5 ms·

From the article: "Security is Clearview's top priority," he said in a statement provided to The Daily Beast. "Unfortunately, data breaches are part of life in

From the article: "Security is Clearview's top priority," he said in a statement provided to The Daily Beast. "Unfortunately, data breaches are part of life in the 21st century. Our servers were never accessed. We patched the flaw, and continue to work to strengthen our security." Servers never accessed? Then how was the client list stolen? Was a paper copy stolen from a filing cabinet? I find this posture somewhat arrogant and dismissive. Also, the article is light on technical details- does anyone have info on what flaw was exploited and patched?

rapsca11i0n 7y ago
I agree -- the language is just so vague, but getting the client list and not accessing the server seems to be either obfuscation or a cloud service was also hacked.
jjoonathan 7y ago
Could the "intruder" have been Joe from sales who came back the night he was laid off using his secondary keycard, which IT hadn't quite gotten around to deactivating yet, and grabbed his old rolodex?
- spacec0wb0y 7y ago
  And how was Joe "patched"
  - reaperducer 7y ago
    With extreme prejudice.
    - rezgi 7y ago
      The only way to patch.
  - raxxorrax 7y ago
    They probably updated his face.
- at-fates-hands 7y ago
  I've been at several places where this happened. I was at a large web dev company where an employee put in his two week notice, then was able to access several of the companies servers and exfiltrate nearly every app or web site they had built in the last two years. Rumor had it he was using the code to start a dev company on his own and this was the "seed" code that would help him get up and running much faster. AFAIK nothing ever happened to him legally.
  - hermitdev 7y ago
    I worked for a hedge fund where a quant dev emailed to his gmail a copy of the source for the quant models. He was sued in federal court 4 hours before he was terminated. Criminal charges came around 2-3 months later, IIRC. Once he realized he was fucked, he tried dumping his hard drives in a river. Yes, police diving squad was involved. Dumbass didn't realize that all SSL traffic was being MITM'd. I never sent any sensitive over personal email from work, being well aware of the practices (also helps to have friends in compliance).
    - htrp 7y ago
      It's always the dumb ones that get caught?
    - Nuzzerino 7y ago
      Doesn't the browser display a warning in the case of SSL MITM?
      - cdumler 7y ago
        Not if the browser has been specifically given the cert. It is typical on corporate networks send all HTTP traffic to a router that acts on behalf of the outside world. If your browser (and browsers these days relying on OS installed certs) has a cert validating the router, it will be legitimate: you have a valid cert for the router you're talking to. The trick is to use a piece of software that doesn't use your system's certs but has it's own built in, like run Linux in a VM and use that browser. That way, you'll see the MitM attack.
- mindslight 7y ago
  Hopefully it's a whistleblower. Shaming specific police departments and causing a local political issue is a good way to prevent its adoption.
giarc 7y ago
I wonder if the key word is "our" servers. I wonder if they had a weak password on some associated account (accounting software or something).
draw_down 7y ago
"data breaches are part of life" is a fun new take. I hadn't seen it before, but now I imagine all such communications will include this sentiment in some form. Man, we really have rolled over on this issue.

rapsca11i0n 7y ago

I agree -- the language is just so vague, but getting the client list and not accessing the server seems to be either obfuscation or a cloud service was also hacked.

jjoonathan 7y ago

Could the "intruder" have been Joe from sales who came back the night he was laid off using his secondary keycard, which IT hadn't quite gotten around to deactivating yet, and grabbed his old rolodex?

spacec0wb0y 7y ago
And how was Joe "patched"
- reaperducer 7y ago
  With extreme prejudice.
  - rezgi 7y ago
    The only way to patch.
- raxxorrax 7y ago
  They probably updated his face.
at-fates-hands 7y ago
I've been at several places where this happened. I was at a large web dev company where an employee put in his two week notice, then was able to access several of the companies servers and exfiltrate nearly every app or web site they had built in the last two years. Rumor had it he was using the code to start a dev company on his own and this was the "seed" code that would help him get up and running much faster. AFAIK nothing ever happened to him legally.
- hermitdev 7y ago
  I worked for a hedge fund where a quant dev emailed to his gmail a copy of the source for the quant models. He was sued in federal court 4 hours before he was terminated. Criminal charges came around 2-3 months later, IIRC. Once he realized he was fucked, he tried dumping his hard drives in a river. Yes, police diving squad was involved. Dumbass didn't realize that all SSL traffic was being MITM'd. I never sent any sensitive over personal email from work, being well aware of the practices (also helps to have friends in compliance).
  - htrp 7y ago
    It's always the dumb ones that get caught?
  - Nuzzerino 7y ago
    Doesn't the browser display a warning in the case of SSL MITM?
    - cdumler 7y ago
      Not if the browser has been specifically given the cert. It is typical on corporate networks send all HTTP traffic to a router that acts on behalf of the outside world. If your browser (and browsers these days relying on OS installed certs) has a cert validating the router, it will be legitimate: you have a valid cert for the router you're talking to. The trick is to use a piece of software that doesn't use your system's certs but has it's own built in, like run Linux in a VM and use that browser. That way, you'll see the MitM attack.
mindslight 7y ago
Hopefully it's a whistleblower. Shaming specific police departments and causing a local political issue is a good way to prevent its adoption.

giarc 7y ago

I wonder if the key word is "our" servers. I wonder if they had a weak password on some associated account (accounting software or something).

draw_down 7y ago

"data breaches are part of life" is a fun new take. I hadn't seen it before, but now I imagine all such communications will include this sentiment in some form. Man, we really have rolled over on this issue.