13 ms·

Yandex said it caught an employee selling access to users' inboxes

155 points by LinuxBender 6y ago

HNSAXU 6y ago
Google trolling competitors?
throwawaysea 6y ago
That's quite scary. I wonder if something like this is possible at Google or Microsoft or Yahoo. Even if multiple people need to approve that kind of access, it must be possible to socially overcome those barriers (via influence, bribery, etc.) if the right actors can be identified. It would be preferable to have control over this from the user-side.
- ajhurliman 6y ago
  This is the idea of local-first software[0]. Imagine you owning your own database and the only thing you get when you go to a website is the software and none of the data (it accesses your database instead). Projects like Textile[1] are building out tools that could help with that sort of project. I really hope it takes off, the cloud sort of freaks me out. [0] https://www.inkandswitch.com/local-first.html https://www.inkandswitch.com/local-first.html [1] http://textile.io/ http://textile.io/
  - yrgulation 6y ago
    Either that or each user’s records are encrypted using their own password and forgot password recovery question/s answers. Here is an example of how it can be done: https://security.stackexchange.com/questions/30193/encrypting-user-data-using-password-and-forgot-my-password https://security.stackexchange.com/questions/30193/encryptin... Although this approach still requires trust that service providers do indeed encrypt user data.
  - Scene_Cast2 6y ago
    So the core problem is that when something is running on someone else's server, you can't even verify what they're running. E2E encryption avoids that by not trusting whatever is running on the servers Local DBs avoid that by not giving up local data. However, it would be quite interesting to have a way to remotely know that a certain service is running the code you think it's running.
    - jaywalk 6y ago
      > it would be quite interesting to have a way to remotely know that a certain service is running the code you think it's running. It sure would, and it would be a hell of a discovery if someone could come up with it. Because I sure can't think of a way that I can't easily debunk.
      - Scene_Cast2 6y ago
        Intel has done some work on this front that can hypothetically be used this way, but I wouldn't say it's practical, for various reasons.
    - DSingularity 6y ago
      You mean like intel TXT remote attestation?
      - Scene_Cast2 6y ago
        The trick here would be integrating that to play nicely with load balancers, REST-style APIs, and reducing overhead from establishing yet another secure connection.
  - hezag 6y ago
    Related: Solid Project - HN discussion: https://news.ycombinator.com/item?id=25989698 https://news.ycombinator.com/item?id=25989698 - A great article about the project: https://ruben.verborgh.org/blog/2020/12/07/a-data-ecosystem-fosters-sustainable-innovation/ https://ruben.verborgh.org/blog/2020/12/07/a-data-ecosystem-...
    - Jugurtha 6y ago
      Slightly related, we're working with a similar philosophy. As a machine learning consultancy that has done many learning projects for enterprise, we're building our machine learning operations, "MLOps", platform (https://iko.ai https://iko.ai) to simplify our work. However, what we're doing is working from the architecture level to have as little and preferrably no sensitive information on our service. We're architecting it so that you give us specific access to deploy on your cluster, and everything happens there: the notebook servers are there, your data is where you choose to put it, your training jobs are there, your experiments are tracked there. Your models are deployed there. I have a saying that the platform should be able to run on a Raspberry PI. One of my personal pet peeves working with the team is to be able to disappear without impacting them, and it has become the same with our platform: it must be able to disappear users having to scramble to exfiltrate or export their work or data from our infrastructure, because it simply is not there.
- sn_master 6y ago
  It is. For example, machine learning teams at Microsoft run software that reads all email content on Exchange servers. There are guardrails to make sure the engineers don't gain access to the data themselves, but there are accidental slip ups from time to time, and certainly a motivated engineer can always find a way to peek at the data of any inbox.
  - fractionalhare 6y ago
    Yeah. That could be resolved if the ML teams only had access to the aggregated, anonymized data or the output of the models. And if a privileged access token (for example, the one the model training flow ostensibly uses) is logged as querying specific subsets of the raw data or ferrying it out of band, that should throw an immediate alarm with an audit trail.
    - deleted 6y ago
      [deleted]
- ceejayoz 6y ago
  Not just possible, it happens. Google: https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... Facebook: https://www.theguardian.com/technology/2018/may/02/facebook-engineer-fired-alleged-stalker-tinder https://www.theguardian.com/technology/2018/may/02/facebook-... The NSA: https://www.reuters.com/article/us-usa-surveillance-watchdog/nsa-staff-used-spy-tools-on-spouses-ex-lovers-watchdog-idUSBRE98Q14G20130927 https://www.reuters.com/article/us-usa-surveillance-watchdog... These are presumably just the tip of the iceberg of people dumb enough to get caught.
  - redis_mlc 6y ago
    Yahoo historically (for decades) monitors customer support IC staff for application-level access abuse to user account data, and does investigations for misuse. Mgmt. takes that seriously, so the Yandex scenario mentioned in the article wouldn't happen for long. However, as at all companies, engineers have alternate server-level access to row-level data, otherwise nobody could troubleshoot internal systems. Yahoo is divided into 50+ engineering silos, so that access is very diffused. So far, so good. But in the case of Yahoo, the govt. does kernel-level keyword sniffing on email servers. (AFAIK that's unique to Yahoo. Never even heard of that for FAANG.) Yahoo was also pwned for a few years: https://www.theregister.com/2018/04/24/yahoo_fined_35m/ https://www.theregister.com/2018/04/24/yahoo_fined_35m/ https://www.theregister.com/2016/10/04/yahoo_was_nsa_stooge/ https://www.theregister.com/2016/10/04/yahoo_was_nsa_stooge/ Source: worked there.
