6 ms·
Attunity Data Leak: Vendor for half the Fortune 100 exposed terabyte of backups
- decasia 7y agoI mean, it's the usual story with these things — "accidentally stored internal data — including other companies' security sensitive data — in a public file share" (or in this case, S3). Not much to learn from the story that we don't already know about IT security. Bottom line, it's bad to trust vendors that are not trustworthy, and this can expose other kinds of lazy/bad practices in your organization. For a company that had thousands of clients, I didn't think 1TB was an especially large amount of data, all things considered.
- Skunkleton 7y agoThe article actually says that only ~1 TB was downloaded by the researcher. The real size is unknown.
- OrgNet 7y ago> or in this case, S3 S3 is very common when it comes to leaks for some reason
- deleted 7y ago[deleted]
- zwily 7y agoI’d say one big reason would be because so many people use it.
- slenk 7y agoAnd it used to be VERY easy to make them public. Amazon has recently been showing a lot more warnings if you try it now.
- eli 7y agoDespite recent improvements, it's still pretty easy to accidentally make a bucket public that you meant to keep private.
- je42 7y agoYep. As a bigger org you want automatic compliance checks that verify that all buckets are not publically accessible.
- mwarkentin 7y agoThey have explicit public access blocks at both the bucket and account level now. These override any permissions granted via IAM or bucket policy.
- je42 7y agoThat's why you still want explicit automatic audits.
- continuational 7y agoAWS has a very complicated configuration format for permissions. In security, complicated = insecure.
- late2part 7y agoStimson's quote doesn't seem appropriate here... "The only way to make a man trustworthy is to trust him; and the surest way to make him untrustworthy is to distrust him and show your distrust."
- golem14 7y agoThere’s trust and there’s trust. I might trust Tom Bombadil not to murder me in my sleep. I might not trust him as a keeper of the one ring …
- techslave 7y agoa terabyte? cue dr evil: one million dollars. what’s that, one email signature?
- techslave 7y agothe real story is, if these were sensitive why wasn’t the data encrypted?
- johnnywalker817 7y agonot to mention attunity is the preferred vendor for data integration by microsoft and amazon...so its not just non-tech fortune 100 companies that use them.
- shiftoutbox 7y agoJust migrate to Tarsnap.com no prying eyes ever . Even if the same thing were to happen the s3 data is useless to anyone else in the world .
- harry8 7y agoHow much business will they lose? This is a measure of market efficiency. In an efficient market they would lose absolutely all of it. Bet you they lose almost none of it. Manipulating old idiots on boards of directors is much more important than quality, which is what the word "enterprise" means. Enterprise IT (noun): Awful quality product that would get zero traction without a massive con of ignorant boards and senior management.
- joewee 7y agoIt depends. Almost all corporate to corporate contracts have clauses about data protection and security breaches. This would allow many of their clients to cancel their contracts with cause. Usually that happens if the business wasn’t getting a lot of value from the service as of late, or the value they were getting doesn’t outweigh the liability. It’s hard for boards to ignore major breaches if you’re a public company and its hard to win business if you’re known to be lax with security.
- jacques_chester 7y agoIf you know a way to reduce the cost of moving data to zero, could you share it with the class?
- harry8 7y agoFlip it around. How high does that cost have to be before it stops being excellent value in this case? Why would you assume zero is the only cost that makes sense here, that's insane! edit: On reflection I think you've got a meaning from what I said that isn't quite right. The cost of moving is one of the things that might make this market inefficient. Anything that is a barrier to entry, a barrier to switching provider contributes to market inefficiency. It's an economic term worth knowing as people bandy it about here a bit. Barriers to entry, imperfect information, market power of suppliers (here), nonzero selling costs, nonzero switching costs all contribute. The question in most markets is to what extent do they contribute? How inefficient is it? Here paying money for gross incompetence when you found that out you'd be pretty determined to dump the supplier because you've been conned, and conned badly. Now you are aware of being exposed to a large risk, ever increasing legally once you do nothing when you clearly know the risk exists. So it's a good measure of how efficient this market is because nobody of any competence or sanity wants to stay with this supplier anymore.
- jbverschoor 7y agoYou don’t just guess the full oath of such a file. Sounds like a data breach, either on the server or in the ops code / config. When will data ownership be a thing? No need for ANY company to store my data if I can have it one my phone, which is on 24/7 and connected.
- slenk 7y agoIs it responsible for Upguard to have waited two days to try and contact Attunity? *edit - I'm not trying to be smarmy - its a genuine question
- tastroder 7y agoYou have to verify and internally coordinate a disclosure of this size. The article also mentions that they were unclear about a point of contact due to a recent merger and that they are in a different time zone. Two days sounds completely reasonable for all of that.
- deleted 7y ago[deleted]
- triplee 7y agoThis one is a double whammy not only because there's not only data on those companies, but it can be extrapolated that many of those companies are relatively new to the cloud (and possibly which cloud service is available as well), making them also ripe for targeting. One of Attunity's bigger sales deals is making their data migration tools free for a long period to help organizations migrate to cloud. This is essentially a list of "Hey, these other orgs might also be open to hacking as they haven't learned yet."