11 ms·

Researcher finds flaw in a16z website that exposed some company data

552 points by udev4096 2y ago

xyst 2y ago
when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”
- miki123211 2y ago
  If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed. There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed.
  - deleted 2y ago
    [deleted]
    - deleted 2y ago
      [deleted]
  - bobmcnamara 2y ago
    More like complaining when your teenager takes a break from mowing on trash day and leaves the mower next to the trash and someone takes it.
  - crngefest 2y ago
    If you put all your stuff on your front porch with a sign “please take what you want” and it’s all gone the next day - then you can’t say you were robbed. I think this is a more apt analogy to what az16 did here
    - qup 2y ago
      More like if they kept their wallets in an open basket on the porch. It's not an invitation to take it, it's just really stupid.
      - crngefest 2y ago
        Yes that would have been a much better analogy.
    - sparky_z 2y ago
      There's no analog for the sign. You just put it in because without it your scenario still feels like theft (because it is) and you end up arguing against your own point.
      - crngefest 2y ago
        That is fair enough, I guess it’s not a great analogy overall. But IMHO it’s hard to feel to bad for someone (az16 in this case) who handles their arguably most valuable goods in such a manner and gets robbed.
    - rblatz 2y ago
      Using those credentials is still a violation of the he CFAA, no reasonable person would think they were invited to access the systems protected by those credentials.
      - pixl97 2y ago
        Yea, I'm sure the Russian/China/NK/Iran hackers are deeply afraid of the CFAA, you got them shaking dude (and vice versa when someone in the US hacks one of their sites). The particular problem here is we think of the crime on the web in a civil/criminal manner... "People should just follow the law or be punished for a crime". This is not the internet. Regardless of what you think about the internet, it is an international war zone. If you leave the hatch of a tank open and a drone blows it up, that was you being stupid. If you leave an ammunition truck unguarded and the enemy takes it, again, that is you being stupid. History will look back and say WWIII started on the web, but as of now it seems a huge number of people are in denial about it.
  - malf 2y ago
    If I leave other people’s stuff that I promised to take care of on the street and it gets stolen, I would be to blame.
    - s1artibartfast 2y ago
      blame isn't mutually exclusive. you can still blame the person that stole it too!
  - rootusrootus 2y ago
    > might have some impact on whether the act was illegal or not Only the burglary, trespassing, or B&E parts. Theft is still theft even if you leave your doors unlocked and/or open.
  - oasisbob 2y ago
    Well, other legal distinctions aside, robbery is taking things by threat of force. If someone doesn't know they've been a victim of larceny until later, it wasn't a robbery.
  - cromulent 2y ago
    Good analogy, from a personal perspective. In this case, a person was yelling through the front door "Your door is wide open!" and no-one was listening. For a 42B AUM company, at a time where running an IT operation means "use CrowdStrike so that you pass audits", leaving the front door open all night should get you fired, regardless of whether you blame hackers or not.
  - svnt 2y ago
    A website is not a house. It is nothing like a house. There is no front door. There is no lock. There is no expectation of privacy. There are only things you can access and things you cannot. There is nothing inappropriate about trying to open the bathroom window from the outside. If I wanted to try to use such a weak analogy, the analogy to hacked is not robbed. You were only robbed if content was removed and exclusively held by someone else, which in the security world we call a ransom. You can see how quickly this breaks down.
Drakim 2y ago
> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties will have to be reported publicly which means you don't need to pay anything.
- bufferoverflow 2y ago
  But it also teaches security researchers to sell that info next time instead of reporting.
  - reducesuffering 2y ago
    Seriously, if anyone from a16z is reading this, all you're doing is incentivizing the next exploit to be sold and used against you.
- chefandy 2y ago
  All sorts of cleverness going on there. I'll bet they saved a ton of money on development by lowballing people on fiverr or whatever they did, and indirectly they'll also save a ton on bookkeeping when a russian ransomware group effortlessly takes them for everything they have.
  - HelloNurse 2y ago
    Even more bookkeeping will be saved with lost business opportunities.
  - cqqxo4zV46cp 2y ago
    With all the money a16z funnelling into the Trump campaign as it is, yada yada, I’m too lazy to make the rest of the line.
- nlh 2y ago
  Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)
tux3 2y ago
>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears to my eyes.
- bdowling 2y ago
  [flagged]
  - Retr0id 2y ago
    That's not what happened at all, and the article you link doesn't say that.
  - gcbirzan 2y ago
    Actually, they posted that a vulnerability existed, https://x.com/xyz3va/status/1807330215955177937 https://x.com/xyz3va/status/1807330215955177937: > someone from @a16z get in touch, now. its bad. security related
    - bdowling 2y ago
      What's the relevant difference?
      - gcbirzan 2y ago
        I don't remember what your post originally said, but posting about a vulnerability is not the same as disclosing the vulnerability. Especially when you're asking for a contact. The difference, in case you really want to know is that one actually tells everyone what the issue is, another tells everyone that there is an issue.
    - londons_explore 2y ago
      So they didn't disclose the bug publically... They simply disclosed that there was a bug. That isn't IMO disclosure. Nearly anything has a bug if you look hard enough.
ent101 2y ago