  - tdeck 6y ago
    That Google link is from 2010. Access controls at Google are much stricter now.
  - fingerlocks 6y ago
    Did you even read the article about Facebook? Some dude got fired over a screenshot of a out-of-context lame joke text message. It was a weak allegation
arkadiyt 6y ago
I hope the HN crowd doesn't write this off because it's Russia - employee abuse of customer data is all too common in tech: - Google Engineer Stalked Teens, Spied on Chats: https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... - Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-allegation-that-employees-abused-customer-data https://www.theinformation.com/articles/lyft-investigates-al... - Uber Employees Allegedly Use Data to Stalk Exes, Celebs: https://www.newser.com/story/235409/lawsuit-uber-employees-use-data-to-stalk-celebs-exes.html https://www.newser.com/story/235409/lawsuit-uber-employees-u... - Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employee-used-privile-1825666305 https://gizmodo.com/facebook-investigating-claim-that-employ... - Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees-abused-data-access-spy-on-users-snaplion https://www.vice.com/en_us/article/xwnva7/snapchat-employees... - Yahoo Engineer Used Insider Access to Get Private Photos of Women: https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-used-insider-access-to-get-private-photos-of-women https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-u... Most occurrences likely never even make it into the news.
- cryptochromium 6y ago
  It's a real big problem. Employees from our version of the cdc (ggd) were caught selling peoples data who were tested positive for covid. including social security numbers. https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/handel-gegevens-nederlanders-ggd-systemen-database-coronit-hpzone https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/ha...
  - brnt 6y ago
    Who would be buying this info? Are Dutch insurers allowed to procure such information?
    - Boltgolt 6y ago
edrobap 6y ago
> Yandex officials also said they re-secured the compromised accounts and blocked what appeared to be unauthorized logins. They are now asking impacted account owners to change their passwords. I’m curious how access was provided to these sold accounts. The password change implies the passwords were shared and that means plan text password were available to admins!?
- justusthane 6y ago
  I'm not sure why you were downvoted - I vouched for your comment to bring it back (in fact, looking at your comment history it looks like almost all of your comments are dead). I think you're right though--it does seem like they must have sold the passwords themselves. It's interesting to think about how you would sell access to an account if you wanted to.
  - ncann 6y ago
    Depending on your level of access, I can think of many ways. You can do a "takeout" of all data in the account and sell that. Or it can be anything that is requested, like a dump of all the private messages. You can change the password of the account, possibly at a time like 3am at the user's local time so they're less likely to be using the account, then change it back at say 5am. This requires DB access. You can find the user's session token/id if they're logged in somewhere and sell that.
    - edrobap 6y ago
      All 3 ways make sense. The dump and session token ways look cleaner from Yandex employees’ perspective. Although, none of the three should require a password change for the compromised user account. At no point, users password or hash of the password gets shared.
camgunz 6y ago
As long as it's possible to do this and there aren't serious high-level repercussions for it, it will keep happening. This is why people flock to e2e systems, because we don't trust corporations or governments to protect us.
- sn_master 6y ago
  The sad part is, most e2e aren't true e2e. Even if they are, they often backup everything in a central location like Whatsapp/ which put everything in your Google account without any additional crypto layers, making it all accessible with a subpeona or prism to any law enforcement agency. Edit: Removed Signal as an example.
  - tokamak-teapot 6y ago
    Signal only backs up messages on Android - and requires a thirty digit key to be provided to save/restore. Is this not the encryption key then?
  - eatingCake 6y ago
    > they often backup everything in a central location like Whatsapp/Telegram/Signal which put everything in your Google account without any additional crypto layers I don't know about the others but I don't think Signal does this. Signal offers the user the ability to backup their messages, and lets them password protect them, but the way you've written this implies Signal is uploading messages to Google of its own volition, unencrypted, which afaik is not the case.
  - deleted 6y ago
    [deleted]
- teddyh 6y ago
  > As long as it's possible to do this … it will keep happening. FTFY. The only solution is for the information never to exist in the first place, never centralized, never even collected.
  - 6y ago
deleted 6y ago
[deleted]
aasasd 6y ago
As usual, the site can't be bothered to link to the first-hand announcement. Which is absolutely a ‘dark pattern’, and half of news sites that are generally considered alright, still feel the need to do this. https://yandex.com/company/press_center/press_releases/2021/2021-12-02 https://yandex.com/company/press_center/press_releases/2021/... Or in Russian: https://yandex.ru/company/press_releases/2021/2021-02-12 https://yandex.ru/company/press_releases/2021/2021-02-12
- jiveturkey 6y ago
  It's not "can't be bothered", implying low effort. It's very intentional SEO. Linking to the source unweights their own reporting. And it isn't a dark pattern. Dark patterns are https://www.darkpatterns.org/types-of-dark-pattern https://www.darkpatterns.org/types-of-dark-pattern type of things. Or, the typical cookie consent box. This is just tragedy of the commons.

