cost you money and most startups or even corps can not afford the kind of inflexibility and cost that this brings in. Security is a trade-off and truth is that most of the times is just additional cost and complexity and even when you're ready to make that trade-off, you're still not invulnerable by any means. [1] http://www.cnet.com/news/report-of-fbi-back-door-roils-openbsd-community/ http://www.cnet.com/news/report-of-fbi-back-door-roils-openb...
- Axsuul 11y agoWhy don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.
- raesene4 11y agothe problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.
- Axsuul 11y agoDepends on the attack. If the key used to encrypt the data is stored on another server and loaded into memory when the application is initialized, then the attackers technically wouldn't be able to get access to that key unless they also hacked the server with the key.
- steckerbrett 11y agoI don't see how that protects anything, if the information is around for the webserver to use it's around for whoever has root on your box.
- Axsuul 11y agoIt would still protect against attacks that don't involve having root access to the box (i.e. Ashley Madison data breach)
- raesene4 11y agosure for some attacks it might help, but ultimately if someone has compromised your server, that server is likely to have the ability to load the key to decrypt the data. For example to handle the case of unattended server reboot, you'd be likely to have the server have a script to load the key back into memory. Attacker gets shell access, they get the script, they get the key... Security is always a trade-off and people tend not to engineer their webapps with the assumption that they'll be breached in specific ways.
- deleted 11y ago[deleted]
- Axsuul 11y agoPatreon uses Stripe so I'm pretty sure the hackers expected to not get any credit card numbers.
- deanCommie 11y agoThis is the first time I've been Pwned (https://haveibeenpwned.com/ https://haveibeenpwned.com/) Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?
- sp332 11y agoYou should have received an email with this information from Patreon. You can read the notice here as well https://www.patreon.com/posts/3457485 https://www.patreon.com/posts/3457485
- lt 11y agoThrough the API: https://haveibeenpwned.com/api/v2/breachedaccount/foo@bar.com https://haveibeenpwned.com/api/v2/breachedaccount/foo@bar.co... I also couldn't find the details in the site anywhere.
- sp332 11y agohttps://haveibeenpwned.com/PwnedWebsites#Patreon https://haveibeenpwned.com/PwnedWebsites#Patreon
- dublinclontarf 11y agoI'm wondering what their setup is? Are they running on their own machines? AWS? Heroku? From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node. I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.
- justusw 11y agoSince their servers appear to run on AWS, and knowing that the breach was possible because their development servers were exposed to the public with production user data, it is safe to assume that they had their development servers on AWS as well.
- dublinclontarf 11y agoAh, development servers with real data.
- kevinnk 11y agoLooks like they use AWS, MySQL, and Python. They also use Stripe for payments (all their secret keys and source are in the dump).
- untilHellbanned 11y agowait, they store their Stripe API keys in their database?
- caio1982 11y agoIt doesn't tell you everything but it helps: http://builtwith.com/patreon.com http://builtwith.com/patreon.com
- deleted 11y ago[deleted]
- anc84 11y agoThe centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?
- dennisnedry 11y agoSo content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?
- indiv0 11y agoBitcoin would be the obvious choice.
- marcosdumay 11y agoThat would require a big change to the Bitcoin algorithms, wouldn't it? Those are too many transactions with too little face value.
- anc84 11y agoSimple standard bank transaction? If you want to support the creator regularly, you can easily set that up as well.
- notthathill 11y agoBank transactions are anything but simple to set up in some places, and can also be very expensive to set up when you're talking about international transfers of money. Thankfully there are things like IBANs and BICs, but that doesn't help when a bank wants to charge you something like 5x the value of the transfer (when the transfer is a low value, like 5/month). Credit card processing already handles the whole international transfer cost, and puts the burden on the processor instead of the payer. That processor can then do things like batch transactions to reduce the cost.
- 11y ago
- callesgg 11y agoSo what of importance is in their database that one could not find by otherwise searching the web? From the email i received from patreon i reckon the only actual private thing is the exact sum i pay to who. Some find addresses to be private, but at-least in my case any one can find where i live by looking on the local yellow pages website.