When we released our open-source project[1], this hacker (Eva) pentested our project pretty extensively and was very professional in their disclosures. They didn't even ask for a bounty since we didn't have a program back then! Eva is an incredibly gifted hacker and a responsible one, a16z should treat them better. [1]: https://github.com/heyPuter/puter/ https://github.com/heyPuter/puter/
JCharante 2y ago
I agree that the bounty outcome is unfair.
Havoc 2y ago
Pretty shitty to not even give a token amount bounty for such a broad hole
- spyspy 2y ago
  The next time someone finds their keys, they're going to find this article and commit them to a public github repo instead...
  - Deathmax 2y ago
    You don't want to push secrets in their raw form on GitHub, secret scanning would disable keys from supported providers.
    - pixl97 2y ago
      Yea, they aren't going up on GH, they are going up on sketchy-site . ru
    - fragmede 2y ago
      that's the point
  - deleted 2y ago
    [deleted]
wouldbecouldbe 2y ago
I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of money for a pen test with one of the big consultancy companies but they also didn’t see it. I ended up finding it and checking the logs seems like it wasn’t abused but it was shocking and a big leak
- IshKebab 2y ago
  > it was in their docs. So not blaming them. We glossed over it. You should be blaming them. You can't excuse dangerous behaviour by documenting it. I feel like this lesson should be known by now.
  - suzzer99 2y ago
    If the panel setting was specifically for API keys, then yes, that's on apostrophecms. If it's just some kind of generic settings with name/value pairs, then it might make sense to expose those to the browser, and make that very clear up front.
    - wouldbecouldbe 2y ago
      Yeah you can define extra global settings extending the existing fields, so we used that for our multi tenancy solution. And is available on the node side of things as well as on the frontend.
  - spookie 2y ago
    We always need to do our due diligence when using someone else's project. It's an open source project, available for free. If they weren't very clear in the docs is one thing, but it doesn't appear so. Anyway, we won't combat these types of shenanigans by assuming others did everything up to snuff. We gotta be more careful ourselves.
ko_pivot 2y ago
Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.
- cedws 2y ago
  Don’t mistake complexity for intelligence.
- krig 2y ago
  I’ve seen people make exactly this mistake with Next.js. IMO React server components is a fantastic tool for losing track of what’s exposed client side and what isn’t.
  - duggan 2y ago
    Next.js makes you prefix env vars with NEXT_PUBLIC_ if you want them to be available client side, and Vercel has warning flags around it when you paste in those keys. It's obviously not foolproof, but it's a good effort.
    - krig 2y ago
      That’s env vars, but not actual variables - it’s really easy (if you are not actively context aware) to f.ex. pass a ”user” object from a server context into a client component and expose passwords etc to the client side.
      - duggan 2y ago
        That's a fair point! It definitely feels easier to make that mistake, and anything where context and discipline is required is a good candidate for making some horrifying blunders :)
      - leerob 2y ago
        If you add `import “server-only”` to the file, it will fail to compile if you to use it on the client. React also has more fine grained options where you can “taint” objects (yes that’s the real name).
ai4ever 2y ago
they are busy writing a giant "architecture of generative AI" whitepaper. give them a pause, they are dreaming a future agentic world of half-assed chatbots. while the world burns with botched software updates.
- xyst 2y ago
  world is already burning with effects of climate change. botched software updates on a Friday is just the chef’s kiss
- stefan_ 2y ago
  > engineering@a16z.com bounced my emails No surprise there.
davedx 2y ago
Maybe they should have installed CrowdStrike
- avery17 2y ago
  Cant get hacked if youre bluescreened.
quantified 2y ago
Isn't it fairly easy to get an address like marca's? I'm sure anyone who is responsible for the place would make the connection to IT security.
ilrwbwrkhv 2y ago
Crypto bullshit - a16z pipeline is a great reflection of a16z as a firm.
xyst 2y ago
When I create a new service and add LetsEncrypt cert to server via ACME. I immediately see logs filled with junk, obviously bots searching for shitty defaults that devs might leave open. I have even seen requests for the process env file lol. How was such vuln not found and abused in this case? a16z is very lucky or maybe it was abused and not disclosed. Researcher or bored person with a kind heart/white hat hacker mindset is the first to reach out. a16z should be fined heavily unfortunately there is no legal framework for this type of negligence
- Quarrel 2y ago
  > How was such vuln not found and abused in this case? Maybe it was.. There might have been more value in leaving this one open than just screwing with them.
- wouldbecouldbe 2y ago
  To be fair, their main site doesn't seem super interesting. Couple of those credentials, such as OKTA seem bad though.
cj 2y ago
If you could actually access their Salesforce instance, that would be very nerve wracking for founders, since usually Salesforce, etc, logs emails which may continue unannounced fundraising plans or M&A plans that haven’t been shared externally by portfolio company founders.
- Quarrel 2y ago
  It would also be pretty damaging if it includes their LPs.
- rvnx 2y ago
  Collecting the keys from a public source-code of a web page is legal (and can be safely reported). Using these keys to access unauthorized systems is a crime. This is a major difference.
  - pixl97 2y ago
    Oh no CRIME! Thank goodness that something being a crime stops people from committing them. Thank goodness the internet isn't an international operation filled with nation state level actors and questionable companies running data gathering operations from places they cannot be touched. Always assume your data has been stolen by an assailant in a place that's only reachable by launching nukes at them. Also assume there is some competitor on the other side of the world now using your data against you. Please stop treating data theft like Barney Fife level candy store theft. A huge portion of the time even if you know the name of the exact person who did it, there isn't going to be shit you can do about it.