155 points by LinuxBender 6y ago

Google trolling competitors?

That's quite scary. I wonder if something like this is possible at Google or Microsoft or Yahoo. Even if multiple people need to approve that kind of access, it must be possible to socially overcome those barriers (via influence, bribery, etc.) if the right actors can be identified. It would be preferable to have control over this from the user-side.

ajhurliman 6y ago
This is the idea of local-first software[0]. Imagine you owning your own database and the only thing you get when you go to a website is the software and none of the data (it accesses your database instead). Projects like Textile[1] are building out tools that could help with that sort of project. I really hope it takes off, the cloud sort of freaks me out. [0] https://www.inkandswitch.com/local-first.html https://www.inkandswitch.com/local-first.html [1] http://textile.io/ http://textile.io/
- yrgulation 6y ago
  Either that or each user’s records are encrypted using their own password and forgot password recovery question/s answers. Here is an example of how it can be done: https://security.stackexchange.com/questions/30193/encrypting-user-data-using-password-and-forgot-my-password https://security.stackexchange.com/questions/30193/encryptin... Although this approach still requires trust that service providers do indeed encrypt user data.
- Scene_Cast2 6y ago
  So the core problem is that when something is running on someone else's server, you can't even verify what they're running. E2E encryption avoids that by not trusting whatever is running on the servers Local DBs avoid that by not giving up local data. However, it would be quite interesting to have a way to remotely know that a certain service is running the code you think it's running.
  - jaywalk 6y ago
    > it would be quite interesting to have a way to remotely know that a certain service is running the code you think it's running. It sure would, and it would be a hell of a discovery if someone could come up with it. Because I sure can't think of a way that I can't easily debunk.
    - Scene_Cast2 6y ago
      Intel has done some work on this front that can hypothetically be used this way, but I wouldn't say it's practical, for various reasons.
  - DSingularity 6y ago
    You mean like intel TXT remote attestation?
    - Scene_Cast2 6y ago
      The trick here would be integrating that to play nicely with load balancers, REST-style APIs, and reducing overhead from establishing yet another secure connection.
- hezag 6y ago
  Related: Solid Project - HN discussion: https://news.ycombinator.com/item?id=25989698 https://news.ycombinator.com/item?id=25989698 - A great article about the project: https://ruben.verborgh.org/blog/2020/12/07/a-data-ecosystem-fosters-sustainable-innovation/ https://ruben.verborgh.org/blog/2020/12/07/a-data-ecosystem-...
  - Jugurtha 6y ago
    Slightly related, we're working with a similar philosophy. As a machine learning consultancy that has done many learning projects for enterprise, we're building our machine learning operations, "MLOps", platform (https://iko.ai https://iko.ai) to simplify our work. However, what we're doing is working from the architecture level to have as little and preferrably no sensitive information on our service. We're architecting it so that you give us specific access to deploy on your cluster, and everything happens there: the notebook servers are there, your data is where you choose to put it, your training jobs are there, your experiments are tracked there. Your models are deployed there. I have a saying that the platform should be able to run on a Raspberry PI. One of my personal pet peeves working with the team is to be able to disappear without impacting them, and it has become the same with our platform: it must be able to disappear users having to scramble to exfiltrate or export their work or data from our infrastructure, because it simply is not there.
