6 ms·

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to their owner? Sure. But that is far from all of them. I also just think it is a little uncharitable to wish harm on people simply because whoever did their IT was inexpert at their job? Like, how does the local mom and pop correctly evaluate a person's IT chops? The nephew says they can set up their website for cheap, and they want to be nice, so they give him the job. Turns out he's a newb and later their database gets deleted and you are on here saying that's a good thing? Hrm. I don't agree.

Drakim 6y ago
It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.
- asdfasgasdgasdg 6y ago
  Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the database if it is found again with an unsecured password, if you wanted to add some stick to your carrot. It does not seem like this attack has harm-minimization in mind.
  - deleted 6y ago
    [deleted]
  - pojzon 6y ago
    What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.
    - wolco 6y ago
      So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.
      - TeMPOraL 6y ago
        The problem is with the e-mailing part. A mom&pop is unlikely to track you down if you lock out their DB, but they'll likely report you to police if you contact them about it.
        Wowfunhappy 6y ago
        Is an email from an anonymous address easier to trace than remote database commands?
        edoceo 6y ago
        Yes. You need good logging on the vulnerable DB to trace the command - and if your DB is vulnerable it's a good bet you forgot the logging too. Emails have a bunch of info in the headers, so there is more meta-data in the email it self. Neither is perfect for finding the culprit but one scenario has zero meta-data and the other has some.
      - jfk13 6y ago
        How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.
  - cheerlessbog 6y ago
    Or just set everyone's password to the same thing eg SecureMe
- phkahler 6y ago
  >> but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? No. The equivalent would be exploiting their buildings weakness to cause them to collapse - maybe with people in them. Pointing out a vulnerability is not the same as demonstrating it. That said, a demonstration will get their attention more.
- octodog 6y ago
  Your comparison isn't fair - blowing the whistle is supposed to be a last resort. Internal disclosure and attempting to fix the issue collaboratively is always the first step. This attack is indiscriminate and is without warning, so it eliminates the possibility for database owners to fix the problem in good faith.
  - zentiggr 6y ago
    Finally, after years and years and years of being told over and over and the bottom line never improving. I got doxxed with the Equifax breach. How many other companies in the world will take someone's word that they are me based on that data, and what potential is there for my life amongst millions of others to go completely sideways because of companies who won't addmit the systems are broken? I say the house is already burning, but maybe throwing some fireworks into the blaze will convince the right parties to finally put the damn fire out. Beyond sick and tired of breach after breach after breach after "oh, there were millions of voter records showing publicly" "no, <insert product name> defaults to no security"
mcv 6y ago
I don't find your example very convincing. Any database storing personal data needs to be properly secured, and if that gym also has ID credit card or other more sensitive data, that data might better be destroyed than stolen. If it's a publicly accessible wiki with no sensitive data whatsoever, and that's meant to be publicly accessible, then there's a reasonable excuse for the poor security and it's not helping anyone to destroy it.
- nxpnsv 6y ago
  Why should innocent users be punished? Why not just send a pic confirming you have full db access? This is just unnecessary vandalism.
  - wolco 6y ago
    Somehow that would be worse. Feels like a ransom call.
  - tsimionescu 6y ago
    The point is that, if my credit card info is staying in a web-exposed, insecure DB, it is safer for me that it be destroyed than left alone. I have no idea of that is the intention of the attackers, or if they are maybe even stealing the info before deleting it. But assuming they were good Samaritans and just deleting it, that is the best outcome for me as a user, better than if it stayed up for another day.
  - katbyte 6y ago
    Because often that doesn’t actually elicit change. Deleting the data over and over does.
- asdfasgasdgasdg 6y ago
  There is no indication in this article that all of the databases had personal data.
Tade0 6y ago
Like, how does the local mom and pop correctly evaluate a person's IT chops? Usually by price and unfortunately both mom and pop like a bargain - I've seen this play out more times than I would like. Also how do you evaluate, say, a landscaper's chops? Or any other kind of contractor's for that matter? By doing research beforehand, checking what kind of reputation that person has etc. Low-effort or lack of research gives you bad services, for which you pay in losses like these.
- evilduck 6y ago
  In construction and landscaping work those companies are usually licensed, bonded and insured. If they fuck up the work there's obvious financial recourse. Also, the measure of them fucking up is generally a lot clearer for physical labor and for mom and pop businesses, getting construction work inspected by a 3rd party is usually more straightforward and cheaper. In software, financial recourse generally means you have to jump straight to lawsuits. There's no licensing for who's qualified to build a website, developers don't have to escrow funds or carry malpractice insurance in case they make a mistake, a development business should have insurance in place but there's not always easy or affordable ways to assign fault in most IT situations if you want to pursue them. Software and IT forensics are prohibitively costly and usually mean a lot of money has to be on the line which rule out mom and pop businesses entirely. IT and software mistakes also usually take longer to rear their heads, and people in IT and software also aren't known for sticking around for decades. How do you sue an LLC that dissolved 5 years ago? It's apples and oranges in my opinion.
  - Tade0 6y ago
    I don't how it is in the US, but in my country an audit that would reveal such an obvious lack of security costs no more than the equivalent of a single minimum salary - usually much less. On top of that several companies that offer such services are widely known because their media presence is mostly articles about vulnerabilities in routers, phones, operating systems etc. I hail from a post-communist country so I assumed the culture in the US is more developed in this regard.
TallGuyShort 6y ago