  - devin 2y ago
    Parent comment never suggested it was legal. They said it would be bad if this info was in their SalesForce and they leaked the key, which they did.
  - mcfedr 2y ago
    How can it possibly be a crime? They literally gave the keys to everyone who accessed their website
xg15 2y ago
[flagged]
- crngefest 2y ago
  Well it could be this person that is professional and does not sell all your data to North Korean ransomware gangs - or it could be the one that does. Which one do you prefer?
  - Lvl999Noob 2y ago
    I (we) would obviously prefer the professional person who is doing good for society. The problem is, this behaviour isn't good for them. I am not an expert or anything but from what I know, pentesting without explicit prior permissions can easily lead to huge lawsuits. I would rather that the careless people get their cars stolen than the good people all lose heart completely.
    - crngefest 2y ago
      Sure there is no perfect solution here. I guess it’s a good idea to only pentest companies that do have a bug bounty program and an expressed interest in you pentesting. While I enjoyed the article that GP referenced and agreed with most thing I thought the “hacking bad” take was a bit off.
    - fermisea 2y ago
      One thing is true about what you said: you're definitely not an expert.
- awesomeMilou 2y ago
  And so you're just going to dismiss the modern reality of cybersecurity threats? "What happened to the good old days when we could all leave our cars and homes unlocked.." Yeah no.
  - account42 2y ago
    > What happened to the good old days when we could all leave our cars and homes unlocked.. That is actually a really good question you should be asking. Also when it comes to computers.
asopd 2y ago
I'm surprised he didn't try harder to contact someone in the company privately. Surely any contact would have sufficed to at least try to get an introduction to their security team? If you browse their website there are loads of email addresses for various offices and divisions.
localfirst 2y ago
> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. I just don't understand this petty attitude. This almost guarantees next time somebody that finds vulnerability with a16z or any of its companies to seek black market rewards that will do far more damage. This is just like when KakaoTalk refused to payout bug bounty because you had to be a Korean citizen which ended up causing more vulnerabilities to be discovered in the wild. Companies and billionaires reading this, please don't be petty like Andreesen. Guy went from a leader to a borderline security fraud artist. You don't want to be earning more ire from the public in the current political climate. It's dangerous.
kva 2y ago
Hopefully Martin Casado or one of the other awesome open source folks from a16z will take a look at this and make the person whole!
- account42 2y ago
  The person is whole as nothing was taken from them. If you choose to do free work you are not owed anything.
Capricorn2481 2y ago
From the techcrunch article: > “On June 30th, a16z addressed a misconfiguration in a web app that is used for the specific use case of updating publicly available information on our website such as company logos and social media profiles. The issue was resolved quickly and no sensitive data was compromised,” What the fuck is this? They are blatantly lying here. There was a lot of sensitive data compromised. Anyone who inspected the site could have had access to everyones emails.
- lazzlazzlazz 2y ago
  How do you know that? Both quotes seem to explain why what you're saying isn't true.
  - Capricorn2481 2y ago
    If anyone could view any of those secrets and access emails, then sensitive data was exposed. They can't just decide it wasn't exposed because no one else told them about this.
    - lazzlazzlazz 2y ago
      Couldn't it be the case that the secrets were not useful for accessing sensitive emails? Their response made it sound like the secrets were limited to a specific, limit-used app.
      - Capricorn2481 2y ago
        I'm just going off what the hacker said. > the compromised list of services: > their database (containing PII) > their AWS > their salesforce (never checked, account may be limited) > mailgun (arbitrary emails from a16z domains, and also could read older emails) > ... and probably more
j-bos 2y ago
The fact that this VC firm didn't provide bug bounty for such a gaping hole does not instill trust.
- renewiltord 2y ago
  Yes, if they can’t do web development what does that say about their ability to deploy capital?
  - pavel_lishin 2y ago
    If my endodontist can't rebuild a car engine, what does that say about his ability to perform a root canal? Turns out, not much.
    - kjkjadksj 2y ago
      Not a great analogy. Its more like if your endodontist hired a secretary who leaves the medical records unlocked, do you really trust them to be up to date with modern dental sensibilities when the rest of their office is ran so carelessly?
- archagon 2y ago
  Unsurprising given that the founders are Trumpists now: https://siliconangle.com/2024/07/17/co-founders-andreessen-horowitz-giving-full-support-trump-campaign/ https://siliconangle.com/2024/07/17/co-founders-andreessen-h...
  - notfed 2y ago
    Billionaires like tax cuts for billionaires; go figure.
    - TeaBrain 2y ago
      According to the article, the decision to back him was due to the 2025 tax plan to tax unrealized gains, which I hadn't heard of, but I'm not surprised that he wouldn't be a fan of that, given that his entire business is built on investing in companies, and that these investments on the part of founders and investors are unrealized. It does seem like it would de-incentivize much of the startup and venture capital economy.
nuz 2y ago
I like lower case tweets and texts but lower case in articles like this is just ridiculous (and trying too hard to be cool)
llmblockchain 2y ago
