6 ms·

Fast Company is shut down after breach

81 points by jawns 4y ago

Dachande663 4y ago
> We have shut down FastCompany.com until the situation is resolved. Initially read the title as shut down for good.
- mritzmann 4y ago
  That also applies to me. I would welcome it if the title were changed.
- not_good_coder 4y ago
  Same
mattw2121 4y ago
Serving the page with a status of 503 Service Unavailable is an interesting touch.
- rdgthree 4y ago
  Doing this is pretty critical for SEO in a situation like this, and these businesses tend to live and die by search traffic.
  - mattw2121 4y ago
    That's a great point I hadn't considered. I guess they are redirecting all pages to this announcement and, by using a 503, the search results will not be impacted.
    - rickstanley 4y ago
      Even so, maybe a temporary redirect, i.e. 307, would be better maybe?
gunapologist99 4y ago
Fast Company used to be awesome to read back in the dot-com era, like an earlier version of TechCrunch (also formerly great). Back when the Internet was young and anything was possible. What happened to these startup-covering sites? Where did they go wrong (or did they), and are there any replacements? Are successive $100M Series Z rounds from PE funds somehow more interesting than pre-seed investments in scrappy startups?
- fullshark 4y ago
  My guess is the economics of news on the internet were unknown at the time, so people invested in it (willing to eat losses in short term) thinking ad supported news could take off and paid for quality journalism. Now no one is that naive and we have just clickbait factories. Another possibility is due to success of newspapers, the craft of journalism was still known and practiced with skill, these days it's basically just fresh college grads without any on the job training cranking out stuff they read on social media and whatever a PR rep emails them that morning. But that's also related to the economics.
  - deleted 4y ago
    [deleted]
  - ghaff 4y ago
    I don’t know if it would have made a real difference in the end but in spite of some dissenting voices the news industry of the dot com era opened everything up and collectively decided they’d deal with the economics later.
- epc 4y ago
  The same advertising apocalypse that wiped out the early dot coms took out most of the media covering technology (Internet World, Red Herring, etc). Fast Company and Wired went from 100+ pages to really, really thin magazines from 2000 to 2001. Given the combination of wide spread ad blocking and reluctance to pay for subscriptions, why would anyone set their money on fire to cover startups today?
troon-lover 4y ago
karol 4y ago
Who's got the screenshots of the abhorrent messages? Update: https://news.ycombinator.com/item?id=33002991 https://news.ycombinator.com/item?id=33002991
- nailer 4y ago
  Direct link: https://twitter.com/rennettefortune/status/1574919580861988865?s=20&t=PnpycgwVllSm6vJmOpikIQ https://twitter.com/rennettefortune/status/15749195808619888...
iamacyborg 4y ago
Yikes, hopefully this spurs folks in marketing to practice good cyber hygiene when it comes to martech platforms they use.
- gk1 4y ago
  What does this have to do with marketing or martech? My guess is their content management system was breached, allowing the attackers to publish whatever they wanted.
  - iamacyborg 4y ago
    Martech platforms in almost all instances will contain your company's entire customer list and the ability to message them en-masse. Accidents like this are a good reminder that marketers and other folks who can access these systems should be extremely careful.
    - alehlopeh 4y ago
      First time I’ve heard “martech” used. Reading these comments, it seems like “martech” consists of email spam and content management systems. Cool, but I don’t see any differentiator between martech and regular old tech that justifies the existence of martech as a term.
      - iamacyborg 4y ago
        Cool, but martech is an industry worth hundreds of billions of $ annually so I'm not sure your uninformed opinion is all that useful.
- skeeter2020 4y ago
  This feels a lot more like a simple, shared WP password than any sort of sophisticated cyber security
- deleted 4y ago
  [deleted]
webscout 4y ago
bombcar 4y ago
They’re lucky the breacher used such obscene and racist terms so they can complain about that and not draw any attention to using identical easy passwords on various aspects of the site. If the details I saw are correct they did pretty bad initial response, too.
Grustaf 4y ago
If I gained control of a news outlet I would use it to spread false rumours, after taking appropriate positions in the market. Why do hackers waste these opportunities in favour of childish pranks?
