8 ms·

When some medical contractor misconfigures an AWS bucket and exposes 15,000 medical records we all lose our minds. It doesn't matter if the first bloke to find

When some medical contractor misconfigures an AWS bucket and exposes 15,000 medical records we all lose our minds. It doesn't matter if the first bloke to find it was the researcher who disclosed it... We still go nuts. We make fun of the companies who come back and say "There was no evidence that the data was accessed by unauthorized parties." We know full well there's no evidence that the data WASN'T accessed by unauthorized parties. Please stop pretending this isn't a big deal just because of a hard-on for Google. If you'll put a 10 man company out of business for their complacency and ignorance you should be lining up at Google HQ with pitchforks over this. They're supposed to be above this. They are hailed as a gold standard.

rwestergren 8y ago
I think there is a difference between a vulnerability in an internal system, and blatantly exposing data to the public requiring little technical acumen to obtain.
- ArchTypical 8y ago
  It wasn't an internal system. It was discovered within Google (internal as it was used originally). The wording is accidentally confusing.
quaunaut 8y ago
So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? Also, I fundamentally disagree with your example. If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party, and then fixed it- I'd say, "Good job checking up on yourselves" and move on. Security is still incredibly hard to get right. I'm willing to bet your service has security holes in it, right now- and that's not a hit against you. We haven't mastered these systems and anyone who thinks they have is just waiting to get bit in the ass. Every security professional knows: It's never, ever, a question of "if", but of "when".
- zelon88 8y ago
  > So what do you say about the idea that it creates a disincentive to find security issues... If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. > If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party They found no evidence of data being accessed, but they also don't share how this particular system tracks data that is accessed. This system was vulnerable for 2-3 years. What if you left your car at my house and you found a dent on it, but I claim that I didn't have any security footage of someone damaging your car without mentioning that I don't actually have security cameras. > I'm willing to bet your service has security holes in it... You're right, and it I find that my NTP service is exploitable and anyone can DDOS me I'll fix it and move on. There's no need to disclose that I'm an idiot when it doesn't affect other people. But when I accidentally leave my servers mis-configured and my API unprotected against unauthorized access I would make a post about it. We're not talking about an arbitrary vulnerability that lets people echo hello on a Google server. They left data exposed. I would like to know if it involves me.
  - hn_throwaway_99 8y ago
    > If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. I don't see any evidence to back up this assertion. FWIW I don't believe this is true.
    - deleted 8y ago
      [deleted]
    - ConceptJunkie 8y ago
      Agreed. When is the last time a company failed because of bad security?
  - bobdole123456 8y ago
    Equifax seems to be doing alright. Sony hasn’t failed yet. I don’t think your opinion matches with reality.
sbuk 8y ago
>...you should be lining up at Google HQ with pitchforks over this. They're supposed to be above this. They are hailed as a gold standard. Especially given the way Google, quite rightly, expose vulnerabilities through Project Zero.
reificator 8y ago
If you're going to be harangued for all vulnerabilities, exploited or not, then why proactively try to prevent breaches at all?
- falcolas 8y ago
  You say that as if being harangued is the worst thing that could happen to a company. Plus, were this the case, the CSV list would have stunted vulnerability exploration across the board. Have you seen the list of vulnerabilities discovered in curl?
gmjoe 8y ago
You don't need to resort to crude sexual language or imply parent commenter's opinion isn't in good faith, rather than out of some blind corporate allegiance. You're supposed to be above this here on HN.
jsight 8y ago
I thought I was going to agree with you and then it all went sideways. You are right that some people "lose [their] minds" over the AWS scenario. I think the person that you are responding to is making the point that they shouldn't in that case either. It isn't that it is Google that makes the difference, but the extent of the damage.
stephenhuey 8y ago
I'm not nit-picking, but your mention of "gold standard" got me thinking. What is Google the gold standard of? They have the top search product which is built on possibly gold standard software, server and networking technologies, but beyond that, are they considered the top standard in anything else? Maybe privacy and security should be important to their business models over the long term, but I'm not sure there is a unified coherent thought in the company's mind that better privacy and security help them make money with search, which is their chief priority. In other words, they can make heaps and piles of money every day with bad privacy and security, and I don't think they were ever considered a gold standard for either of those.
- kasey_junk 8y ago
  Google is near universally considered one of the gold standards of infrastructure & application security. So besides applications, infrastructure, distributed systems, reliability, money & security what have the Romans ever given us?
  - tptacek 8y ago
    It would be hard to make a case that they're not one of the 3 best defensive security teams in the world, and that very much includes every world government. You could go back and forth about whether they're #1 or #2 or in 2- or 3-way tie.
UncleMeat 8y ago
Do we? "Some user data exposed on AWS due to crappy S3 permissions" happens like forty times a year. People publish papers annually just finding stupid crap like this in mobile apps. Misconfiguration bugs happen in thousands upon thousands of products. Where do we lose our minds?
- Brockenstein 8y ago
  When it makes headline news... typically.
  - UncleMeat 8y ago
    Less than 1% of these make the news. Papers regularly find tens of thousands of examples of this vuln.
- emn13 8y ago
  There is a qualitative difference between an internally discovered vulnerability - presumably by somebody with lots of access, knowledge, and the ability to verify their hypotheses - and an externally discovered vulnerability. Furthermore, if every potential vulnerability that might have been exploited needs to be reported as a breach... then each and every bug in any library and other dependency you use likely needs a breach report too - after all, you typically cannot verify retrospectively whether that exploit wasn't independently discovered and abused before the fix. I'm not even positive such a reporting requirement would really be a bad idea, but it would definitely needs some more mature reporting and population education to tell the two classes of issue apart, especially since it's pretty vague where you draw the line on what needs publication once you get that far.
sctb 8y ago
> Please stop pretending this isn't a big deal just because of a hard-on for Google. Please don't project strawmen onto other users, it's intellectually weak and rude besides.
bobdole123456 8y ago
The difference here is that Google found this problem itself, and evaluated with high confidence that it was likely unknown to anyone outside that audit. That means that Google was proactively checking it’s work to make sure it was secure, unlike your example where nobody was likely ever going to notice that bucket was misconfigured. They’re the gold standard because they find and clean up their own shit, even when nobody is pressing them to do it.
ugh123 8y ago
>We know full well there's no evidence that the data WASN'T accessed by unauthorized parties. Really? If Google has access logging on its content, and as in your example an AWS bucket can be configured for access logging then it would be fairly straightforward to identify if the data was accessed.
- emn13 8y ago
  Google does not have (or claims not to have) that kind of logging beyond the short term; not enough to cover even a small fraction of the vulnerability period.
gideon_b 8y ago
Comparing this to the Cambridge Analytica breach or a HIPPA violation is disingenuous. This is the information that was possibly was exposed: https://developers.google.com/+/web/api/rest/latest/people https://developers.google.com/+/web/api/rest/latest/people

