21 ms·
American spy hacked Booking.com, company stayed silent
- swarnie 5y agoWhich internationally renowned terrorist group with a 3 letter abbreviation did this?
- DeathArrow 5y agoAnd what the Dutch officials have to say? Will they do an investigation? I hope Booking pays a fine.
- andygrd 5y agoI'd feel sorry for anyone who hacked booking.com, they'd end up trying to decipher several petabytes of email data saying basically, "stop sending me hotel offers in Outer Mongolia!"
- mrich 5y agoWorse still, they would have to read Perl code :)
- iso1210 5y agoSo you're saying the encrypt their code?
- OneTimePetes 5y agoRevenge of the Reg/"(?>(?:(?>[^"\\]+)|\\.)*)"/ ex. The enbalm it in pyramids and put a camel in front.
- danmur 5y agoHilarious route to security, only Perl programmers can work it out and they won't be bought off
- iso1210 5y agoNobody can read my perl code -- including me!
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- tyingq 5y agoI love Perl. But, if I were hired to squirrel away code that helped me spy on people, Perl would be one of my top choices. Lots of opportunity to hide the true purpose of the code with weird, little known side-effects, syntax, and so on. Perl doesn't have to be cryptic, but it can be.
- kizer 5y agoWhy would anyone build something like that in Perl? I could only see it being done “just because”. Wasn’t Perl specifically designed for the quickly code it once and not change it again case?
- tempest_ 5y agoPerl was python before python was python, and booking.com is old.
- mrich 5y agoOn the server it was the predecessor to Node.js, back when the alternative was a C program :)
- nebula8804 5y agoI thought the Netherlands was weird in that there is a large group of Perl programmers who never decided to move on. It is its own ecosystem Its kind of like how Japan stayed on flip phones for forever and even bolted on smartphone features to their flip phones.
- tantalor 5y agoPerl was the best/fastest way to write web applications (think FastCGI, mod_perl) before PHP stole that crown in late 90s.
- encryptluks2 5y agoWhy wouldn't they stay silent? That is the norm unfortunately and congress is more concerned about being able to enact more anti-privacy and anti-encryption laws than they are of actually holding companies liable for poor cybersecurity. I definitely encourage everyone to watch the hearing with Colonial Pipeline to see what I'm talking about.
- miohtama 5y agoBecause Booking.com is a Dutch company, and the EU has GDPR, the incident cannot legally repeat itself. This was 2016 incident and GDPR become effective 2018.
- sweaty 5y agoGDPR isn't a be-all and end-all, Dutch laws already incorporated a lot of aspects of it such as having to notify their customers prior to GDPR becoming effective.
- daenney 5y agoOf course it can repeat itself. Dutch laws already mandated disclosure of a breach like this before the GDPR. The company simply didn’t give a fuck and found a legal firm that gave it license not to. As the article noted the company operates on a “if we don’t see it and it doesn’t hurt us we don’t care” principle. Even with the GDPR, the company can still chose to not give a fuck. It just becomes a more risky gamble assuming anyone ever finds out.
- Freak_NL 5y agoThis took place just before the EU-wide GDPR was introduced, but under the Dutch national laws applicable at the time Booking.com was obliged to notify its affected users. Because the impact of a foreign state actor spying on your hotel bookings can be quite high (something Booking.com cannot reasonably determine for their users themselves) disclosure should have happened then in 2016, and the Dutch Data Protection Authority should have been informed as well.
- consp 5y ago
- rossmohax 5y agoIs it worth a shot to file a complain with SEC? Booking is a public company and must disclose any substantial information.
- consp 5y agoInteresting part from the Dutch version of the article: Booking is nooit eerder op spionage gestuit. Het bedrijf is er ook niet echt naar op zoek. Zolang die geen hinder oplevert, kost het geen geld. De onuitgesproken consensus onder specialisten binnen het bedrijf is: we vermoeden dat inlichtingendiensten meekijken, maar zolang we ze niet zien, maken we ons niet druk. Which roughly translates to We are not looking for espionage and if it doesn't hinder us we don't care.
