5 ms·

Breach affecting 1M was caught only after hacker maxed out target’s storage

102 points by heshiebee 7y ago

fgnkj 7y ago
Reminds me of something similar that happened to me once a long time ago. I hacked into a server. I wanted to take a copy of everything so I made a tar of / to wget it to computer later. Only that the disk was at >50% usage so I filled it by making the tar file. Everything stopped to work with 0 bytes left of disk space (I wasn't root) so I kinda bricked the machine. I had to walk away in shame.
- beauzero 7y ago
  Don't feel bad. 1995. SunOS. Very patient boss. I did the same thing.
  - mirimir 7y ago
    When I was learning Microsoft Access, many years ago, I didn't really understand joins. So I did a cross join with no where condition. And the machine (Windows XP) just sat there, and eventually locked up. So I rebooted, and tried it again. Same result. Eventually I figured it out.
- jacquesm 7y ago
  > I had to walk away in shame. No, you'd have walked away in shame if you had walked away in handcuffs. Don't do stupid stuff. Imnsho you got lucky that disk filled up before you could notch up a(nother?) crime.
  - fgnkj 7y ago
    What happened is arguably more stupid: by filling up the disk, 1) they definitely noticed, 2) I couldn't get what I wanted, and 3) I couldn't clean up the logs after it. Thankfully I had covered up my steps (or, more probably, the sysadmin was ashamed to see he had been hacked and chose to fix it and say nothing).
    - jacquesm 7y ago
      I hope you learned and not just to use 'df' more often.
- newnewpdro 7y ago
  It's unlikely you bricked the machine by filling the disk as a regular user. E.g. Ext2 by default reserves 5% for super-user processes. Do something more useful with your time and skills.
kjaftaedi 7y ago
plaintext passwords in 2019 .. it hurts to read articles like these.
- mattferderer 7y ago
  These are often found in log files when people get a bit to log happy. I've seen many smart developers accidentally log a request in an API that also happens to show the login credentials.
  - jacquesm 7y ago
    Even Google fell for that one recently.
    - NullPrefix 7y ago
      Didn't Facebook fell for it too?
      - EGreg 7y ago
        No. Never.
        NullPrefix 7y ago
        Could "Never" be defined as a time frame from year 2012 to at least 2019 ? https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t... https://arstechnica.com/information-technology/2019/03/facebook-developers-wrote-apps-that-stored-users-passwords-in-plaintext/ https://arstechnica.com/information-technology/2019/03/faceb... https://www.wired.com/story/facebook-passwords-plaintext-change-yours/ https://www.wired.com/story/facebook-passwords-plaintext-cha...
  - service_bus 7y ago
hn_throwaway_99 7y ago
Given the fair assumption that any piece of data you give to a third party system that has access to the internet will eventually be breached, I feel like we need an entirely new system for data sharing. The problem with most of these hacks isn't usually so much that the hacked system itself has lots of valuable data, but that the data from the hacked system can be used to hack into other systems that do have valuable data. Just like we tell people to only use a different password per-site, we need the option to essentially give only tokenized versions of our data to third parties. We've started somewhat with tokenization in place of credit card numbers, but we should be able to do this in many more areas. There are obvious difficulties here regarding how we'd handle certain fields (e.g. how do I calculate your shipping if I don't know your exact zip code), but these should still be solvable problems. The alternative of believing that every rinky dink (or non-rinky dink) site out there will be able to keep your data secure is laughable.
- deleted 7y ago
  [deleted]
- manifestsilence 7y ago
  Absolutely! The same way we say you have to hash and salt passwords so they're not useful for cross-site breaches, it's even more important for any other piece of information that is used to verify identity. Especially since these other pieces of info aren't easily changed and can't be different on different sites. Or, facts about a person shouldn't be considered secret for the purpose of authentication, but that's hard when people have trouble with being asked to keep track of any new secret pieces of information they are given.
- deleted 7y ago
  [deleted]
- pavel_lishin 7y ago
  > There are obvious difficulties here regarding how we'd handle certain fields (e.g. how do I calculate your shipping if I don't know your exact zip code) Forget calculating shipping; how do you ship me my product at all without me giving you my address? (A quick napkin sketch would be that I wouldn't, I'd give you a USPS reference number, which you could use to calculate shipping costs as well as actually mail me a thing; only the USPS would be able to link the reference number to my physical location. There's almost certainly problems with this idea, which is why it's a napkin sketch.)
ptah 7y ago
>full payment card numbers storing these in plain text violates PCI-DSS
- garden3r 7y ago
  The article doesn't say that they were stored in plaintext. Still a PCI violation though!
  - donarb 7y ago
    From the FTC complaint: "... stored consumers’ personal information, including consumers’ SSNs, payment card information (including full or partial credit card and debit card numbers, CVVs, and expiration dates), bank account information (including account and routing numbers), and authentication credentials such as user IDs and passwords, in clear, readable text on InfoTrax’s network."
- strbean 7y ago
  And CVVs. Storing CVVs in any form breaks PCI.
social_quotient 7y ago
Does the title bother anyone else? 1M what? People, records, a subsidiary of 3M.
- jjtheblunt 7y ago
  "subsidiary of 3M" : made me laugh quietly.
- yellowapple 7y ago
  "Customers" seems like a solid guess.
erulabs 7y ago
I’ve got a long running bet this is how AGI will be discovered as well. A full disk alert will lead a tired sysadmin to ssh into an old R&D GPU system and be greeted with “Hello, Dave”