It's pretty shocking how many commenters are blaming the individual for not "trying harder" to find contact information. It's pretty clear a16z didn't want to pay anything or appreciate the disclosure at all. Finding random email addresses and sending them a notice would have gone no where other than spam folders. I get dozens of "disclosures" every week from mostly script kiddies that think my DKIM setting is somehow going to be the end of my business. My brain automatically ignores emails like it.
- deleted 2y ago
  [deleted]
- mrcode007 2y ago
  I’m surprised there is almost no discussion about the severity of reputational damage caused by an extremely amateur bug not expected of a prominent VC firm
  - llmblockchain 2y ago
    Yes... In my mind, there are three kinds of security bugs. 1. Caused by pure ignorance and completely avoidable (this bug). 2. Caused by subtle configurations, workflows, programming (mostly avoidable, secret scanning, security linters, code reviews, general intelligence, etc). This is where 99% of security bugs are. 3. Caused by a malicious actor aligning planets with a single intent to maximize their cause. You'll never stop these people (three letter agencies, state actors). edit: A must watch talk https://vimeo.com/95066828 https://vimeo.com/95066828
  - altthrow24 2y ago
    Probably because a16z reputation has already been quite tarnished in recent years. This is par for the course. People will still take their massive bags of money and name brand boost but "these are smart, technical, 'making the world a better place' visionaries" as opposed to wealth chasing bankers, has already run the gamut. See crypto, Clubhouse, "it's time to build [not in my Atherton neighborhood]", e/acc Nick Land manifesto, Trump '24 support, etc.
deleted 2y ago
[deleted]
hpen 2y ago
Wait, do hackers feel entitled to money for finding security holes, even if there was never any signal of such reward?
- hpen 2y ago
  Ha my actual question was downvoted. I guess people are as entitled as they say.
  - hpen 2y ago
    Actually, I think entitlement is the wrong word. Maybe more like "window washing panhandler who's upset because you don't give them money for their service"
hedora 2y ago
Neko! https://en.wikipedia.org/wiki/Neko_%28software%29 https://en.wikipedia.org/wiki/Neko_%28software%29 The Wikipedia article is missing the implementation in the article. Too bad they don't pay bounties. ^ ^ 0 - * -
very_good_man 2y ago
how do I disable the cat following my cursor animation on your website? how insanely distracting
- neilv 2y ago
  uBlock Origin -> Dashboard -> My Filters -> add the line: ||www.kibty.town/files/js/oneko.js^$important
deleted 2y ago
[deleted]
paxys 2y ago
Stuff like this is what gives the entire security and white hat community a bad name. 1. "Surprise pentests" are illegal in the US and pretty much every jurisdiction in the world. If you are actively breaking into websites without a prior agreement, you are not doing anyone a favor. Save your efforts for companies that actually want you. 2. If the company doesn't have a published bug bounty program, they don't owe you anything. Yes they can still be nice and pay you, but they definitely won't if you disclose the vulnerability to the rest of the world without giving them a heads up and enough time to fix it. 3. "Oh I couldn't find an email address" is the worst excuse in the world. I found one after exactly 5 seconds of Googling (at the bottom of https://a16z.com/connect https://a16z.com/connect). And even otherwise there's Twitter, Instagram, LinkedIn and a hundred other ways to reach someone at the company if you really want to. This is classic case of clout chasing over responsible disclosure.
- pavel_lishin 2y ago
  > If you are actively breaking into websites They viewed the source code. Despite what the governor of Missouri[1] thinks, that's not hacking. [1]: https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code https://www.theverge.com/2021/12/31/22861188/missouri-govern...
  - csmpltn 2y ago
    > They viewed the source code. No. "i like to do this thing where i search twitter, looking for companies, and then try giving them a quick pentest" "the compromised list of services: their database (containing PII), their AWS, their salesforce (never checked, account may be limited), mailgun (arbitrary emails from a16z domains, and also could read older emails) ... and probably more" By their own admission, this is a "pentest", and they were able to access a16z's "database" and ascertain that it contains PII. Amongst other services used by a16z. I'm not the one to judge whether they crossed any legal (or moral) lines though.
deleted 2y ago
[deleted]
udev4096 2y ago
The HN mods changed the title to a less embarrassing one. Not surprised
- tux3 2y ago
  Oh, my comment must have been too critical of a16z as well. I see it has been moved from top to way bottom without a score change. That's certainly one way to offer a response!
cromulent 2y ago
It's really hard to generate "all due respect" for a16z.
janjones 2y ago
https://archive.is/Wk6OO https://archive.is/Wk6OO
throw16z 2y ago
even web3 could protect a16z ugh, thats very bad
sourcecodeplz 2y ago
Too much javascript for everything (front & back) seems easy but for new developers it kind of blurs the lines between what should be on the server vs the client.
qwertox 2y ago
That's what security.txt is there for. They don't even have a robots.txt file.
deleted 2y ago
[deleted]
notfed 2y ago
> i publicly reached out Means what exactly? What information did your public reach-out include? EDIT: Ah, I think it's a tweet that said: > someone from @a16z get in touch, now. its bad. security related. Lol, ok. I guess they don't want anyone to know they had a security vuln. I wonder if they make you sign an NDA too when you get the bounty.
helic 2y ago
Why does this read like a 9 year old TikToker wrote it? This reads like some little script kiddie who runs fuzzing tools (and can't make any of their own) ranting online unprofessionally.
QkPrsMizkYvt 2y ago
Question to the community. I managed to expose all customer data of a well-funded D2C brand and when I reached out to them I did not ask for bounty before I shared the fix/the security hole. I only got a 200 USD gift card for their shop :D What is best practice here? Do you first tell the company that they have a security issue, ask for bounty and then help? Is that unethical? Blackmail?
Donaldkenneth 2y ago
[dead]