- mettamage 5y agoSounds pragmatic, I wonder when this approach will backfire though.
- throwaway4good 5y agoI bet the attitude would have been very different had spying been done by China, Russia, Israel, or even the Netherlands itself.
- Cthulhu_ 5y agoDepends on whether they see it as competition. Given their market share, I don't believe they do. They're aimed at a western market.
- throwaway4good 5y agoThey are quite active in Asia including China.
- buran77 5y agoIt would have turned into one of the hundreds of articles about Russian, Chinese, Iranian, Ukrainian, North Korean, etc. hackers meant to solidify people's world view that we have a "good side" and a "bad side" of the world. The reality is that we have a "bad side" and a "worse side" but that's a hard pill to swallow for the regular person. Hence the deluge of articles meant to "straighten up" the view.
- dmix 5y ago> The specific intelligence organization—of which the United States has 18—is unknown. This is a great factoid. Eighteen different IC agencies and countless contractors.
- Tepix 5y agoThat's not counting the secret agencies.
- seanieb 5y agoAnd they couldn’t estimate accurately how fast the Taliban was recapturing Afghanistan, a country they occupied for over a decade! Too many cooks in that kitchen!
- dtjb 5y agoWendover did an interesting video on the logistics of Afghanistan, including the collapse of the ring road which hampered intelligence efforts. https://www.youtube.com/watch?v=o4tuhWvKduU https://www.youtube.com/watch?v=o4tuhWvKduU
- xxs 5y agoOf course they could not - the gravy train for 20years... what's not to like
- Santosh83 5y agoOf course they could. Why are people this naive? Nevertheless the administration simply did not care. It was time to shift the theatre of war elsewhere and that's that.
- jessaustin 5y agoLook who's naive. The war was marketed as an attempt to kill one person. A month after the war started, that person left Afghanistan and never came back. After ten years, someone who vaguely resembled the original target was allegedly killed in a different nation, although somehow the corpse was never photographed or examined. After another ten years, it was twenty years past time to end the war. Our unsupervised services might have suspected that it would all go to shit, but they expected that to take several months rather than several days. It's stupid to argue about, however, because the war should have ended after a month, when ObL left Afghanistan!
- eecc 5y agoI guess the Board knows well enough how many skeletons they're hiding (either personally, or the company itself) and what US laws might be pulled out of the hat to give them an Assange or Huawey treatment. You don't mess with the US, even when you're the victim.
- LogonType10 5y agoThere's a simpler answer here. There's no money to be made by accusing the US. They just don't care about security.
- bbarn 5y agoThey may be dutch on paper and the office may be in the NL, but they are owned by an American company.
- abbassi 5y agoWhen European states or US talk about democracy, freedom, NSA, Assange, US drones killing children, selling weapons, funding most reactionary regimes, human rights, rearmament, etc. I feel I need to read Lenin again!
- TheGigaChad 5y agoI feel that you should be put in a mass grave with you equally retarded friends.
- streamofdigits 5y agoTo understand the ramifications without geopolitical biases and pink glasses think of the headline: "X spy hacked Y, company stayed silent" where X is any (quasi)state actor that feels agrieved or entitled, and Y is any giant data collector The net as it has come to be used is a fractal of bad design in practically all conceivable ways: economic, social, geo(political)
- aj3 5y agoCounter example where companies didn't stay silent: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora
- jb1991 5y agoThis isn’t surprising to me. I know lots of people who work for this company in the Netherlands, and I’ve heard a lot of inside stories about the questionable business practices that go on there. Starting at the very top, with the fraudulent marketing lies to sell you rooms because there’s only X number of rooms left, which is entirely bogus, and for which the courts have punished them, if I recall. They’re not interested in anything but profit above all else. It is unfortunate, that this is what the tech industry has evolved into.
- kaba0 5y ago> They’re not interested in anything but profit above all else Not disagreeing with you, but why is it a surprise to anyone? Any company that seems to be “nice” is only doing that as a good PR increases their profits, which depending on domain may be very important.