rwestergren 8y ago

I think there is a difference between a vulnerability in an internal system, and blatantly exposing data to the public requiring little technical acumen to obtain.

ArchTypical 8y ago
It wasn't an internal system. It was discovered within Google (internal as it was used originally). The wording is accidentally confusing.

quaunaut 8y ago

So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? Also, I fundamentally disagree with your example. If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party, and then fixed it- I'd say, "Good job checking up on yourselves" and move on. Security is still incredibly hard to get right. I'm willing to bet your service has security holes in it, right now- and that's not a hit against you. We haven't mastered these systems and anyone who thinks they have is just waiting to get bit in the ass. Every security professional knows: It's never, ever, a question of "if", but of "when".

zelon88 8y ago
> So what do you say about the idea that it creates a disincentive to find security issues... If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. > If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party They found no evidence of data being accessed, but they also don't share how this particular system tracks data that is accessed. This system was vulnerable for 2-3 years. What if you left your car at my house and you found a dent on it, but I claim that I didn't have any security footage of someone damaging your car without mentioning that I don't actually have security cameras. > I'm willing to bet your service has security holes in it... You're right, and it I find that my NTP service is exploitable and anyone can DDOS me I'll fix it and move on. There's no need to disclose that I'm an idiot when it doesn't affect other people. But when I accidentally leave my servers mis-configured and my API unprotected against unauthorized access I would make a post about it. We're not talking about an arbitrary vulnerability that lets people echo hello on a Google server. They left data exposed. I would like to know if it involves me.
- hn_throwaway_99 8y ago
  > If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. I don't see any evidence to back up this assertion. FWIW I don't believe this is true.
  - deleted 8y ago
    [deleted]
  - ConceptJunkie 8y ago
    Agreed. When is the last time a company failed because of bad security?
- bobdole123456 8y ago
  Equifax seems to be doing alright. Sony hasn’t failed yet. I don’t think your opinion matches with reality.