Just because it's understandable for Mom & Pop to not care about the privacy of the people whose data they've collected doesn't make it a good idea. They should care. If the buck doesn't stop with business owners, with whom does it stop? IMO we specialize too much and miss important things that we mentally outsource to other people. I'm equally disturbed how often I meet people in tech who are unable to do basic home repairs or cook for themselves. Something, like say, a few weeks of quarantine, and people's anxiety goes through the roof because they've relied on other people for basic life skills.
cm2187 6y ago
I am thinking more about the clients of the mom and pop shop who are better off not having their personal details exposed.
jaggirs 6y ago
The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. Deleting exposed databases is genious, there need to be real repercussions for companies if they leak user data.
- MattGaiser 6y ago
  > The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. That is a very rich person statement.
  - zentiggr 6y ago
    Fine, what about every poor person who gets their data stolen from an unsecured database, and gets their identity stolen? Yours is also a rich person statement. Unsecured databases are a huge loss for everyone. Anything that forces a shift in this naive behavior of vendors, implementors and executives is not just fine by me, I welcome it. If my life suffers because of data of mine that's lost from companies' databases, I now know who to cease doing business with.
  - tsimionescu 6y ago
    Not really, it's much easier for rich people to reclaim their identity than it is for poor people.
birdyrooster 6y ago
A spin class? Really that is the best example you can come up with? That is not at all compelling.
- asdfasgasdgasdg 6y ago
  What part of the example do you dispute? Spin studios have databases, like almost all small businesses these days.
  - birdyrooster 6y ago
    If I knew we were frying fish this small Id a brought a different pan
    - asdfasgasdgasdg 6y ago
      4000 small fish is a lot of biomass.
markovbot 6y ago
> Are there databases that could be lost without consequence except to their owner I would certainly hope the owner of the insecure database would face massive consequences. IMO there's not _nearly_ enough of that. This sort of breach should be financially ruinous for _any_ company.
- mod 6y ago
  What if the database only contains my blog posts? Or my own personal health information I'm tracking? Or all the Hearthstone cards? Or any other of the infinite data sets that are totally insignificant to anyone beyond the owner of the database? Not everything is about you, and also you totally misunderstood the post you quoted.
  - petee 6y ago
    Then you'll learn real quick to secure your database, make backups, or not post personal stuff online. And if you've configured your database that poorly, am I supposed to assume you've properly configured your server against becoming part of a DDoS attack? Or a bot net? The base level of negligence you're defending enables a multitude of attacks. Losing your DB would be an immediate sign you don't know what you're doing, and thus shouldn't be doing it.
jb775 6y ago
But what about the companies making millions in profit each year that are carelessly exposing sensitive data because they don't want to spend a little more on quality IT work? No one wants to see their local pizza shop lose their pizza-credit database, but if that's the price to pay for data security then so be it.
jb775 6y ago
What happens when mom & pop are storing your name and credit card # in plain text and then your identity gets stolen and credit ruined? Should we still be "charitable" to them and their d-bag nephew?
- jrockway 6y ago
  Your credit card number being stolen is a problem for your bank, not a problem for you. You can't steal someone's identity with a credit card number. The concern in this case is when there is some social problem with being in Mom & Pop Inc's customer database. There are probably some people that buy some things that they don't want other people to know about. When the database gets hacked and you are linked to being their customer, that is the unfortunate and potentially damaging information leak. A credit card just gets reissued and the bank reverses the transaction. No big deal.
  - gowld 6y ago
    It's a problem for the vendors, not the banks. They get hit with chargebacks for fraud that's no fault of their own, hurting the whole ecosystem of vendors and their customers. https://www.thestreet.com/personal-finance/credit-cards/credit-qa-who-foots-bill-fraudulent-charges-12790242 https://www.thestreet.com/personal-finance/credit-cards/cred...
    - lotsofpulp 6y ago
      The problem could be easily solved by Visa/MC/Discover/Amex implementing chip and pin, or at least 2FA SMS authorization. Bestbuy.com has it working somehow.
      - jessaustin 6y ago
        These people can't configure a firewall. How are they going to implement payments in the secure fashion you suggest?
        6y ago
RcouF1uZ4gsC 6y ago
> What if one of the databases has a record of credits you've purchased at your local spin studio? Usually when you buy something, you get an email receipt. So you print out your email receipt and go to the mom and pop store. Given they are a local mom and pop store, you likely have a long term relationship with them and they may even remember you buying credits. So it will be a hassle, but likely ok. It is the huge corporate stores that don’t have long term relationships that would be hurt by this thing the most.
abbadadda 6y ago
lol im sorry but this is probably not the best go-to example of real world consequences: > What if one of the databases has a record of credits you've purchased at your local spin studio? p.s. bobby tables did it first
tgsovlerkhgsel 6y ago
Depending on what data is being deleted, not deleting it could also have significantly worse consequences when it later falls into the wrong hands. In the case of the spin studio, you can prove what you paid, the owner just lost his evidence of what he no longer owes you, and will hopefully in the future stop exposing your personal data on the Internet.
boomlinde 6y ago
> Like, how does the local mom and pop correctly evaluate a person's IT chops? Not my problem. > The nephew says they can set up their website for cheap, and they want to be nice, so they give him the job. Turns out he's a newb and later their database gets deleted and you are on here saying that's a good thing? Hrm. I don't agree. Mom and pop prefer nepotism over skill, credentials and reputation, without even a second opinion. There is a reason that this is frowned upon (and has been for at least some 2000 years before mom and pop were born), regardless of the domain. On the off chance that their database doesn't contain any personally identifying information on their customers, this is an idiot tax. In any other case, their loss is completely justified when compared to the potential losses, abuse and manipulation of their customers that come with exposing their PII to the public.

