16 ms·
Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data
- postepowanieadm 2y ago> leaked 1.1 TiB (1.2 TB) I don't know why but I find this funny.
- Jerrrrry 2y ago[dead]
- Jerrrrrrry 2y agoWould you rather have three fingers and a thumb or seven fingers and a thumb? 70 million year old evolutionary technical debt rearing its head, yet again.
- Jerrrrrrry 2y ago(humans have a number of fingers that isnt a base of two)
- latentsea 2y agoExcept a subset of humans who have been involved in industrial accidents.
- fmj 2y agoDon't forget about birth defects. I went to school with a kid that was born without pinkies, but otherwise completely normal looking hands. You could still tell something was off when you looked at his hands, but it usually took a few seconds for it to register with most people.
- Jerrrrrrry 2y agoHe was an exemption, not an exception.
- latentsea 2y agoAI maybe.
- userbinator 2y agoYou can count to 1023 on them. Although some numbers might be a bit awkward to use.
- Jerrrrrrry 2y agoyou can double that with every physical property you care to add. fingers arent innately binary, you can curl them and point them. wrist orientation relative to the hand and at that point you can count up to 2048 without resorting to too much more than a set of two rules (past instinctual counting)
- robxorb 2y agoPerhaps one day, we can return to the days when a KB was a KB and a MB was a MB. Those grand old days, when we all accepted kilo and mega stretch a little more for computers. Because in binary, base10 metric is a wee bit of a shoehorn. Just a bit.
- SoftTalker 2y agoIt all changed when "normal people" started using computers. 1 KB = 1024 bytes makes perfect sense except to 98% of the world.
- ssl-3 2y ago98% of the world doesn't even know that details like this exist. They never have the opportunity to question the sensibility of one or the other.
- TheCleric 2y agoI think it’s also the SI standards pedants who can’t imagine a kilogram might be a different context than a kilobyte.
- croes 2y agoQuick, how many gibibyte are 1234567890 byte?
- ffsm8 2y agoQuick, how many blocks will 4096 bytes use on my storage device? The argument is that the base10 interval makes no sense with computers, because they're physically base2. You can't really have 10 without wasting 2, and that's why it made sense to use 1024 instead of 1000. Personally I feel the pushback against gibi/mibi/kibi overblown. It's ultimately better to be coherent everywhere and always specify everything with decimals/rounded over random context dependent decisions. But still, the original argument for 1024 made sense too.
- fhars 2y agoYeah, the innumeracy is strong in that one.
- Tokkemon 2y agoAlex has us covered: https://www.youtube.com/watch?v=TCTWyNstpD0&t=55s https://www.youtube.com/watch?v=TCTWyNstpD0&t=55s
- qup 2y agoThe built in video player on Reddit will say 2:21 in the preview, then the video will be 2:22 long
- deleted 2y ago[deleted]
- 1231232131231 2y agoI wonder why there are so few articles considering this happened last night. Also, it's sad how the "insider" (who probably was hacked/RATed) had his SSN and other info leaked :/
- jachee 2y agoAfter the bell on Friday is an infamous time for releasing news you don’t want to be covered.
- SoftTalker 2y agoAgain highlighting the unrecognized liability companies are taking on by logging every scrap of internal communication, no matter how informal or ill-conceived it may be.
- KerrAvon 2y agoIn a very large company like Disney there are often legal data retention requirements from ongoing litigation, which means Corporate Slack might be more complicated than the AT&T customer data breach.
- deleted 2y ago[deleted]
- Zondartul 2y agoWith how big and aggressive Disney is I'd expect it to be under ongoing litigation 24/7/365.
- 05 2y agoProper logging for retention would surely involve a point where you encrypt the data with a temporary key and then encrypt that key with the public key and only your top brass would have access to the HSM that could decrypt that blob..
- nyrikki 2y agoRetention doesn't require it to be online. A tape sitting in Iron mountain would have a smaller attack surface and be compliant. Potentially this breach will allow litigation that was financially infeesable for some people. As a former WDIG employee I am not even suggesting anything concrete or that I have any knowledge of unlawful activity. But as someone who also worked in the electronic evidence discovery field, the cost of blind discovery has a chilling effect on lawsuits. Now that targeted discovery is possible, it will be within the budgets of more potential cases. The forever retention was a marketing differentiator for Slack, so this type of events were a risk you have to accept. But all about convenience and not compliance.
- pylua 2y agoIs it even legal to view that data ?
- falcor84 2y agoWhy would it not be? What data is it illegal to view? Other than perhaps CSAM, which I would strongly hope Disney don't host on their Slack.
- aflag 2y agoYou just gave an example. There are loads of classified information out there. Though Disney will probably not be able to sue you for just reading the data necessarily, doing so is a big liability if you're a competitor or work for a competitor.
- pylua 2y agoI don’t know why it would be illegal, but it feels skeevy. Besides, Disney has a a good legal team — I wouldn’t be surprised if they could find a reason.
- falcor84 2y agoI'm not a lawyer, but I would assume that good lawyers would advise their clients against suing random people on the internet.