552 points by udev4096 2y ago

xyst 2y ago

when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”

miki123211 2y ago
If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed. There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed.
- deleted 2y ago
  [deleted]
  - deleted 2y ago
    [deleted]
- bobmcnamara 2y ago
  More like complaining when your teenager takes a break from mowing on trash day and leaves the mower next to the trash and someone takes it.
- crngefest 2y ago
  If you put all your stuff on your front porch with a sign “please take what you want” and it’s all gone the next day - then you can’t say you were robbed. I think this is a more apt analogy to what az16 did here
  - qup 2y ago
    More like if they kept their wallets in an open basket on the porch. It's not an invitation to take it, it's just really stupid.
    - crngefest 2y ago
      Yes that would have been a much better analogy.
  - sparky_z 2y ago
    There's no analog for the sign. You just put it in because without it your scenario still feels like theft (because it is) and you end up arguing against your own point.
    - crngefest 2y ago
      That is fair enough, I guess it’s not a great analogy overall. But IMHO it’s hard to feel to bad for someone (az16 in this case) who handles their arguably most valuable goods in such a manner and gets robbed.
  - rblatz 2y ago
    Using those credentials is still a violation of the he CFAA, no reasonable person would think they were invited to access the systems protected by those credentials.
    - pixl97 2y ago
      Yea, I'm sure the Russian/China/NK/Iran hackers are deeply afraid of the CFAA, you got them shaking dude (and vice versa when someone in the US hacks one of their sites). The particular problem here is we think of the crime on the web in a civil/criminal manner... "People should just follow the law or be punished for a crime". This is not the internet. Regardless of what you think about the internet, it is an international war zone. If you leave the hatch of a tank open and a drone blows it up, that was you being stupid. If you leave an ammunition truck unguarded and the enemy takes it, again, that is you being stupid. History will look back and say WWIII started on the web, but as of now it seems a huge number of people are in denial about it.
- malf 2y ago
  If I leave other people’s stuff that I promised to take care of on the street and it gets stolen, I would be to blame.
  - s1artibartfast 2y ago
    blame isn't mutually exclusive. you can still blame the person that stole it too!
- rootusrootus 2y ago
  > might have some impact on whether the act was illegal or not Only the burglary, trespassing, or B&E parts. Theft is still theft even if you leave your doors unlocked and/or open.
- oasisbob 2y ago
  Well, other legal distinctions aside, robbery is taking things by threat of force. If someone doesn't know they've been a victim of larceny until later, it wasn't a robbery.
- cromulent 2y ago
  Good analogy, from a personal perspective. In this case, a person was yelling through the front door "Your door is wide open!" and no-one was listening. For a 42B AUM company, at a time where running an IT operation means "use CrowdStrike so that you pass audits", leaving the front door open all night should get you fired, regardless of whether you blame hackers or not.
- svnt 2y ago
  A website is not a house. It is nothing like a house. There is no front door. There is no lock. There is no expectation of privacy. There are only things you can access and things you cannot. There is nothing inappropriate about trying to open the bathroom window from the outside. If I wanted to try to use such a weak analogy, the analogy to hacked is not robbed. You were only robbed if content was removed and exclusively held by someone else, which in the security world we call a ransom. You can see how quickly this breaks down.