Drakim 6y ago

It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.

asdfasgasdgasdg 6y ago
Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the database if it is found again with an unsecured password, if you wanted to add some stick to your carrot. It does not seem like this attack has harm-minimization in mind.
- deleted 6y ago
  [deleted]
- pojzon 6y ago
  What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.
  - wolco 6y ago
    So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.
    - TeMPOraL 6y ago
      The problem is with the e-mailing part. A mom&pop is unlikely to track you down if you lock out their DB, but they'll likely report you to police if you contact them about it.
      - Wowfunhappy 6y ago
        Is an email from an anonymous address easier to trace than remote database commands?
        edoceo 6y ago
        Yes. You need good logging on the vulnerable DB to trace the command - and if your DB is vulnerable it's a good bet you forgot the logging too. Emails have a bunch of info in the headers, so there is more meta-data in the email it self. Neither is perfect for finding the culprit but one scenario has zero meta-data and the other has some.
    - jfk13 6y ago
      How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.
- cheerlessbog 6y ago
  Or just set everyone's password to the same thing eg SecureMe
phkahler 6y ago
>> but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? No. The equivalent would be exploiting their buildings weakness to cause them to collapse - maybe with people in them. Pointing out a vulnerability is not the same as demonstrating it. That said, a demonstration will get their attention more.
octodog 6y ago
Your comparison isn't fair - blowing the whistle is supposed to be a last resort. Internal disclosure and attempting to fix the issue collaboratively is always the first step. This attack is indiscriminate and is without warning, so it eliminates the possibility for database owners to fix the problem in good faith.
- zentiggr 6y ago
  Finally, after years and years and years of being told over and over and the bottom line never improving. I got doxxed with the Equifax breach. How many other companies in the world will take someone's word that they are me based on that data, and what potential is there for my life amongst millions of others to go completely sideways because of companies who won't addmit the systems are broken? I say the house is already burning, but maybe throwing some fireworks into the blaze will convince the right parties to finally put the damn fire out. Beyond sick and tired of breach after breach after breach after "oh, there were millions of voter records showing publicly" "no, <insert product name> defaults to no security"

mcv 6y ago

I don't find your example very convincing. Any database storing personal data needs to be properly secured, and if that gym also has ID credit card or other more sensitive data, that data might better be destroyed than stolen. If it's a publicly accessible wiki with no sensitive data whatsoever, and that's meant to be publicly accessible, then there's a reasonable excuse for the poor security and it's not helping anyone to destroy it.