102 points by heshiebee 7y ago

Reminds me of something similar that happened to me once a long time ago. I hacked into a server. I wanted to take a copy of everything so I made a tar of / to wget it to computer later. Only that the disk was at >50% usage so I filled it by making the tar file. Everything stopped to work with 0 bytes left of disk space (I wasn't root) so I kinda bricked the machine. I had to walk away in shame.

beauzero 7y ago
Don't feel bad. 1995. SunOS. Very patient boss. I did the same thing.
- mirimir 7y ago
  When I was learning Microsoft Access, many years ago, I didn't really understand joins. So I did a cross join with no where condition. And the machine (Windows XP) just sat there, and eventually locked up. So I rebooted, and tried it again. Same result. Eventually I figured it out.
jacquesm 7y ago
> I had to walk away in shame. No, you'd have walked away in shame if you had walked away in handcuffs. Don't do stupid stuff. Imnsho you got lucky that disk filled up before you could notch up a(nother?) crime.
- fgnkj 7y ago
  What happened is arguably more stupid: by filling up the disk, 1) they definitely noticed, 2) I couldn't get what I wanted, and 3) I couldn't clean up the logs after it. Thankfully I had covered up my steps (or, more probably, the sysadmin was ashamed to see he had been hacked and chose to fix it and say nothing).
  - jacquesm 7y ago
    I hope you learned and not just to use 'df' more often.
newnewpdro 7y ago
It's unlikely you bricked the machine by filling the disk as a regular user. E.g. Ext2 by default reserves 5% for super-user processes. Do something more useful with your time and skills.

kjaftaedi 7y ago

plaintext passwords in 2019 .. it hurts to read articles like these.

mattferderer 7y ago
These are often found in log files when people get a bit to log happy. I've seen many smart developers accidentally log a request in an API that also happens to show the login credentials.
- jacquesm 7y ago
  Even Google fell for that one recently.
  - NullPrefix 7y ago
    Didn't Facebook fell for it too?
    - EGreg 7y ago
      No. Never.
      - NullPrefix 7y ago
        Could "Never" be defined as a time frame from year 2012 to at least 2019 ? https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t... https://arstechnica.com/information-technology/2019/03/facebook-developers-wrote-apps-that-stored-users-passwords-in-plaintext/ https://arstechnica.com/information-technology/2019/03/faceb... https://www.wired.com/story/facebook-passwords-plaintext-change-yours/ https://www.wired.com/story/facebook-passwords-plaintext-cha...
- service_bus 7y ago

hn_throwaway_99 7y ago

Given the fair assumption that any piece of data you give to a third party system that has access to the internet will eventually be breached, I feel like we need an entirely new system for data sharing. The problem with most of these hacks isn't usually so much that the hacked system itself has lots of valuable data, but that the data from the hacked system can be used to hack into other systems that do have valuable data. Just like we tell people to only use a different password per-site, we need the option to essentially give only tokenized versions of our data to third parties. We've started somewhat with tokenization in place of credit card numbers, but we should be able to do this in many more areas. There are obvious difficulties here regarding how we'd handle certain fields (e.g. how do I calculate your shipping if I don't know your exact zip code), but these should still be solvable problems. The alternative of believing that every rinky dink (or non-rinky dink) site out there will be able to keep your data secure is laughable.

deleted 7y ago
[deleted]
manifestsilence 7y ago
Absolutely! The same way we say you have to hash and salt passwords so they're not useful for cross-site breaches, it's even more important for any other piece of information that is used to verify identity. Especially since these other pieces of info aren't easily changed and can't be different on different sites. Or, facts about a person shouldn't be considered secret for the purpose of authentication, but that's hard when people have trouble with being asked to keep track of any new secret pieces of information they are given.
deleted 7y ago
[deleted]
pavel_lishin 7y ago
> There are obvious difficulties here regarding how we'd handle certain fields (e.g. how do I calculate your shipping if I don't know your exact zip code) Forget calculating shipping; how do you ship me my product at all without me giving you my address? (A quick napkin sketch would be that I wouldn't, I'd give you a USPS reference number, which you could use to calculate shipping costs as well as actually mail me a thing; only the USPS would be able to link the reference number to my physical location. There's almost certainly problems with this idea, which is why it's a napkin sketch.)

ptah 7y ago

>full payment card numbers storing these in plain text violates PCI-DSS

garden3r 7y ago
The article doesn't say that they were stored in plaintext. Still a PCI violation though!
- donarb 7y ago
  From the FTC complaint: "... stored consumers’ personal information, including consumers’ SSNs, payment card information (including full or partial credit card and debit card numbers, CVVs, and expiration dates), bank account information (including account and routing numbers), and authentication credentials such as user IDs and passwords, in clear, readable text on InfoTrax’s network."
strbean 7y ago
And CVVs. Storing CVVs in any form breaks PCI.

social_quotient 7y ago

Does the title bother anyone else? 1M what? People, records, a subsidiary of 3M.

jjtheblunt 7y ago
"subsidiary of 3M" : made me laugh quietly.
yellowapple 7y ago
"Customers" seems like a solid guess.

erulabs 7y ago

I’ve got a long running bet this is how AGI will be discovered as well. A full disk alert will lead a tired sysadmin to ssh into an old R&D GPU system and be greeted with “Hello, Dave”