Drakim 2y ago

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties will have to be reported publicly which means you don't need to pay anything.

bufferoverflow 2y ago
But it also teaches security researchers to sell that info next time instead of reporting.
- reducesuffering 2y ago
  Seriously, if anyone from a16z is reading this, all you're doing is incentivizing the next exploit to be sold and used against you.
chefandy 2y ago
All sorts of cleverness going on there. I'll bet they saved a ton of money on development by lowballing people on fiverr or whatever they did, and indirectly they'll also save a ton on bookkeeping when a russian ransomware group effortlessly takes them for everything they have.
- HelloNurse 2y ago
  Even more bookkeeping will be saved with lost business opportunities.
- cqqxo4zV46cp 2y ago
  With all the money a16z funnelling into the Trump campaign as it is, yada yada, I’m too lazy to make the rest of the line.
nlh 2y ago
Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

tux3 2y ago

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears to my eyes.

bdowling 2y ago
[flagged]
- Retr0id 2y ago
  That's not what happened at all, and the article you link doesn't say that.
- gcbirzan 2y ago
  Actually, they posted that a vulnerability existed, https://x.com/xyz3va/status/1807330215955177937 https://x.com/xyz3va/status/1807330215955177937: > someone from @a16z get in touch, now. its bad. security related
  - bdowling 2y ago
    What's the relevant difference?
    - gcbirzan 2y ago
      I don't remember what your post originally said, but posting about a vulnerability is not the same as disclosing the vulnerability. Especially when you're asking for a contact. The difference, in case you really want to know is that one actually tells everyone what the issue is, another tells everyone that there is an issue.
  - londons_explore 2y ago
    So they didn't disclose the bug publically... They simply disclosed that there was a bug. That isn't IMO disclosure. Nearly anything has a bug if you look hard enough.

ent101 2y ago

When we released our open-source project[1], this hacker (Eva) pentested our project pretty extensively and was very professional in their disclosures. They didn't even ask for a bounty since we didn't have a program back then! Eva is an incredibly gifted hacker and a responsible one, a16z should treat them better. [1]: https://github.com/heyPuter/puter/ https://github.com/heyPuter/puter/

JCharante 2y ago

I agree that the bounty outcome is unfair.

Havoc 2y ago

Pretty shitty to not even give a token amount bounty for such a broad hole

spyspy 2y ago
The next time someone finds their keys, they're going to find this article and commit them to a public github repo instead...
- Deathmax 2y ago
  You don't want to push secrets in their raw form on GitHub, secret scanning would disable keys from supported providers.
  - pixl97 2y ago
    Yea, they aren't going up on GH, they are going up on sketchy-site . ru
  - fragmede 2y ago
    that's the point
- deleted 2y ago
  [deleted]

wouldbecouldbe 2y ago

I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of money for a pen test with one of the big consultancy companies but they also didn’t see it. I ended up finding it and checking the logs seems like it wasn’t abused but it was shocking and a big leak

IshKebab 2y ago
> it was in their docs. So not blaming them. We glossed over it. You should be blaming them. You can't excuse dangerous behaviour by documenting it. I feel like this lesson should be known by now.
- suzzer99 2y ago
  If the panel setting was specifically for API keys, then yes, that's on apostrophecms. If it's just some kind of generic settings with name/value pairs, then it might make sense to expose those to the browser, and make that very clear up front.
  - wouldbecouldbe 2y ago
    Yeah you can define extra global settings extending the existing fields, so we used that for our multi tenancy solution. And is available on the node side of things as well as on the frontend.
- spookie 2y ago
  We always need to do our due diligence when using someone else's project. It's an open source project, available for free. If they weren't very clear in the docs is one thing, but it doesn't appear so. Anyway, we won't combat these types of shenanigans by assuming others did everything up to snuff. We gotta be more careful ourselves.

ko_pivot 2y ago

Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.