- greggman 11y agoThere are plenty of adult content artists that some people might rather not have others know they're supporting. Especially if that adult content is out of the ordinary.
- rasz_pl 11y agoYou can look up who sponsored Lara banging a horse for example.
- cuckcuckspruce 11y agoSome GamerGate supporters have made claims that video game reviewers have covered games and develelopers that they have backed financially through Patreon without disclosing this to their audience. This disclosuee would allow those making that claim to demonstrate if their claims are accurate, and it allows those about whom the claim is made to demonstrate that the claim is inaccurate.
- TazeTSchnitzel 11y agoAren't patrons public, though? The only relevance to gamergate is that they'd be able to doxx people who support figures they don't like.
- mattbasta 11y agoDo GG accusations actually matter anymore? Does anyone still care besides the people actually making the accusations?
- deleted 11y ago[deleted]
- Udo 11y agoThere is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally, that internal API server couldn't even communicate with the internet directly. I've been doing web programming for a long time, and while direct DB access is both convenient and fast, I have to admit it's not easy to monitor these databases for breaches, or to stop them from spilling their entire contents if so requested.
- JulianMorrison 11y agoYeah. I feel like an ideal architecture would be to use NSQ and transmit not queries, but a minified JSON bundle of query "name" with query parameters. Then have stateless DB service nodes preloaded with canned, named queries on secured VMs whose only access to the outside world is NSQ. Bonus, you can tap off DB requests with an ephemeral channel and log them.
- mpeg 11y agoThat sounds like SOAP + SQL Server stored procedures (full replication mode to log db requests, then monitor any SQL queries). I'm assuming other vendors have similar set ups. I've ran systems like that, and I'm glad things are a lot easier to maintain now (stored procs are a pain in the ass, whether they exist in the database or in the app layer). Query injection is solved by parameterising queries (never sanitising them yourself), it should not be an issue nowadays, "advanced SQL injection" is a lie, either you can inject or you can't. If you can inject, it doesn't matter how many protections you put in place, you can always extract data via timing attacks or boolean conditions.
- JulianMorrison 11y agoYour SQL is going to be "stored" one way or another, whether it's implicitly in the internal workings of an ORM, explicitly in code or mybatis style config, or explicitly in the DB. I think isolating it into data workers, and making them feed off a high throughput message queue (hiding restarts), minimizes the amount of redeploying needed.
- jhh 11y agoI had just been listening to the "Talk Python to Me" podcast episode with Albert Sheu of Patreon (http://talkpython.fm/episodes/show/14/moving-from-php-to-python-3-with-patreon http://talkpython.fm/episodes/show/14/moving-from-php-to-pyt...). Having heard the guy's voice and his enthusiasm for his work makes me really feel sorry for the team at Patreon. This is pretty much worst case and may end the company.
- raesene4 11y agoI like patreon a lot and feel sorry that they've been breached. Luckily (for them) I'd guess that with the number of breaches these days, the negative publicity on them will be a lot less than it would have been a couple of years back, so hopefully they'll be able to carry on ok.
- Axsuul 11y agoWhy do you think it'll end the company? It's a marketplace with network effects. And not to mention, many people depend on Patreon for their primary source of income. It won't simply just go away.
- deleted 11y ago[deleted]
- cfontes 11y agoThis is now so common I am starting to become numb to about it.
- clebio 11y agoThis just got me thinking, which would be worse -- your account data from any one site leaked, or metadata about your internet activities leaked? Thinking about the arguments about mass data collection and metadata, I'm pretty certain I'd be most worried about metadata. Do metadata-collecting companies tend to be more secure, or more security aware, or it just hasn't happened yet? What I mean is, if your private browsing session from your laptop, along with non-private sessions, and data connections for IM conversations, were all leaked, that would be intensely revealing.