- robswc 4y ago
  I imagine that would exponentially increase potential punishments, since "real" money is involved there. I agree though, that would be more interesting, haha.
- mistrial9 4y ago
  Sir Conrad Black, is that you?
- cagenut 4y ago
  they are very frequently children (teenagers)
diehunde 4y ago
I would think iOS has some sort of filter for the push notifications they send, right? They might implement one now
- sofixa 4y ago
  I'm fairly certain I've heard of Firebase Cloud Messages simply refusing push notifications with bad words, which had some ramifications for non-English languages.
- bombcar 4y ago
  They clearly didn't have even a basic one, considering the racist word. Implementing one may be relatively ineffective because if you get blocked you just change up the word by adding spaces, characters, unicode, etc. Clbuttic scenario problem.
- joshstrange 4y ago
  How would that work for chat programs? I mean maybe Apple News could implement that but as far I know normal push notifications have no concept of filtering like that. I don't think pushes are E2E (they can't be, we send them as plain text to the APN endpoints) so Apple could filter but that seems more trouble than it's worth.
retrocryptid 4y ago
or you could hire some security people (including appsec people) who could have told you your WordPress install had some vulnerabilities. just sayin.
- bombcar 4y ago
  The "vulnerability" apparently was depending on a IP block on a systems, and having many accounts with 'pizza123' as the password.
  - retrocryptid 4y ago
    Vulnerabilities are often with wetware running between people's ears.
bombcar 4y ago
Supposedly from Thrax (https://archive.ph/JWwmN https://archive.ph/JWwmN): >I am releasing 6,737 employee records from their WordPress database, among other things such as posts (including unpublished drafts), configurations, and more. We were not able to gain access to customer records as these were likely stored in another database. The data includes emails, password hashes for some users (WordPress format), and a few other things. Hell, I think there's some Auth0 shit hidden somewhere if you want to do anything with that. >The articles are written through a WordPress instance hosted at wp.fastcompany.com - which we found the origin IP of and totally bypassed the HTTP basic auth, leaving us with only WordPress authentication. Thankfully, Fast Company had the ridiculously easy default password of "pizza123" on a dozen accounts, including an administrator account (sorry Amy!), so we got in there really easily. We were able to exfiltrate a BUNCH of sensitive stuff through there - Auth0 tokens, Apple News API keys, Amazon SES secrets (we could literally send email as any @fastcompany.com email with this access), etc. We also found a HTTP basic auth username/password, which happened to work for wp.fastcompany.com, meaning we didn't have to go through hell to access it anymore. We also found a Slack webhook, which we could've used to pull some bullshit, but we didn't want to bother. >Remember the Auth0 I just talked about earlier? Well, they had an access token in WordPress that allowed us to not only grab the email addresses, usernames, and IPs of a bunch of employees, but also create our own account that we gave admin privileges to two portals: Wonton (wonton.fastcompany.com) and the management portal (manage.fastcompany.com). manage.fastcompany.com was under HTTP auth as well, under the exact same username and password as wp.fastcompany.com (in fact, this site is what the credentials were originally for). Once we logged in with our account (which they still haven't deleted after days, by the way), and basically let us do a fuck ton of funny shit such as push notifications to Apple News users, mess with the site, and much more. Wonton was fairly boring, just listing a bunch of bullshit that they hadn't used since 2020-2021.
- cormorant 4y ago
  A hacker statement (part of which matches one of the forum posts you quoted) was posted on the fastcompany.com site (https://web.archive.org/web/20220928010445/https://www.fastcompany.com/90793240/fastcompany-gets-hacked https://web.archive.org/web/20220928010445/https://www.fastc...). The post on the site itself, at least, must indeed have come from the hacker. (Edited my comment with corrections)
aestetix 4y ago
I don't understand why they are apologizing for the racist messages that got posted on their site. They were hacked. We get it, obviously they did not post the messages. Seems to me they should be more sorry to all their users and customers whose data was compromised.