cedws 2y ago
Don’t mistake complexity for intelligence.
krig 2y ago
I’ve seen people make exactly this mistake with Next.js. IMO React server components is a fantastic tool for losing track of what’s exposed client side and what isn’t.
- duggan 2y ago
  Next.js makes you prefix env vars with NEXT_PUBLIC_ if you want them to be available client side, and Vercel has warning flags around it when you paste in those keys. It's obviously not foolproof, but it's a good effort.
  - krig 2y ago
    That’s env vars, but not actual variables - it’s really easy (if you are not actively context aware) to f.ex. pass a ”user” object from a server context into a client component and expose passwords etc to the client side.
    - duggan 2y ago
      That's a fair point! It definitely feels easier to make that mistake, and anything where context and discipline is required is a good candidate for making some horrifying blunders :)
    - leerob 2y ago
      If you add `import “server-only”` to the file, it will fail to compile if you to use it on the client. React also has more fine grained options where you can “taint” objects (yes that’s the real name).

ai4ever 2y ago

they are busy writing a giant "architecture of generative AI" whitepaper. give them a pause, they are dreaming a future agentic world of half-assed chatbots. while the world burns with botched software updates.

xyst 2y ago
world is already burning with effects of climate change. botched software updates on a Friday is just the chef’s kiss
stefan_ 2y ago
> engineering@a16z.com bounced my emails No surprise there.

davedx 2y ago

Maybe they should have installed CrowdStrike

avery17 2y ago
Cant get hacked if youre bluescreened.

quantified 2y ago

Isn't it fairly easy to get an address like marca's? I'm sure anyone who is responsible for the place would make the connection to IT security.

ilrwbwrkhv 2y ago

Crypto bullshit - a16z pipeline is a great reflection of a16z as a firm.

xyst 2y ago

When I create a new service and add LetsEncrypt cert to server via ACME. I immediately see logs filled with junk, obviously bots searching for shitty defaults that devs might leave open. I have even seen requests for the process env file lol. How was such vuln not found and abused in this case? a16z is very lucky or maybe it was abused and not disclosed. Researcher or bored person with a kind heart/white hat hacker mindset is the first to reach out. a16z should be fined heavily unfortunately there is no legal framework for this type of negligence

Quarrel 2y ago
> How was such vuln not found and abused in this case? Maybe it was.. There might have been more value in leaving this one open than just screwing with them.
wouldbecouldbe 2y ago
To be fair, their main site doesn't seem super interesting. Couple of those credentials, such as OKTA seem bad though.

cj 2y ago

If you could actually access their Salesforce instance, that would be very nerve wracking for founders, since usually Salesforce, etc, logs emails which may continue unannounced fundraising plans or M&A plans that haven’t been shared externally by portfolio company founders.

Quarrel 2y ago
It would also be pretty damaging if it includes their LPs.
rvnx 2y ago
Collecting the keys from a public source-code of a web page is legal (and can be safely reported). Using these keys to access unauthorized systems is a crime. This is a major difference.
- pixl97 2y ago
  Oh no CRIME! Thank goodness that something being a crime stops people from committing them. Thank goodness the internet isn't an international operation filled with nation state level actors and questionable companies running data gathering operations from places they cannot be touched. Always assume your data has been stolen by an assailant in a place that's only reachable by launching nukes at them. Also assume there is some competitor on the other side of the world now using your data against you. Please stop treating data theft like Barney Fife level candy store theft. A huge portion of the time even if you know the name of the exact person who did it, there isn't going to be shit you can do about it.
- devin 2y ago
  Parent comment never suggested it was legal. They said it would be bad if this info was in their SalesForce and they leaked the key, which they did.
- mcfedr 2y ago
  How can it possibly be a crime? They literally gave the keys to everyone who accessed their website

xg15 2y ago

[flagged]

crngefest 2y ago
Well it could be this person that is professional and does not sell all your data to North Korean ransomware gangs - or it could be the one that does. Which one do you prefer?
- Lvl999Noob 2y ago
  I (we) would obviously prefer the professional person who is doing good for society. The problem is, this behaviour isn't good for them. I am not an expert or anything but from what I know, pentesting without explicit prior permissions can easily lead to huge lawsuits. I would rather that the careless people get their cars stolen than the good people all lose heart completely.
  - crngefest 2y ago
    Sure there is no perfect solution here. I guess it’s a good idea to only pentest companies that do have a bug bounty program and an expressed interest in you pentesting. While I enjoyed the article that GP referenced and agreed with most thing I thought the “hacking bad” take was a bit off.
  - fermisea 2y ago
    One thing is true about what you said: you're definitely not an expert.
awesomeMilou 2y ago
And so you're just going to dismiss the modern reality of cybersecurity threats? "What happened to the good old days when we could all leave our cars and homes unlocked.." Yeah no.
- account42 2y ago
  > What happened to the good old days when we could all leave our cars and homes unlocked.. That is actually a really good question you should be asking. Also when it comes to computers.

asopd 2y ago

I'm surprised he didn't try harder to contact someone in the company privately. Surely any contact would have sufficed to at least try to get an introduction to their security team? If you browse their website there are loads of email addresses for various offices and divisions.

localfirst 2y ago

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. I just don't understand this petty attitude. This almost guarantees next time somebody that finds vulnerability with a16z or any of its companies to seek black market rewards that will do far more damage. This is just like when KakaoTalk refused to payout bug bounty because you had to be a Korean citizen which ended up causing more vulnerabilities to be discovered in the wild. Companies and billionaires reading this, please don't be petty like Andreesen. Guy went from a leader to a borderline security fraud artist. You don't want to be earning more ire from the public in the current political climate. It's dangerous.

kva 2y ago

Hopefully Martin Casado or one of the other awesome open source folks from a16z will take a look at this and make the person whole!

account42 2y ago
The person is whole as nothing was taken from them. If you choose to do free work you are not owed anything.