nxpnsv 6y ago
Why should innocent users be punished? Why not just send a pic confirming you have full db access? This is just unnecessary vandalism.
- wolco 6y ago
  Somehow that would be worse. Feels like a ransom call.
- tsimionescu 6y ago
  The point is that, if my credit card info is staying in a web-exposed, insecure DB, it is safer for me that it be destroyed than left alone. I have no idea of that is the intention of the attackers, or if they are maybe even stealing the info before deleting it. But assuming they were good Samaritans and just deleting it, that is the best outcome for me as a user, better than if it stayed up for another day.
- katbyte 6y ago
  Because often that doesn’t actually elicit change. Deleting the data over and over does.
asdfasgasdgasdg 6y ago
There is no indication in this article that all of the databases had personal data.

Tade0 6y ago

Like, how does the local mom and pop correctly evaluate a person's IT chops? Usually by price and unfortunately both mom and pop like a bargain - I've seen this play out more times than I would like. Also how do you evaluate, say, a landscaper's chops? Or any other kind of contractor's for that matter? By doing research beforehand, checking what kind of reputation that person has etc. Low-effort or lack of research gives you bad services, for which you pay in losses like these.

evilduck 6y ago
In construction and landscaping work those companies are usually licensed, bonded and insured. If they fuck up the work there's obvious financial recourse. Also, the measure of them fucking up is generally a lot clearer for physical labor and for mom and pop businesses, getting construction work inspected by a 3rd party is usually more straightforward and cheaper. In software, financial recourse generally means you have to jump straight to lawsuits. There's no licensing for who's qualified to build a website, developers don't have to escrow funds or carry malpractice insurance in case they make a mistake, a development business should have insurance in place but there's not always easy or affordable ways to assign fault in most IT situations if you want to pursue them. Software and IT forensics are prohibitively costly and usually mean a lot of money has to be on the line which rule out mom and pop businesses entirely. IT and software mistakes also usually take longer to rear their heads, and people in IT and software also aren't known for sticking around for decades. How do you sue an LLC that dissolved 5 years ago? It's apples and oranges in my opinion.
- Tade0 6y ago
  I don't how it is in the US, but in my country an audit that would reveal such an obvious lack of security costs no more than the equivalent of a single minimum salary - usually much less. On top of that several companies that offer such services are widely known because their media presence is mostly articles about vulnerabilities in routers, phones, operating systems etc. I hail from a post-communist country so I assumed the culture in the US is more developed in this regard.

TallGuyShort 6y ago

Just because it's understandable for Mom & Pop to not care about the privacy of the people whose data they've collected doesn't make it a good idea. They should care. If the buck doesn't stop with business owners, with whom does it stop? IMO we specialize too much and miss important things that we mentally outsource to other people. I'm equally disturbed how often I meet people in tech who are unable to do basic home repairs or cook for themselves. Something, like say, a few weeks of quarantine, and people's anxiety goes through the roof because they've relied on other people for basic life skills.

cm2187 6y ago

I am thinking more about the clients of the mom and pop shop who are better off not having their personal details exposed.

jaggirs 6y ago

The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. Deleting exposed databases is genious, there need to be real repercussions for companies if they leak user data.

MattGaiser 6y ago
> The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. That is a very rich person statement.
- zentiggr 6y ago
  Fine, what about every poor person who gets their data stolen from an unsecured database, and gets their identity stolen? Yours is also a rich person statement. Unsecured databases are a huge loss for everyone. Anything that forces a shift in this naive behavior of vendors, implementors and executives is not just fine by me, I welcome it. If my life suffers because of data of mine that's lost from companies' databases, I now know who to cease doing business with.
- tsimionescu 6y ago
  Not really, it's much easier for rich people to reclaim their identity than it is for poor people.

birdyrooster 6y ago

A spin class? Really that is the best example you can come up with? That is not at all compelling.