- pixl97 2y agoThere are a shortage of good lawyers
- cqqxo4zV46cp 2y agoDisney doesn’t care about you looking at this data dump.
- kelseyfrog 2y agoViewing the data necessary copies it. The data is of course, all Disney IP in the sense that all employee output is the employers intellectual property. Copying Disney IP hasn't historically worked out for folks.
- 486sx33 2y agoSeems like slack has a problem Maybe a dumping tool that uses a stolen api key? Rate limiting and monitoring on slack’s part could help…
- kjkjadksj 2y agoHardly slacks fault. With so many clients and so much money behind that, theres such a big target on their back that shoring up defenses is fundamentally impossible. It’s probably best to just consider such services from such large providers as already compromised, and keep sensitive data off them entirely.
- prng2021 2y agoWhether you’re talking about enterprise file storage, email, or chat messaging software, they all have APIs and/or admin user interface to allow retrieving any and all data to support eDiscovery.
- scherlock 2y agoAll their APIs are rate limited. Disney would have a Grid and with Grids you get data dumps. The feature is normally used for litigation and you need pretty high admin access to get a dump. They either found an exploit or they compromised an Admins account.
- denysvitali 2y agohttps://slack.com/help/articles/12914005852819-Slack-data-loss-prevention https://slack.com/help/articles/12914005852819-Slack-data-lo...
- johndhi 2y agoCan someone explain why hackers dump the files publicly rather than just tell the victim they got access? What's the point?
- beeboobaa3 2y agotechno-anarchism
- thegrim33 2y agoIf you read the article, the answer to your question is in the fourth sentence. There's even an entire section under the headline "Who, Why, and How" that goes into motives.
- walterbell 2y agohttps://www.csoonline.com/article/565048/what-hackers-do-their-motivations-and-their-malware.html https://www.csoonline.com/article/565048/what-hackers-do-the... Financial motivations Nation-state sponsored/cyberwarfare Corporate espionage Hackivists Resource theft Gamer issues Financial theft and nation-state attacks are easily the largest portion of cybercrime. Decades ago, the lone, solitary youth hacker powered by junk food was an adequate representation of the average hacker. They were interested in showing themselves and others that they could hack something or create interesting malware. Rarely did they do real harm. Today, most hackers belong to professional groups, which are motivated by taking something of value, and often causing significant harm. The malware they use is designed to be covert as possible and to take as much of something of value as is possible before discovery.
- guerrilla 2y agoYou missed non-state political motivations. There are plenty of revolutionaries and so-called terrorists around. It appears that this is actually the case here, as it's supposedly about artist's rights.
- walterbell 2y ago> non-state political motivations "hacktivists"?
- karaterobot 2y agoThey should learn opsec from the Disney Vault.
- linuxdude314 2y agoAs someone who literally used to own the digital version of the Disney vault I find this leak highly unlikely what it is claimed to be. Disney doesn’t just use one Slack instance across the whole company and everyone knows to not put pre-release content on my public platforms. Maybe they compromised an instance owned by DTSS (Disneys centralized IT entity), but this would have little to do with Disney Studios like they imply. Its pretty standard in the industry to only store pre-release content on airgapped systems.
- doctorpangloss 2y agoI don't know, the Sony hacks were pretty comprehensive. Why not Disney? Because of some aspirations about imagineers and giant corporations or whatever? They aren't software specialists. The software they sold to other people, like their games business, was kind of a disaster. They don't compete on software. > Its pretty standard in the industry to only store pre-release content on airgapped systems. Unreleased narrative content isn't actually valuable, so nobody actually cares. I mean of course they say it's valuable. But there are aspects of value that are objective, and I am saying objectively, not in some aspirational sense, it's not valuable. And anyway, surely, how did such pre-release content get on such airgapped systems? They have tens of thousands of vendors, and those people talk, and they have ordinary desktop computers. They make mistakes all the time. It doesn't really matter. Their business communications are valuable. So people hacked that. I understand there is a lot of gestural, performative security measures in the industry, I belong to it. At the end of the day, Disney (Hollywood) asks too much from IT for too little money, does not attract talent comparable to a middle-of-the-road Series A startup in San Francisco, and is led by people who don't value technology (on average).
- dagmx 2y agoThe Sony hacks were definitely not comprehensive. They affected the core company but all subsidiaries were left alone. Source: I was an employee at the time and my only data leaked was HR data sent to the primary company.
- KingLancelot 2y ago[dead]
- v3ss0n 2y agoThats for Ruining MCU!
- slowhadoken 2y agoThe spin from Disney is going to be entertaining.
- egypturnash 2y agoI can’t stop giggling at this group’s name.
- deleted 2y ago[deleted]
- roxy9006 2y agoAny news on the contents in terms of unreleased films?
- lopkeny12ko 2y agoI don't understand the situation with the insider (Matthew J Van Andel). Is the implication that he was originally collaborating with the hackers to give them access, then regretted doing so and decided to cut off their access, and the hackers retaliated by doxxing him?
- omgwtfusb 2y agothis video alleges that it might've been because he downloaded an infected mod for a game: https://youtu.be/ZGScvWIyw2E https://youtu.be/ZGScvWIyw2E Not sure why they would dox him, maybe to throw him under the bus after he found out he got pwned and cut them off?