sn_master 6y ago
It is. For example, machine learning teams at Microsoft run software that reads all email content on Exchange servers. There are guardrails to make sure the engineers don't gain access to the data themselves, but there are accidental slip ups from time to time, and certainly a motivated engineer can always find a way to peek at the data of any inbox.
- fractionalhare 6y ago
  Yeah. That could be resolved if the ML teams only had access to the aggregated, anonymized data or the output of the models. And if a privileged access token (for example, the one the model training flow ostensibly uses) is logged as querying specific subsets of the raw data or ferrying it out of band, that should throw an immediate alarm with an audit trail.
  - deleted 6y ago
    [deleted]
ceejayoz 6y ago
Not just possible, it happens. Google: https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... Facebook: https://www.theguardian.com/technology/2018/may/02/facebook-engineer-fired-alleged-stalker-tinder https://www.theguardian.com/technology/2018/may/02/facebook-... The NSA: https://www.reuters.com/article/us-usa-surveillance-watchdog/nsa-staff-used-spy-tools-on-spouses-ex-lovers-watchdog-idUSBRE98Q14G20130927 https://www.reuters.com/article/us-usa-surveillance-watchdog... These are presumably just the tip of the iceberg of people dumb enough to get caught.
- redis_mlc 6y ago
  Yahoo historically (for decades) monitors customer support IC staff for application-level access abuse to user account data, and does investigations for misuse. Mgmt. takes that seriously, so the Yandex scenario mentioned in the article wouldn't happen for long. However, as at all companies, engineers have alternate server-level access to row-level data, otherwise nobody could troubleshoot internal systems. Yahoo is divided into 50+ engineering silos, so that access is very diffused. So far, so good. But in the case of Yahoo, the govt. does kernel-level keyword sniffing on email servers. (AFAIK that's unique to Yahoo. Never even heard of that for FAANG.) Yahoo was also pwned for a few years: https://www.theregister.com/2018/04/24/yahoo_fined_35m/ https://www.theregister.com/2018/04/24/yahoo_fined_35m/ https://www.theregister.com/2016/10/04/yahoo_was_nsa_stooge/ https://www.theregister.com/2016/10/04/yahoo_was_nsa_stooge/ Source: worked there.
- tdeck 6y ago
  That Google link is from 2010. Access controls at Google are much stricter now.
- fingerlocks 6y ago
  Did you even read the article about Facebook? Some dude got fired over a screenshot of a out-of-context lame joke text message. It was a weak allegation

arkadiyt 6y ago

I hope the HN crowd doesn't write this off because it's Russia - employee abuse of customer data is all too common in tech: - Google Engineer Stalked Teens, Spied on Chats: https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... - Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-allegation-that-employees-abused-customer-data https://www.theinformation.com/articles/lyft-investigates-al... - Uber Employees Allegedly Use Data to Stalk Exes, Celebs: https://www.newser.com/story/235409/lawsuit-uber-employees-use-data-to-stalk-celebs-exes.html https://www.newser.com/story/235409/lawsuit-uber-employees-u... - Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employee-used-privile-1825666305 https://gizmodo.com/facebook-investigating-claim-that-employ... - Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees-abused-data-access-spy-on-users-snaplion https://www.vice.com/en_us/article/xwnva7/snapchat-employees... - Yahoo Engineer Used Insider Access to Get Private Photos of Women: https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-used-insider-access-to-get-private-photos-of-women https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-u... Most occurrences likely never even make it into the news.