- nitrogen 11y agoAIUI most states don't require breaches to be announced unless they get some combo of credit cards, passwords, email/name/phone, and govt' IDs. So metadata spying companies like Adobe/Omniture might never report being hacked at all. Frankly it bothers me how lackadaisically business types treat security sometimes, caring more about company image than customer privacy, to the point of never revealing massive breaches if they don't hit states' ridiculous requirements for disclosure.
- paulmd 11y agoAll the data breaches lately have demonstrated the need for some kind of professional engineering license to ensure compliance with best practices. Even if your app is meaningless in and of itself, a data breach can reveal Personally Identifying Information or credentials for other sites and accounts. There's too much of a "code cowboy" mentality out there right now. As a community we've become very feature-driven and security is usually the last consideration. You need somebody whose name goes on the dotted line and assumes responsibility for the overall integrity of the system, because otherwise it's always Somebody Else's Problem. If you get breached and you weren't following best practices, then your PE takes on the liability, just like a building collapse or something. This can be accomplished without significant burden to smalltime admins now that we have stuff like AWS and Docker. You should be able to Chef yourself a secure AWS instance and then Docker-Compose yourself a functional application deployment. Most smalltime users probably want some combination of CMS, storefront, or forum, and it should be pretty easy to provide these as prefabs. Some customization will be necessary, but then it will fall on the appdevs to force validation and security on the webdevs. If your defaults let someone inject SQL or something then it falls on the appdev, if the webdev uses an "unsafe" flag and overrides the defaults it rolls downhill onto the webdev. If you don't follow unit/integration testing best-practices, then it falls on you. If you don't pin your versions and a vulnerability opens up in the future - falls on you. Etc. These standards should apply whenever you are a commercial entity or store Personally Identifying Information. If you are a legit smalltime user and don't want to use professionally licensed software then go ahead and do whatever, but you should be content with storing a username/password and perhaps using a one-time SMS or email validation that doesn't get stored. These then travel in a "viral" fashion like copyleft - if you are building a commercial website you need to do it using a storefront that has a licensed PE, that runs on a runtime that has a licensed PE. Once these are commonly available then most users would probably follow suit anyway. This idea isn't going to be very popular with startup coders from Silicon Valley, but the reality is that the US is way out there on this stuff and we're seeing an epidemic of data breaches as a result. The EU has much more stringent data privacy laws. These don't have a whole lot of teeth at the moment, but the principles are down on paper and this is what I think you would need to implement them effectively. To me HTML code is really a microcosm of the problem. People will write whatever old crap for as long as you let them get away with it. You have to make it as easy as possible to do the right thing, but a lot of people will have to be dragged kicking and screaming by turning on XHTML and disallowing standards non-compliance. Professional licensing is how you do that for applications and systems engineering.
- mwarkentin 11y agoApparently they were compromised via a publicly exposed Werkzeug debugger: http://labs.detectify.com/post/130332638391/how-patreon-got-hacked-publicly-exposed-werkzeug http://labs.detectify.com/post/130332638391/how-patreon-got-...
- theintern 11y agoThere's almost no hack needed here, as the article says, they basically opened up remote code execution to anyone. That's shockingly bad.
- the_mitsuhiko 11y agoMakes me wonder what can be done to prevent this from happening without making it a terrible experience from a user point of view. Maybe the solution would be to store a password for the debugger and ask for it on first usage.
- andy_ppp 11y agoIt said the guys name in the subdomain that this was available on. I can only imagine how that guy must feel, worst thing that I can imagine happening as a dev. We've all made stupid mistakes and not paid a price as high as this!
- xorcist 11y agoMistakes happens. But it should not be possible to put production data in publicly accessible systems by mistake. Not without committing a criminal offense, at the very least. Your customer data is your customers' data. It's not yours to toy with as you please.
- mahouse 11y ago>Your customer data is your customers' data. It's not yours to toy with as you please. That's the European point of view. In the US, customer data is nothing more than an asset.