- mckirk 5y agoAny public company, perhaps. Private companies could decide to care about profit not as much and be genuinely 'nice' -- though the invisible hand would probably come along at some point and replace it with something more profit oriented.
- dgb23 5y agoI find it unfortunate that the "invisible hand" is somehow seen as a real force of nature. It's a spooky, ideological term that implies some kind of simple generality describing a system that is everything but simple. Additionally it is used as a bad excuse for exploitative, oppressive or otherwise shitty behavior - which is ironic, because that is exactly the thing that is claimed _not_ to happen by definition. There are real firms in highly competitive markets that have been doing well for decades or even more than a hundred years without putting the profit motive above everything else, but have favored long term stability, cooperation, servicing customers, respecting workers and so on.
- elliekelly 5y agoIt’s not necessarily about PR. Being nice is good business. The problem is being nice is good in the long term while being a greedy bastard generally pays more immediate dividends.
- joe-collins 5y ago> The specific intelligence organization—of which the United States has 18—is unknown. I certainly couldn't have named them all, so I dug up a list: • Air Force Intelligence • Army Intelligence • Central Intelligence Agency • Coast Guard Intelligence • Defense Intelligence Agency • Department of Energy • Department of Homeland Security • Department of State • Department of the Treasury • Drug Enforcement Administration • Federal Bureau of Investigation • Marine Corps Intelligence • National Geospatial-Intelligence Agency • National Reconnaissance Office • National Security Agency • Navy Intelligence • Space Force Intelligence
- samhw 5y agoAll that intelligence and they still can't figure out how to stop a bunch of unemployed basementarians from organising on Facebook to storm one of their principal seats of government... (Sorry for the Twitter-grade comment - but I do sometimes wonder what these people really spend their time doing, that they couldn't catch that one.)
- A4ET8a8uTh0 5y agoI think the assumption that the gathering storm was not noticed by various intelligence agencies is a wrong one. You had to not want to notice some of chatter online and I am talking about publicly available stuff like FB, Imgur and so on; nothing fancy. I think what I am saying is that it was allowed to happen, for one reason or another.
- samhw 5y agoIt feels a bit tin-foil-hattish (I mean: why?), but, aside from my stupefaction at the possible motivation behind why they would do that, logically I find it pretty hard to deny that conclusion. They identify AQ/ISIS plots which are far more competently organised. I have absolutely 0% confidence that they weren't aware of something widely organised on literal Facebook. -- Edit: The only other logical conclusion I can draw is that it was identified, passed up the chain, and then either covered up by someone (in the realm of politics) who did have that intention, or else bumbled (e.g. left on someone's desk and they were simply overloaded / missed it, a bit like the advance warnings relating to 9/11). In that connexion it's interesting to read about the research done into pilot error (https://en.wikipedia.org/wiki/Pilot_error https://en.wikipedia.org/wiki/Pilot_error), and how surprisingly common it is for human beings to simply miss alerts like that. Multiply that by the probable number of people in the chain, and it's not wildly unlikely.
- tchalla 5y agoEvery time I read such articles, I replace the nationalities American with Russian or Chinese just to gauge how the reactions would be.
- tgv 5y agoFor edginess’ sake? While I don’t approve of hacking, I expect American spying to have less damaging results than Chinese or Russian spying.
- hosteur 5y agoWhy?
- nverno 5y agoWould you rather live under the American, Russian, or Chinese government? Probably as simple as that- what's considered damaging in this case likely depends on your preferences.
- angio 5y agoI'd rather not live any under of them, and that's the reason I live in Europe. This is not the first time the US (an ally country) hacked European companies to gather data about European citizens (or in other cases technology).
- stjohnswarts 5y agoIf you think European countries aren't hacking American companies...