asdfasgasdgasdg 6y ago
What part of the example do you dispute? Spin studios have databases, like almost all small businesses these days.
- birdyrooster 6y ago
  If I knew we were frying fish this small Id a brought a different pan
  - asdfasgasdgasdg 6y ago
    4000 small fish is a lot of biomass.

markovbot 6y ago

> Are there databases that could be lost without consequence except to their owner I would certainly hope the owner of the insecure database would face massive consequences. IMO there's not _nearly_ enough of that. This sort of breach should be financially ruinous for _any_ company.

mod 6y ago
What if the database only contains my blog posts? Or my own personal health information I'm tracking? Or all the Hearthstone cards? Or any other of the infinite data sets that are totally insignificant to anyone beyond the owner of the database? Not everything is about you, and also you totally misunderstood the post you quoted.
- petee 6y ago
  Then you'll learn real quick to secure your database, make backups, or not post personal stuff online. And if you've configured your database that poorly, am I supposed to assume you've properly configured your server against becoming part of a DDoS attack? Or a bot net? The base level of negligence you're defending enables a multitude of attacks. Losing your DB would be an immediate sign you don't know what you're doing, and thus shouldn't be doing it.

jb775 6y ago

But what about the companies making millions in profit each year that are carelessly exposing sensitive data because they don't want to spend a little more on quality IT work? No one wants to see their local pizza shop lose their pizza-credit database, but if that's the price to pay for data security then so be it.

jb775 6y ago

What happens when mom & pop are storing your name and credit card # in plain text and then your identity gets stolen and credit ruined? Should we still be "charitable" to them and their d-bag nephew?

jrockway 6y ago
Your credit card number being stolen is a problem for your bank, not a problem for you. You can't steal someone's identity with a credit card number. The concern in this case is when there is some social problem with being in Mom & Pop Inc's customer database. There are probably some people that buy some things that they don't want other people to know about. When the database gets hacked and you are linked to being their customer, that is the unfortunate and potentially damaging information leak. A credit card just gets reissued and the bank reverses the transaction. No big deal.
- gowld 6y ago
  It's a problem for the vendors, not the banks. They get hit with chargebacks for fraud that's no fault of their own, hurting the whole ecosystem of vendors and their customers. https://www.thestreet.com/personal-finance/credit-cards/credit-qa-who-foots-bill-fraudulent-charges-12790242 https://www.thestreet.com/personal-finance/credit-cards/cred...
  - lotsofpulp 6y ago
    The problem could be easily solved by Visa/MC/Discover/Amex implementing chip and pin, or at least 2FA SMS authorization. Bestbuy.com has it working somehow.
    - jessaustin 6y ago
      These people can't configure a firewall. How are they going to implement payments in the secure fashion you suggest?
      - 6y ago

RcouF1uZ4gsC 6y ago

> What if one of the databases has a record of credits you've purchased at your local spin studio? Usually when you buy something, you get an email receipt. So you print out your email receipt and go to the mom and pop store. Given they are a local mom and pop store, you likely have a long term relationship with them and they may even remember you buying credits. So it will be a hassle, but likely ok. It is the huge corporate stores that don’t have long term relationships that would be hurt by this thing the most.

abbadadda 6y ago

lol im sorry but this is probably not the best go-to example of real world consequences: > What if one of the databases has a record of credits you've purchased at your local spin studio? p.s. bobby tables did it first

tgsovlerkhgsel 6y ago

Depending on what data is being deleted, not deleting it could also have significantly worse consequences when it later falls into the wrong hands. In the case of the spin studio, you can prove what you paid, the owner just lost his evidence of what he no longer owes you, and will hopefully in the future stop exposing your personal data on the Internet.

boomlinde 6y ago

> Like, how does the local mom and pop correctly evaluate a person's IT chops? Not my problem. > The nephew says they can set up their website for cheap, and they want to be nice, so they give him the job. Turns out he's a newb and later their database gets deleted and you are on here saying that's a good thing? Hrm. I don't agree. Mom and pop prefer nepotism over skill, credentials and reputation, without even a second opinion. There is a reason that this is frowned upon (and has been for at least some 2000 years before mom and pop were born), regardless of the domain. On the off chance that their database doesn't contain any personally identifying information on their customers, this is an idiot tax. In any other case, their loss is completely justified when compared to the potential losses, abuse and manipulation of their customers that come with exposing their PII to the public.