3 ms·

It doesn't sound like Dell has been very effective here: likely attackers downloaded the database raw or it's one of their many contractors who log in remotely.

by geocar 11y ago

It doesn't sound like Dell has been very effective here: likely attackers downloaded the database raw or it's one of their many contractors who log in remotely. Last time I saw that interface it was a web form that someone could access from any machine! This is serious. If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a zero-tolerance policy. This isn't trivial to set up, but it's necessary; The CTO is responsible here, not some "website hackers".

rms_returns 11y ago
Second this. In fact, I would rather argue that its better to stop forcing online registration of computers until the privacy of those who register is guaranteed. Its not as if registration is even needed, they already have a tag attached to each device, so they can track sales using that. On the other hand, this problem is not specific to only Dell. Take the online web-forms of any other major Tech seller like Asus, Samsung, Motorola or HTC and their website sucks. Almost every one of them looks poorly designed and unprofessional which is more worrying.
- geocar 11y ago
  It's not just tracking sales though, it's CRM, so every time they speak to someone about replacement/warrantee they need to know who they spoke to and audit frequent complaints either as abuse or something systemic that needs to be chased with a supplier. I know why Dell needs to do this, but the C-suite is responsible for dieselgate and this kind of thing needs to be developed smartly, with taste, and with a consideration about what can fail (and how bad it can get). Bread and butter: Encrypt everything, long audit trail; Sysadmins don't need to read the databases (and can log need for keys), engineering doesn't need to read personal data, helpdesk don't need to log into servers, and no service needs unauthenticated and unlogged read (even internally; e.g. for automated reporting); Get audited by someone competent. I handled 1bn daily records with 100% uptime, and max 6hr delay reporting using a single server, so there is no excuse except an incompetent CTO.
dogma1138 11y ago
>If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a zero-tolerance policy. In an ideal world yes, but sadly here on planet reality I would be surprised if Dell even knows where all of its "customer data" is regardless of what certifications they are in compliance with. They share that data with 100's of 3rd parties from outsourcing some of their own support services to some 5 man consultancy form Singapore that the CFO heard about on his last flight that sells them advanced analytics. While it's true that today customer data isn't shared that easily (at least in newer organizations that care about this) with an organization as old as Dell they might have data sharing relationships going past 2-3 decades that trump that and that sadly many people even C level at Dell might not be aware off. Not to mention that under the various 3rd party clauses many organizations pretty much use customer data as a commodity delegating it's distribution to various low level sale's execs that would send it to who ever would take it as long as they can get more accurate predictions for the next quarter to hit their targets.
Sven7 11y ago
Then Mark Zuckerberg and Larry Page are responsible for a lot of things... But as long as they come and cry on stage about how we should trust them and help them make the world more "open and connected" I guess it makes it okay. If the NSA, Sony and the Director of the CIA can't protect their data, how am I supposed to realistically ensure less educated\tech savvy family members, customers, employees protect theirs? Even if everything leaks, and there is a story everyday of the week for anyone paying attention, things have become too big to fail. It's like the Steve Carell character says at the end of the 'Big Short' - "There's going to be a bailout. They knew the taxpayers would bail them out. They just didn't care. And in a few years we'll go back to what we were always doing...blame the immigrants and poor people"
- geocar 11y ago
  I think this attitude is a big part of the problem: Bugs aren't inevitable, not everything leaks, software doesn't have to be slow and bloating, and how were we supposed to know shouldn't be a defence. I'm not happy about the status quo, and I'm becoming increasingly convinced that combining criticism and humility is the only way out.
madaxe_again 11y ago
The CTO is responsible here, not some "website hackers". If only that bore up in reality - you need only look at any number of recent high profile breaches (TalkTalk, for instance), to see that the "hacked" (incompetent) party gets sympathy, the exploiter gets prison time. As to how this is happening - quite likely exactly as you say. They have extreme staff churn in their Indian operations, and all it takes is a few dishonest individuals to make this sort of thing become widespread. I've even had Dell sales reps contact me from their personal email address trying to get me to scam Dell (buy servers, I get commission, you return, I give you 50% of commission, deal?), so this is as unsurprising as it gets.
- geocar 11y ago
  Wow that's terrifying. I think it's systemic, and we need to be very clear what we want a company (like Dell) to do in this situation. Programmers are not usually held accountable for their own bugs, and I think that needs to change too. I don't recommend prison time, but maybe just some humility? Bankers do the same thing: Past performance is not a guarantee of future results, and I get they're just doing their best, so why don't they put their own money in the same pot? Heck, we expect the cafe to refund our coffee if they mix it up wrong, so why can't we just push that message upwards?
  - kruczek 11y ago
    > Programmers are not usually held accountable for their own bugs, and I think that needs to change too. I disagree. Bugs are created and will be created; it is up to the proper process to test the system and get rid of them. A bug that goes into production code is a collective failure. Why do you blame the programmer, but won't blame the tester, or the guy who designed the test, or the guy who designed whole workflow, or the architect who planned the system?
    - geocar 11y ago
      > Why do you blame the programmer, but won't blame the tester, or the guy who designed the test, or the guy who designed whole workflow, or the architect who planned the system? Where did you get the idea that I don't? I think people make mistakes sometimes (myself included), but I don't somehow think that diminishes the mistake. I also think the programmer has less responsibility than the architect, or the CTO (which is why we pay them more). I don't like that shit only runs downhill.