sbuk 8y ago

>...you should be lining up at Google HQ with pitchforks over this. They're supposed to be above this. They are hailed as a gold standard. Especially given the way Google, quite rightly, expose vulnerabilities through Project Zero.

reificator 8y ago

If you're going to be harangued for all vulnerabilities, exploited or not, then why proactively try to prevent breaches at all?

falcolas 8y ago
You say that as if being harangued is the worst thing that could happen to a company. Plus, were this the case, the CSV list would have stunted vulnerability exploration across the board. Have you seen the list of vulnerabilities discovered in curl?

gmjoe 8y ago

You don't need to resort to crude sexual language or imply parent commenter's opinion isn't in good faith, rather than out of some blind corporate allegiance. You're supposed to be above this here on HN.

jsight 8y ago

I thought I was going to agree with you and then it all went sideways. You are right that some people "lose [their] minds" over the AWS scenario. I think the person that you are responding to is making the point that they shouldn't in that case either. It isn't that it is Google that makes the difference, but the extent of the damage.

stephenhuey 8y ago

I'm not nit-picking, but your mention of "gold standard" got me thinking. What is Google the gold standard of? They have the top search product which is built on possibly gold standard software, server and networking technologies, but beyond that, are they considered the top standard in anything else? Maybe privacy and security should be important to their business models over the long term, but I'm not sure there is a unified coherent thought in the company's mind that better privacy and security help them make money with search, which is their chief priority. In other words, they can make heaps and piles of money every day with bad privacy and security, and I don't think they were ever considered a gold standard for either of those.

kasey_junk 8y ago
Google is near universally considered one of the gold standards of infrastructure & application security. So besides applications, infrastructure, distributed systems, reliability, money & security what have the Romans ever given us?
- tptacek 8y ago
  It would be hard to make a case that they're not one of the 3 best defensive security teams in the world, and that very much includes every world government. You could go back and forth about whether they're #1 or #2 or in 2- or 3-way tie.

UncleMeat 8y ago

Do we? "Some user data exposed on AWS due to crappy S3 permissions" happens like forty times a year. People publish papers annually just finding stupid crap like this in mobile apps. Misconfiguration bugs happen in thousands upon thousands of products. Where do we lose our minds?

Brockenstein 8y ago
When it makes headline news... typically.
- UncleMeat 8y ago
  Less than 1% of these make the news. Papers regularly find tens of thousands of examples of this vuln.
emn13 8y ago
There is a qualitative difference between an internally discovered vulnerability - presumably by somebody with lots of access, knowledge, and the ability to verify their hypotheses - and an externally discovered vulnerability. Furthermore, if every potential vulnerability that might have been exploited needs to be reported as a breach... then each and every bug in any library and other dependency you use likely needs a breach report too - after all, you typically cannot verify retrospectively whether that exploit wasn't independently discovered and abused before the fix. I'm not even positive such a reporting requirement would really be a bad idea, but it would definitely needs some more mature reporting and population education to tell the two classes of issue apart, especially since it's pretty vague where you draw the line on what needs publication once you get that far.

sctb 8y ago

> Please stop pretending this isn't a big deal just because of a hard-on for Google. Please don't project strawmen onto other users, it's intellectually weak and rude besides.

bobdole123456 8y ago

The difference here is that Google found this problem itself, and evaluated with high confidence that it was likely unknown to anyone outside that audit. That means that Google was proactively checking it’s work to make sure it was secure, unlike your example where nobody was likely ever going to notice that bucket was misconfigured. They’re the gold standard because they find and clean up their own shit, even when nobody is pressing them to do it.

ugh123 8y ago

>We know full well there's no evidence that the data WASN'T accessed by unauthorized parties. Really? If Google has access logging on its content, and as in your example an AWS bucket can be configured for access logging then it would be fairly straightforward to identify if the data was accessed.

emn13 8y ago
Google does not have (or claims not to have) that kind of logging beyond the short term; not enough to cover even a small fraction of the vulnerability period.

gideon_b 8y ago

Comparing this to the Cambridge Analytica breach or a HIPPA violation is disingenuous. This is the information that was possibly was exposed: https://developers.google.com/+/web/api/rest/latest/people https://developers.google.com/+/web/api/rest/latest/people