6 ms·

Am I alone in thinking things like online pastebins, base64encoders/decoders, online heap analysers, online json linters, etc are all security issues where the

Am I alone in thinking things like online pastebins, base64encoders/decoders, online heap analysers, online json linters, etc are all security issues where the sites can just harvest tons of data? Uploading a bunch of stack traces to generate a flame map is one thing, but the heap can have secrets and keys and so on in memory.

the_arun 7y ago
+1. Exactly! I too thought about the same.
funcDropShadow 7y ago
No you are not alone. As a consultant, I am usually not allowed to use such online tools with customer data. So they are useless, at least for me.
JensRantil 7y ago
Yeah, I just tweeted about this: https://twitter.com/JensRantil/status/1247431174865203203 https://twitter.com/JensRantil/status/1247431174865203203
dntbnmpls 7y ago
I think so too. Also, the "free" online pdf converters seem like great way to harvest tons of data.
- TeMPOraL 7y ago
  I once browsed around a local Scribdb equivalent and found tons of internal corporate and government-related documents that I'm pretty sure shouldn't be floating around on the public Internet; I bet they got indexed and included there because of some checkbox or TOC line item on a free PDF conversion tool.
Slartie 7y ago
No, I see it exactly the same way. Especially heap analyzers - you are uploading the entire content of your memory up there, including even the entire application (because classes are in the heap as well, and it's trivial to decompile Java classes, especially since even companies which release only obfuscated class files usually don't obfuscate anything while testing on dev machines, where a majority of heap dumps probably originate from). In my eyes, anyone using such a service is as careless as someone posting unencrypted lists of his passwords hidden in Lorem Ipsum texts on Facebook so he can look them up if he forgets one. Any sane corporate data protection rulebook should prohibit the use of such services and consider any potential surreptitious use a harsh breach of trust and thus a cause for termination of the employment.
pjmlp 7y ago
Not at all. I am not alowed to expose customer data to the world as well, regardless how many promises they make on the website regarding how carefully the data is handled.
jmiserez 7y ago
I agree, uploading a heap dump is completely unacceptable. And their privacy policy seems to grant them a license to use your heap dumps (they call them "log files" which is obviously wrong): https://heaphero.io/heap-terms.jsp https://heaphero.io/heap-terms.jsp: >Software applications generate a specialized type of log file. These log files are hard for engineers to interpret and troubleshoot. Using the Site, users can upload log files and we parse, analyze, and generate root cause analysis reports instantly. >By uploading log files or leaving us feedback, you may provide text, images, software, videos and/or other material, including third party content ("User Content") that you share using the Site. >Your User Content belongs to you (or to the relevant third parties). However, you grant the Company the following non-exclusive license: a worldwide, transferable and sub-licensable right to use, copy, modify, distribute, publish, and process, information and your User Content that you provide through the Site, without any further consent, notice and/or compensation to you or others. You also grant us the right to use your log files to enhance the performance of our Services. Not that I would trust even a perfect privacy policy when it comes to uploading heapdumps. There are however some websites that work completely offline (you download the HTML page and there is no network IO), like CyberChef [1] or the Spotify thread dump analyzer [2]. And for heap dumps, just use Eclipse MAT [3]. [1] https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/ (yes, that GCHQ) [2] https://spotify.github.io/threaddump-analyzer/ https://spotify.github.io/threaddump-analyzer/ [3] https://www.eclipse.org/mat/ https://www.eclipse.org/mat/
mrkeen 7y ago
Uploading code/data to AWS too!
thombat 7y ago
On these lines, allow me to introduce a valuable new service: MRLTaaS (Most Recent Leak Time as a Service) Ever wondered when the most recent leak of your most valuable secrets occurred? Simply upload your password file to my web service and within moments the magic of our distributed AI will return the current date/time...
- fnord123 7y ago
  https://haveibeenpwned.com/ https://haveibeenpwned.com/ Doesn't cynically take passwords, but could in theory harvest emails.
- fnord123 7y ago
  I found one that checks your hmac generation: https://www.freeformatter.com/hmac-generator.html https://www.freeformatter.com/hmac-generator.html
jsd1982 7y ago
Obviously bad to upload heap dumps, but they do have an enterprise plan you can pay for to host their software on your own hardware to avoid public upload. Still, even offering the public upload option is a serious concern. They'd be better suited offering a download with free tier limitations.
mumblemumble 7y ago
Just to add to this: Definitely do not use their cloud service to analyze heap dumps out of production. You will probably be leaking sensitive company secrets, and, if your company's data handling policies are at all reasonable, you'll probably also be violating legal obligations to your clients, as well as their trust. Doing it for development may be safer, insofar as it it's more likely to merely be dangerous, but not also tortious or unethical.
- hinkley 7y ago
  How did we end up in a place where everyone believes they have to go SaaS to make any money at all?
Twirrim 7y ago
Amazon used to (and may still) block access from their corporate network to any pastebin they could find, to try to stop engineers from using them to share code. They'd had too much stuff leak out that way, including API keys.

the_arun 7y ago

+1. Exactly! I too thought about the same.

funcDropShadow 7y ago

No you are not alone. As a consultant, I am usually not allowed to use such online tools with customer data. So they are useless, at least for me.