81 points by jawns 4y ago

Dachande663 4y ago

> We have shut down FastCompany.com until the situation is resolved. Initially read the title as shut down for good.

mritzmann 4y ago
That also applies to me. I would welcome it if the title were changed.
not_good_coder 4y ago
Same

mattw2121 4y ago

Serving the page with a status of 503 Service Unavailable is an interesting touch.

rdgthree 4y ago
Doing this is pretty critical for SEO in a situation like this, and these businesses tend to live and die by search traffic.
- mattw2121 4y ago
  That's a great point I hadn't considered. I guess they are redirecting all pages to this announcement and, by using a 503, the search results will not be impacted.
  - rickstanley 4y ago
    Even so, maybe a temporary redirect, i.e. 307, would be better maybe?

gunapologist99 4y ago

Fast Company used to be awesome to read back in the dot-com era, like an earlier version of TechCrunch (also formerly great). Back when the Internet was young and anything was possible. What happened to these startup-covering sites? Where did they go wrong (or did they), and are there any replacements? Are successive $100M Series Z rounds from PE funds somehow more interesting than pre-seed investments in scrappy startups?

fullshark 4y ago
My guess is the economics of news on the internet were unknown at the time, so people invested in it (willing to eat losses in short term) thinking ad supported news could take off and paid for quality journalism. Now no one is that naive and we have just clickbait factories. Another possibility is due to success of newspapers, the craft of journalism was still known and practiced with skill, these days it's basically just fresh college grads without any on the job training cranking out stuff they read on social media and whatever a PR rep emails them that morning. But that's also related to the economics.
- deleted 4y ago
  [deleted]
- ghaff 4y ago
  I don’t know if it would have made a real difference in the end but in spite of some dissenting voices the news industry of the dot com era opened everything up and collectively decided they’d deal with the economics later.
epc 4y ago
The same advertising apocalypse that wiped out the early dot coms took out most of the media covering technology (Internet World, Red Herring, etc). Fast Company and Wired went from 100+ pages to really, really thin magazines from 2000 to 2001. Given the combination of wide spread ad blocking and reluctance to pay for subscriptions, why would anyone set their money on fire to cover startups today?

troon-lover 4y ago

karol 4y ago

Who's got the screenshots of the abhorrent messages? Update: https://news.ycombinator.com/item?id=33002991 https://news.ycombinator.com/item?id=33002991

nailer 4y ago
Direct link: https://twitter.com/rennettefortune/status/1574919580861988865?s=20&t=PnpycgwVllSm6vJmOpikIQ https://twitter.com/rennettefortune/status/15749195808619888...

iamacyborg 4y ago

Yikes, hopefully this spurs folks in marketing to practice good cyber hygiene when it comes to martech platforms they use.

gk1 4y ago
What does this have to do with marketing or martech? My guess is their content management system was breached, allowing the attackers to publish whatever they wanted.
- iamacyborg 4y ago
  Martech platforms in almost all instances will contain your company's entire customer list and the ability to message them en-masse. Accidents like this are a good reminder that marketers and other folks who can access these systems should be extremely careful.
  - alehlopeh 4y ago
    First time I’ve heard “martech” used. Reading these comments, it seems like “martech” consists of email spam and content management systems. Cool, but I don’t see any differentiator between martech and regular old tech that justifies the existence of martech as a term.
    - iamacyborg 4y ago
      Cool, but martech is an industry worth hundreds of billions of $ annually so I'm not sure your uninformed opinion is all that useful.
skeeter2020 4y ago
This feels a lot more like a simple, shared WP password than any sort of sophisticated cyber security
deleted 4y ago
[deleted]

webscout 4y ago

bombcar 4y ago

They’re lucky the breacher used such obscene and racist terms so they can complain about that and not draw any attention to using identical easy passwords on various aspects of the site. If the details I saw are correct they did pretty bad initial response, too.