- joshgrib 5y agoI think you can both say you'd rather live in the US, and at the same time our intelligence agencies do just as much (if not more) damage worldwide. For example if you live in South America the US is a much bigger risk to you than other countries because they overthrow any govt they don't agree with, regardless of what the people of the country want. Russian spying doesn't seem to result in much damage as far as I can tell, while US spying is regularly used to undermine democracy. If the motto of a country was "we'll keep you safe inside but we'll be treating everyone outside terribly", then you'd definitely rather live inside that country, but it doesn't mean they're less of a risk to the world.
- jacquesm 5y agoIf you're a name with brand recognition, and active in a space that allows effective monitoring and/or eavesdropping on the communications of a large number of people then you can consider yourselves either already hacked or a target of various intelligence services. Also beware of employees that are overly eager to have more access than they should have the 'plant' is a very effective way to gain access to data (support: en detail, ops: en gros). Companies routinely wipe hacks and data leaks under the carpet in the hope that nobody will notice, with the GDPR active they really should stop doing this but it still happens with great regularity.
- mclightning 5y ago> Also beware of employees that are overly eager to have more access than they should Another side of the coin, I always felt shy to ask for access to tools in big corporations that I worked at, unless I am offered access directly by a manager or co-worker directly. This can backfire, if you act too strictly around tools, some employees will never even try to get a hold of the tool you potentially pay 100K$+ a year.
- jacquesm 5y agoAccess to tools is one thing, access to unfiltered large amounts of data (say: production database copies, backups, reporting tools that have themselves unfiltered access) are a real risk and should be handed out with great care and oversight.
- mclightning 5y agoAh true, that I agree %100
- sofixa 5y ago> Companies routinely wipe hacks and data leaks under the carpet in the hope that nobody will notice, with the GDPR active they really should stop doing this but it still happens with great regularity. That's why the DPO is mandatory to have and is personally responsible. From my experience ( MSP/MHP/consultancy with lots of clients), post-GDPR data leaks are taken much more seriously.
- simonswords82 5y agoBooking.com is to hotels what Ticketmaster is to live events. Total scumbags, terrible customer service, over charging, false promises. I might use booking.com to find a hotel but I'll always book direct once I find one.
- sumedh 5y ago> I'll always book direct once I find one. Sometimes booking direct is expensive and the hotels most of them have a shitty website.
- bbarn 5y agoIf any at all.
- hanwenn 5y agoBooking takes a 20% cut of the reservation, so I expect every hotel to gladly you offer a 10% off the booking.com price.
- t8e56vd4ih 5y agothat's just your expectations. booking hotels directly is usually more expensive. why? because they can
- Nasrudith 5y agoAlso because making it cheaper through something gets called a marketing/business expansion opportunity and they don't want to take the haircut when they don't have to.
- nerevarthelame 5y agoYou are correct. Marriott, Hilton, and IHG (and probably others) have price match guarantees, offering 20-25% discount (or a load of reward points) on top off of the cheaper rate that you found. Submitting claims can be a little inconvenient, but it’s worth attempting before booking an expensive trip. Booking through a third party also usually prevents you from receiving loyalty rewards, if that's something you're concerned about. https://www.marriott.com/look/claimForm.mi https://www.marriott.com/look/claimForm.mi https://hiltonworldwide3.hilton.com/en/price-match-guarantee/overview.html https://hiltonworldwide3.hilton.com/en/price-match-guarantee... https://www.ihg.com/content/us/en/customer-care/best-price-guarantee https://www.ihg.com/content/us/en/customer-care/best-price-g...
- greatgib 5y agoSo funny in cases like that when you have the corporate bullshit statement of company like "data protection is our topmost priority" when it is obviously not the case. I think that we need to create a hashtag to associate with all these cases of "obviously not true".
- 1cvmask 5y agoThe Obama administration hacked the world. Let's see when and if the Chinese come to this level.
- kottaram 5y agoI understand the company fucked up but why does the article only talk about the company and not the intelligence agency hacking into companies to get information?
- danguson 5y agoHow can they not report the data breach to their customers? The customers should know about this one because it is their right.