JensRantil 7y ago

Yeah, I just tweeted about this: https://twitter.com/JensRantil/status/1247431174865203203 https://twitter.com/JensRantil/status/1247431174865203203

dntbnmpls 7y ago

I think so too. Also, the "free" online pdf converters seem like great way to harvest tons of data.

TeMPOraL 7y ago
I once browsed around a local Scribdb equivalent and found tons of internal corporate and government-related documents that I'm pretty sure shouldn't be floating around on the public Internet; I bet they got indexed and included there because of some checkbox or TOC line item on a free PDF conversion tool.

Slartie 7y ago

No, I see it exactly the same way. Especially heap analyzers - you are uploading the entire content of your memory up there, including even the entire application (because classes are in the heap as well, and it's trivial to decompile Java classes, especially since even companies which release only obfuscated class files usually don't obfuscate anything while testing on dev machines, where a majority of heap dumps probably originate from). In my eyes, anyone using such a service is as careless as someone posting unencrypted lists of his passwords hidden in Lorem Ipsum texts on Facebook so he can look them up if he forgets one. Any sane corporate data protection rulebook should prohibit the use of such services and consider any potential surreptitious use a harsh breach of trust and thus a cause for termination of the employment.

pjmlp 7y ago

Not at all. I am not alowed to expose customer data to the world as well, regardless how many promises they make on the website regarding how carefully the data is handled.

jmiserez 7y ago

I agree, uploading a heap dump is completely unacceptable. And their privacy policy seems to grant them a license to use your heap dumps (they call them "log files" which is obviously wrong): https://heaphero.io/heap-terms.jsp https://heaphero.io/heap-terms.jsp: >Software applications generate a specialized type of log file. These log files are hard for engineers to interpret and troubleshoot. Using the Site, users can upload log files and we parse, analyze, and generate root cause analysis reports instantly. >By uploading log files or leaving us feedback, you may provide text, images, software, videos and/or other material, including third party content ("User Content") that you share using the Site. >Your User Content belongs to you (or to the relevant third parties). However, you grant the Company the following non-exclusive license: a worldwide, transferable and sub-licensable right to use, copy, modify, distribute, publish, and process, information and your User Content that you provide through the Site, without any further consent, notice and/or compensation to you or others. You also grant us the right to use your log files to enhance the performance of our Services. Not that I would trust even a perfect privacy policy when it comes to uploading heapdumps. There are however some websites that work completely offline (you download the HTML page and there is no network IO), like CyberChef [1] or the Spotify thread dump analyzer [2]. And for heap dumps, just use Eclipse MAT [3]. [1] https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/ (yes, that GCHQ) [2] https://spotify.github.io/threaddump-analyzer/ https://spotify.github.io/threaddump-analyzer/ [3] https://www.eclipse.org/mat/ https://www.eclipse.org/mat/

mrkeen 7y ago

Uploading code/data to AWS too!

thombat 7y ago

On these lines, allow me to introduce a valuable new service: MRLTaaS (Most Recent Leak Time as a Service) Ever wondered when the most recent leak of your most valuable secrets occurred? Simply upload your password file to my web service and within moments the magic of our distributed AI will return the current date/time...

fnord123 7y ago
https://haveibeenpwned.com/ https://haveibeenpwned.com/ Doesn't cynically take passwords, but could in theory harvest emails.
fnord123 7y ago
I found one that checks your hmac generation: https://www.freeformatter.com/hmac-generator.html https://www.freeformatter.com/hmac-generator.html

jsd1982 7y ago

Obviously bad to upload heap dumps, but they do have an enterprise plan you can pay for to host their software on your own hardware to avoid public upload. Still, even offering the public upload option is a serious concern. They'd be better suited offering a download with free tier limitations.

mumblemumble 7y ago

Just to add to this: Definitely do not use their cloud service to analyze heap dumps out of production. You will probably be leaking sensitive company secrets, and, if your company's data handling policies are at all reasonable, you'll probably also be violating legal obligations to your clients, as well as their trust. Doing it for development may be safer, insofar as it it's more likely to merely be dangerous, but not also tortious or unethical.

hinkley 7y ago
How did we end up in a place where everyone believes they have to go SaaS to make any money at all?

Twirrim 7y ago

Amazon used to (and may still) block access from their corporate network to any pastebin they could find, to try to stop engineers from using them to share code. They'd had too much stuff leak out that way, including API keys.