Grustaf 4y ago

If I gained control of a news outlet I would use it to spread false rumours, after taking appropriate positions in the market. Why do hackers waste these opportunities in favour of childish pranks?

robswc 4y ago
I imagine that would exponentially increase potential punishments, since "real" money is involved there. I agree though, that would be more interesting, haha.
mistrial9 4y ago
Sir Conrad Black, is that you?
cagenut 4y ago
they are very frequently children (teenagers)

diehunde 4y ago

I would think iOS has some sort of filter for the push notifications they send, right? They might implement one now

sofixa 4y ago
I'm fairly certain I've heard of Firebase Cloud Messages simply refusing push notifications with bad words, which had some ramifications for non-English languages.
bombcar 4y ago
They clearly didn't have even a basic one, considering the racist word. Implementing one may be relatively ineffective because if you get blocked you just change up the word by adding spaces, characters, unicode, etc. Clbuttic scenario problem.
joshstrange 4y ago
How would that work for chat programs? I mean maybe Apple News could implement that but as far I know normal push notifications have no concept of filtering like that. I don't think pushes are E2E (they can't be, we send them as plain text to the APN endpoints) so Apple could filter but that seems more trouble than it's worth.

retrocryptid 4y ago

or you could hire some security people (including appsec people) who could have told you your WordPress install had some vulnerabilities. just sayin.

bombcar 4y ago
The "vulnerability" apparently was depending on a IP block on a systems, and having many accounts with 'pizza123' as the password.
- retrocryptid 4y ago
  Vulnerabilities are often with wetware running between people's ears.

bombcar 4y ago

Supposedly from Thrax (https://archive.ph/JWwmN https://archive.ph/JWwmN): >I am releasing 6,737 employee records from their WordPress database, among other things such as posts (including unpublished drafts), configurations, and more. We were not able to gain access to customer records as these were likely stored in another database. The data includes emails, password hashes for some users (WordPress format), and a few other things. Hell, I think there's some Auth0 shit hidden somewhere if you want to do anything with that. >The articles are written through a WordPress instance hosted at wp.fastcompany.com - which we found the origin IP of and totally bypassed the HTTP basic auth, leaving us with only WordPress authentication. Thankfully, Fast Company had the ridiculously easy default password of "pizza123" on a dozen accounts, including an administrator account (sorry Amy!), so we got in there really easily. We were able to exfiltrate a BUNCH of sensitive stuff through there - Auth0 tokens, Apple News API keys, Amazon SES secrets (we could literally send email as any @fastcompany.com email with this access), etc. We also found a HTTP basic auth username/password, which happened to work for wp.fastcompany.com, meaning we didn't have to go through hell to access it anymore. We also found a Slack webhook, which we could've used to pull some bullshit, but we didn't want to bother. >Remember the Auth0 I just talked about earlier? Well, they had an access token in WordPress that allowed us to not only grab the email addresses, usernames, and IPs of a bunch of employees, but also create our own account that we gave admin privileges to two portals: Wonton (wonton.fastcompany.com) and the management portal (manage.fastcompany.com). manage.fastcompany.com was under HTTP auth as well, under the exact same username and password as wp.fastcompany.com (in fact, this site is what the credentials were originally for). Once we logged in with our account (which they still haven't deleted after days, by the way), and basically let us do a fuck ton of funny shit such as push notifications to Apple News users, mess with the site, and much more. Wonton was fairly boring, just listing a bunch of bullshit that they hadn't used since 2020-2021.

cormorant 4y ago
A hacker statement (part of which matches one of the forum posts you quoted) was posted on the fastcompany.com site (https://web.archive.org/web/20220928010445/https://www.fastcompany.com/90793240/fastcompany-gets-hacked https://web.archive.org/web/20220928010445/https://www.fastc...). The post on the site itself, at least, must indeed have come from the hacker. (Edited my comment with corrections)

aestetix 4y ago

I don't understand why they are apologizing for the racist messages that got posted on their site. They were hacked. We get it, obviously they did not post the messages. Seems to me they should be more sorry to all their users and customers whose data was compromised.