by geocar 11y ago

rms_returns 11y ago

Second this. In fact, I would rather argue that its better to stop forcing online registration of computers until the privacy of those who register is guaranteed. Its not as if registration is even needed, they already have a tag attached to each device, so they can track sales using that. On the other hand, this problem is not specific to only Dell. Take the online web-forms of any other major Tech seller like Asus, Samsung, Motorola or HTC and their website sucks. Almost every one of them looks poorly designed and unprofessional which is more worrying.

geocar 11y ago
It's not just tracking sales though, it's CRM, so every time they speak to someone about replacement/warrantee they need to know who they spoke to and audit frequent complaints either as abuse or something systemic that needs to be chased with a supplier. I know why Dell needs to do this, but the C-suite is responsible for dieselgate and this kind of thing needs to be developed smartly, with taste, and with a consideration about what can fail (and how bad it can get). Bread and butter: Encrypt everything, long audit trail; Sysadmins don't need to read the databases (and can log need for keys), engineering doesn't need to read personal data, helpdesk don't need to log into servers, and no service needs unauthenticated and unlogged read (even internally; e.g. for automated reporting); Get audited by someone competent. I handled 1bn daily records with 100% uptime, and max 6hr delay reporting using a single server, so there is no excuse except an incompetent CTO.

dogma1138 11y ago

>If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a zero-tolerance policy. In an ideal world yes, but sadly here on planet reality I would be surprised if Dell even knows where all of its "customer data" is regardless of what certifications they are in compliance with. They share that data with 100's of 3rd parties from outsourcing some of their own support services to some 5 man consultancy form Singapore that the CFO heard about on his last flight that sells them advanced analytics. While it's true that today customer data isn't shared that easily (at least in newer organizations that care about this) with an organization as old as Dell they might have data sharing relationships going past 2-3 decades that trump that and that sadly many people even C level at Dell might not be aware off. Not to mention that under the various 3rd party clauses many organizations pretty much use customer data as a commodity delegating it's distribution to various low level sale's execs that would send it to who ever would take it as long as they can get more accurate predictions for the next quarter to hit their targets.

Sven7 11y ago

Then Mark Zuckerberg and Larry Page are responsible for a lot of things... But as long as they come and cry on stage about how we should trust them and help them make the world more "open and connected" I guess it makes it okay. If the NSA, Sony and the Director of the CIA can't protect their data, how am I supposed to realistically ensure less educated\tech savvy family members, customers, employees protect theirs? Even if everything leaks, and there is a story everyday of the week for anyone paying attention, things have become too big to fail. It's like the Steve Carell character says at the end of the 'Big Short' - "There's going to be a bailout. They knew the taxpayers would bail them out. They just didn't care. And in a few years we'll go back to what we were always doing...blame the immigrants and poor people"

geocar 11y ago
I think this attitude is a big part of the problem: Bugs aren't inevitable, not everything leaks, software doesn't have to be slow and bloating, and how were we supposed to know shouldn't be a defence. I'm not happy about the status quo, and I'm becoming increasingly convinced that combining criticism and humility is the only way out.

madaxe_again 11y ago

The CTO is responsible here, not some "website hackers". If only that bore up in reality - you need only look at any number of recent high profile breaches (TalkTalk, for instance), to see that the "hacked" (incompetent) party gets sympathy, the exploiter gets prison time. As to how this is happening - quite likely exactly as you say. They have extreme staff churn in their Indian operations, and all it takes is a few dishonest individuals to make this sort of thing become widespread. I've even had Dell sales reps contact me from their personal email address trying to get me to scam Dell (buy servers, I get commission, you return, I give you 50% of commission, deal?), so this is as unsurprising as it gets.

geocar 11y ago
Wow that's terrifying. I think it's systemic, and we need to be very clear what we want a company (like Dell) to do in this situation. Programmers are not usually held accountable for their own bugs, and I think that needs to change too. I don't recommend prison time, but maybe just some humility? Bankers do the same thing: Past performance is not a guarantee of future results, and I get they're just doing their best, so why don't they put their own money in the same pot? Heck, we expect the cafe to refund our coffee if they mix it up wrong, so why can't we just push that message upwards?
- kruczek 11y ago
  > Programmers are not usually held accountable for their own bugs, and I think that needs to change too. I disagree. Bugs are created and will be created; it is up to the proper process to test the system and get rid of them. A bug that goes into production code is a collective failure. Why do you blame the programmer, but won't blame the tester, or the guy who designed the test, or the guy who designed whole workflow, or the architect who planned the system?
  - geocar 11y ago
    > Why do you blame the programmer, but won't blame the tester, or the guy who designed the test, or the guy who designed whole workflow, or the architect who planned the system? Where did you get the idea that I don't? I think people make mistakes sometimes (myself included), but I don't somehow think that diminishes the mistake. I also think the programmer has less responsibility than the architect, or the CTO (which is why we pay them more). I don't like that shit only runs downhill.