cryptochromium 6y ago
It's a real big problem. Employees from our version of the cdc (ggd) were caught selling peoples data who were tested positive for covid. including social security numbers. https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/handel-gegevens-nederlanders-ggd-systemen-database-coronit-hpzone https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/ha...
- brnt 6y ago
  Who would be buying this info? Are Dutch insurers allowed to procure such information?
  - Boltgolt 6y ago

edrobap 6y ago

> Yandex officials also said they re-secured the compromised accounts and blocked what appeared to be unauthorized logins. They are now asking impacted account owners to change their passwords. I’m curious how access was provided to these sold accounts. The password change implies the passwords were shared and that means plan text password were available to admins!?

justusthane 6y ago
I'm not sure why you were downvoted - I vouched for your comment to bring it back (in fact, looking at your comment history it looks like almost all of your comments are dead). I think you're right though--it does seem like they must have sold the passwords themselves. It's interesting to think about how you would sell access to an account if you wanted to.
- ncann 6y ago
  Depending on your level of access, I can think of many ways. You can do a "takeout" of all data in the account and sell that. Or it can be anything that is requested, like a dump of all the private messages. You can change the password of the account, possibly at a time like 3am at the user's local time so they're less likely to be using the account, then change it back at say 5am. This requires DB access. You can find the user's session token/id if they're logged in somewhere and sell that.
  - edrobap 6y ago
    All 3 ways make sense. The dump and session token ways look cleaner from Yandex employees’ perspective. Although, none of the three should require a password change for the compromised user account. At no point, users password or hash of the password gets shared.

camgunz 6y ago

As long as it's possible to do this and there aren't serious high-level repercussions for it, it will keep happening. This is why people flock to e2e systems, because we don't trust corporations or governments to protect us.

sn_master 6y ago
The sad part is, most e2e aren't true e2e. Even if they are, they often backup everything in a central location like Whatsapp/ which put everything in your Google account without any additional crypto layers, making it all accessible with a subpeona or prism to any law enforcement agency. Edit: Removed Signal as an example.
- tokamak-teapot 6y ago
  Signal only backs up messages on Android - and requires a thirty digit key to be provided to save/restore. Is this not the encryption key then?
- eatingCake 6y ago
  > they often backup everything in a central location like Whatsapp/Telegram/Signal which put everything in your Google account without any additional crypto layers I don't know about the others but I don't think Signal does this. Signal offers the user the ability to backup their messages, and lets them password protect them, but the way you've written this implies Signal is uploading messages to Google of its own volition, unencrypted, which afaik is not the case.
- deleted 6y ago
  [deleted]
teddyh 6y ago
> As long as it's possible to do this … it will keep happening. FTFY. The only solution is for the information never to exist in the first place, never centralized, never even collected.
- 6y ago

deleted 6y ago

[deleted]

aasasd 6y ago

As usual, the site can't be bothered to link to the first-hand announcement. Which is absolutely a ‘dark pattern’, and half of news sites that are generally considered alright, still feel the need to do this. https://yandex.com/company/press_center/press_releases/2021/2021-12-02 https://yandex.com/company/press_center/press_releases/2021/... Or in Russian: https://yandex.ru/company/press_releases/2021/2021-02-12 https://yandex.ru/company/press_releases/2021/2021-02-12

jiveturkey 6y ago
It's not "can't be bothered", implying low effort. It's very intentional SEO. Linking to the source unweights their own reporting. And it isn't a dark pattern. Dark patterns are https://www.darkpatterns.org/types-of-dark-pattern https://www.darkpatterns.org/types-of-dark-pattern type of things. Or, the typical cookie consent box. This is just tragedy of the commons.