- bariumbitmap 11y agoI was somewhat surprised to find my email on the list, since I don't have a Patreon account. It seems that when Subbable was acquired by Patreon, they got the user information, and possibly password database, too. I can't log in to Patreon with my Subbable password, but my email address is definitely in the breach. Makes me glad I use a password manager. It's also a sobering reminder of the permanence of user data. You have to trust the competence of not only the service you use now, but any company that owns that service down the road. (Not that Subbable was necessarily more secure than Patreon.)
- 6stringmerc 11y agoWow, I avoided Patreon because I didn't trust that all the music being hosted was following proper licensing and compensation rules (e.g. looked like >50% of songs were covers), so this is kind of a double shock to me about how they ran their operation. Believe it or not, this re-inforces my commitment to SoundCloud, which isn't monetized (yet), thereby keeping listeners' financial information off the table for the present.
- griffinmb 11y agoI believe you are thinking of a different platform. Patreon is a Kickstarter-like site, but with a monthly pledge. It is not for music hosting.
- 6stringmerc 11y agoNo, I'm not mistaken, at all. I'm very clear on what I understand about Patreon. If you want, you can probably get into the hacked data and see my email warning them that by being a financial conduit they were not abiding by Safe Harbors with respect to the real rights owners. It may not have "hosted" the music, but if you click on the music page, what do you see? Music videos. Then Patreon was the method to give those people money. People who may or may not have secured the proper licenses and paid the original artists. Also, if I was an artist on the site, my personal information would be part of that dump - SSN, etc - so my reluctance to engage with them was prudent. Edit: Downvoting my observations? I guess there are more people here that don't understand copyright than I figure, oh well.
- chatmasta 11y agoI've never heard of Patreon until now. This might be the most press they've ever gotten. At what point do we start asking questions like, did this company "hack" themselves for the publicity? There is a great moral hazard in providing so much free publicity to companies that get "hacked."
- 6stringmerc 11y agoUnlikely, due to the rumored personal information of all the artists being compromised. That's not a rational avenue.
- chatmasta 11y agoUnless nobody finds out...
- justizin 11y agoI have heard of Patreon, and used it to support a number of artists and other projects. You and your one brain and human experience are an incredibly bad sample size. :) And why in the world would they want to get PR by faking a data breach?
- facetube 11y agoHey, guess what? To delete your account, you have to e-mail delete@patreon.com "from your registered e-mail address". There is no way to do it over a secure connection. What could go wrong?
- 6stringmerc 11y agoNot sure why you're being downvoted other than expressing doubt at the decisions Patreon has made / is making with respect to best practices. I'm getting slammed for understanding and pointing out they've had some suspect practices in the past based on copyright law in music. Shrug
- ne0n 11y agoFor anyone that doesn't know, email is not a "secure connection" and the "from" address on an email can be spoofed.
- methodover 11y agoThis scares me. I'm the eng lead of a startup that's a bit smaller than Patreon. And hey, we program in Python too. We're not vulnerable to this particular problem. And I feel pretty confident that both our stage and production environments are well-protected. However, I can't help but wonder if I'm missing something. I'm sure Patreon felt confident a month ago.
- nullrouted 11y agoIf you'd like some free help I don't mind spending some time looking at your overall setup. Feel free to email me ross [at] ruselabs.com.
- trhway 11y ago"we take security seriously" reminds me "we come in peace" from Iron Sky :)
- chucky_z 11y agoUnless every single employee actually follows this clause, just one bad apple can ruin every security procedure in the world. Layer 8 is awfully vulnerable...
- trhway 11y ago>Unless every single employee actually follows this clause, just one bad apple can ruin every security procedure in the world. the point of good security architecture is exactly that such thing can't happen. Security by compliance isn't good security.
- hellbanTHIS 11y agoOn the bright side if they dump the source code we may finally get a public API
- 21echoes 11y agoWe have a public API in development. ping david at patreon dot com for more info if you'd like.
- throwaypatreon 11y agoThis could be quite a scary prospect. There are certain anonymous and controversial artists who have solicited and received donations through Patreon. Some of these artists remain anonymous because of the controversial nature of their work. I think this is a scary prospect for both patrons and artists.