- drexlspivey 2y agoI’d like to know if that’s really how Kathleen Kennedy eats her Linguini.
- matt-attack 2y agoCould you please explain this reference? I know who she is but I don’t get it.
- drexlspivey 2y agoIt’s from South Park https://youtu.be/TWhsjai-OVE?si=i8VAiEZ4kt885xa5 https://youtu.be/TWhsjai-OVE?si=i8VAiEZ4kt885xa5
- hd4 2y agoAnecdotally it feels like there has been an uptick in these high-profile hacks recently, maybe a result of more security people being laid off as a result of companies thinking they would replace everyone with AI?
- sva_ 2y agoPerhaps even hybrid warfare
- layer8 2y agoIf AI is a factor at all, then more likely on the hackers’ side.
- StressedDev 2y agoProbably not - The reason we continue to see attacks is for a couple of reasons: 1) There are very few consequences. At worst, a hacker will get 5-7 years, and the chance of getting caught is low. 2) Security is very very very hard. The defender must get everything right. The attacker only needs to find one flaw. 3) Security does not just depend on security staff. It depends on every software engineer, operations (or devops) engineer, every software dependency, every piece of hardware, etc. If one of these people or dependencies has a problem, the whole system can be cracked. Examples of problems include writing insecure code, getting hacked, not removing old employees from an ACL or group, installing a tool with a back door, etc. The point is security is hard and it depends on people doing the right thing. It's very hard to get people to do the right thing.
- endorphine 2y agoThe reason for this attack is political (in the general sense of the term).
- michaelcampbell 2y ago> The reason for this attack is political (in the general sense of the term). The opening salvo in the article is: >> A self-proclaimed hacktivist group named NullBulge, aiming to “protect artists’ rights and ensure fair compensation for their work,” claims to have breached Disney and leaked 1.1 TiB (1.2 TB) of the company’s internal Slack infrastructure Which seems more financial.
- christkv 2y agoDisney seems to be just shooting themselves in the foot over and over again recently. It will be interesting to see what happens here. Information that leaks could actually impact share price.
- deleted 2y ago[deleted]
- shrubble 2y agoConsidering the social and political controversies that Disney is unvolved in, I would expect a lot of scrutiny of the contents of this link.
- deleted 2y ago[deleted]
- indus 2y agoDark side of API-based access to everything on SaaS where companies have no control. I can’t guard the front door effectively. Nor, I can easily guard the back doors. Will data breaches like these: AT&T, Ticketmaster, and now Disney—-a nail in Security coffins for SaaS?
- werrett 2y agolol. no. besides which all of these hacks would have been prevented by simple, well established controls (eg. MFA everywhere, not hoarding every scrap of customer data and internal comms). so all of those basics are going to magically happen when you move your data on-prem?
- nerdponx 2y agoAlso the above-mentioned SaaS customers will face no negative consequences from investors or otherwise, just some bad press that will be forgotten quickly and amount to nothing. It's great if your SaaS vendor gets hacked and not you: it spreads blame around in the eyes of the public, and makes it harder for legislators, regulators, and plucky DAs to come after you.
- ziofill 2y agoIt's clear that 1Tb is a lot of data, but I would have expected more from Disney's slack?
- femou 2y agoAccording to the hackers they lost access so it's possible there's more data that wasn't gathered in time
- az226 2y agoThis is going to be a anti-DEI treasure trove. The unsaid things will be shown to have very much been said.
- ngetchell 2y agoWill it?
- TacticalCoder 2y agoWell it seems like a huge leak. And if there's a place where there are illegal, woke, decisions taken it's Disney. For example there's a Disney exec who's been recently caught by an undercover journalist, on video, saying "we don't hire white men as such positions". It is discrimination and it's totally illegal. I do personally find the "wokeness" of Disney also shows in their cartoons (it's just an opinion but several have that same opinion). So for such things to happen, there may be a company culture of wokism in place at Disney. If there's such a company culture and seen the size of the leak, it's very possible that they've been so dumb as to openly discuss how to be anti-white (e.g. both in hiring practices and in picking fictional characters) on their slack channels. To paraphrase a well-known meme: *"You never go full woke: Disney went full woke".
- amanaplanacanal 2y agoWhat do you mean by “woke”, exactly?
- Cornbilly 2y agoGiven the contexts I most commonly see it used in, I think it means “having empathy for someone outside my identity group”.
- whatthesmack 2y agoIt's not empathy when a person is passed over for a role because of their skin color due to unwritten HR policies, and people using the word "woke" are generally referencing the unethical and illegal aspects of such policies.
- KomoD 2y agoThis is the same group that put malware in ComfyUI_LLMVISION and said they were against crypto but then extorted people for crypto. (ComfyUI_LLMVISION is probably what caused this breach)
- 90210 2y agowhere can i actually read it
- 93po 2y agoi would like this too, i don't think it's going to be easily found on some website though, Disney will sue the owner out of existence
- Torz 2y ago[dead]
- matrix12 2y agohttps://nullbulge.se/blog.html https://nullbulge.se/blog.html