- JohnGB 5y agoThe company's response is very much in line with standard Dutch policy. Unless someone forces you to do something, only do the absolute bare minimum necessary to not go to jail. The common term for this is "zesje" (little six in English), which comes from school and university where it's the bare minimum grade to pass. Anything more than the bare minimum is considered a waste of work. Before any Dutch members get worked up, I'm Dutch.
- huskyr 5y agoBasically the current Dutch policy on covid measures as well i guess.
- JohnGB 5y agoOnly the Dutch Covid response has set a new low bar for complete incompetence and responsibility avoidance.
- arthur_sav 5y agoLean startup but in attitude.
- deleted 5y ago[deleted]
- WaitWaitWha 5y agoI am having little luck to identify the source of attribution to American 'Andrew'. There is very little technical details. Anyone can point me the tech info?
- jc01480 5y agoIs the full analysis posted somewhere?
- rawgabbit 5y agoBooking.com parent company also owns: Priceline, Agoda, Rentalcars.com, KAYAK and OpenTable. It also has "subsidiary brands": Rocketmiles, Fareharbor, HotelsCombined, Cheapflights and Momondo. https://www.bookingholdings.com/about/factsheet/ https://www.bookingholdings.com/about/factsheet/
- smueller1234 5y agoIt's worth noting the while some of the other brands may be more well known in the Americas, Booking.com is actually the vast majority of the business. That's the reason why the parent renamed from "Priceline.com" to "Priceline Group" to "Booking Holdings". (Source: I'm a former employee)
- jamal-kumar 5y agoOne time I found a booking.com lanyard on the ground and wore it and people thought I worked for them so I got free drinks at bars and shit in tropical tourist areas when I said 'yeah!' Before anyone harshes me for this I met a chick with a smirnoff lanyard who was getting free shots without being from them too
- yjftsjthsd-h 5y ago> Before anyone harshes me for this I met a chick with a smirnoff lanyard who was getting free shots without being from them too How does that make anything better?
- kupopuffs 5y agoYeah, now I hate two people instead of one!
- cheeze 5y agoWho cares? Dude got free drinks for wearing a lanyard. This isn't some lesson in morality.
- boomboomsubban 5y agoThe actual act doesn't bother me much, it is the justifying it by saying someone else did it. Imagine if they said "and at the end of the night I was plastered and drove home. But don't harsh me, the Smirnoff lady did it too."
- deleted 5y ago[deleted]
- jamal-kumar 5y agowhat are you, a bartender?
- dekhn 5y agoFrom https://en.wikipedia.org/wiki/Black_Chamber https://en.wikipedia.org/wiki/Black_Chamber "Gentlemen do not read each other's mail."
- mike_d 5y agoHenry Stimson later clarified he only meant close allies. It is also hard to take moral guidance from the guy who oversaw Japanese internment camps in the US and decided to change the city we dropped the atomic bomb on because the original target was where he went on his honeymoon.
- dekhn 5y agoHe changed the target because he convinced Roosevelt that Kyoto was a city of historical importance, not merely because he went there on his honeymoon. That's a dishonest retelling of one of the most important moments in war diplomacy.
- mike_d 5y agoIn Truman's July 25th journal entry he says "I have told the Sec. of War, Mr. Stimson, to use it so that military objectives and soldiers and sailors are the target and not women and children. [...] He and I are in accord. The target will be a purely military one" Implying that Stimson had mislead him to believe that Kyoto should be spared because it was not a military target, when in fact - none were. All 5 potential targets were shortlisted because they were civilian centers and not targets of military value. At that point in the war everything of military value had already been heavily bombed, so they were left with non-strategic targets to show the maximum "before and after" contrast for the test. If anything, Kyoto was the more militarized option. It was a major rail hub between Osaka and Tokyo, as well as hosting the second largest engine factory in Japan. As far as being "one of the most important moments in war diplomacy," it is hard to grant such a title to what amounted to an arbitrary decision to kill the entire population of San Francisco instead of Seattle or Houston. Had we not been the victors, it surely would be called a genocide.