Capricorn2481 2y ago

From the techcrunch article: > “On June 30th, a16z addressed a misconfiguration in a web app that is used for the specific use case of updating publicly available information on our website such as company logos and social media profiles. The issue was resolved quickly and no sensitive data was compromised,” What the fuck is this? They are blatantly lying here. There was a lot of sensitive data compromised. Anyone who inspected the site could have had access to everyones emails.

lazzlazzlazz 2y ago
How do you know that? Both quotes seem to explain why what you're saying isn't true.
- Capricorn2481 2y ago
  If anyone could view any of those secrets and access emails, then sensitive data was exposed. They can't just decide it wasn't exposed because no one else told them about this.
  - lazzlazzlazz 2y ago
    Couldn't it be the case that the secrets were not useful for accessing sensitive emails? Their response made it sound like the secrets were limited to a specific, limit-used app.
    - Capricorn2481 2y ago
      I'm just going off what the hacker said. > the compromised list of services: > their database (containing PII) > their AWS > their salesforce (never checked, account may be limited) > mailgun (arbitrary emails from a16z domains, and also could read older emails) > ... and probably more

j-bos 2y ago

The fact that this VC firm didn't provide bug bounty for such a gaping hole does not instill trust.

renewiltord 2y ago
Yes, if they can’t do web development what does that say about their ability to deploy capital?
- pavel_lishin 2y ago
  If my endodontist can't rebuild a car engine, what does that say about his ability to perform a root canal? Turns out, not much.
  - kjkjadksj 2y ago
    Not a great analogy. Its more like if your endodontist hired a secretary who leaves the medical records unlocked, do you really trust them to be up to date with modern dental sensibilities when the rest of their office is ran so carelessly?
archagon 2y ago
Unsurprising given that the founders are Trumpists now: https://siliconangle.com/2024/07/17/co-founders-andreessen-horowitz-giving-full-support-trump-campaign/ https://siliconangle.com/2024/07/17/co-founders-andreessen-h...
- notfed 2y ago
  Billionaires like tax cuts for billionaires; go figure.
  - TeaBrain 2y ago
    According to the article, the decision to back him was due to the 2025 tax plan to tax unrealized gains, which I hadn't heard of, but I'm not surprised that he wouldn't be a fan of that, given that his entire business is built on investing in companies, and that these investments on the part of founders and investors are unrealized. It does seem like it would de-incentivize much of the startup and venture capital economy.

nuz 2y ago

I like lower case tweets and texts but lower case in articles like this is just ridiculous (and trying too hard to be cool)

llmblockchain 2y ago

It's pretty shocking how many commenters are blaming the individual for not "trying harder" to find contact information. It's pretty clear a16z didn't want to pay anything or appreciate the disclosure at all. Finding random email addresses and sending them a notice would have gone no where other than spam folders. I get dozens of "disclosures" every week from mostly script kiddies that think my DKIM setting is somehow going to be the end of my business. My brain automatically ignores emails like it.

deleted 2y ago
[deleted]
mrcode007 2y ago
I’m surprised there is almost no discussion about the severity of reputational damage caused by an extremely amateur bug not expected of a prominent VC firm
- llmblockchain 2y ago
  Yes... In my mind, there are three kinds of security bugs. 1. Caused by pure ignorance and completely avoidable (this bug). 2. Caused by subtle configurations, workflows, programming (mostly avoidable, secret scanning, security linters, code reviews, general intelligence, etc). This is where 99% of security bugs are. 3. Caused by a malicious actor aligning planets with a single intent to maximize their cause. You'll never stop these people (three letter agencies, state actors). edit: A must watch talk https://vimeo.com/95066828 https://vimeo.com/95066828
- altthrow24 2y ago
  Probably because a16z reputation has already been quite tarnished in recent years. This is par for the course. People will still take their massive bags of money and name brand boost but "these are smart, technical, 'making the world a better place' visionaries" as opposed to wealth chasing bankers, has already run the gamut. See crypto, Clubhouse, "it's time to build [not in my Atherton neighborhood]", e/acc Nick Land manifesto, Trump '24 support, etc.

deleted 2y ago

[deleted]

hpen 2y ago

Wait, do hackers feel entitled to money for finding security holes, even if there was never any signal of such reward?

hpen 2y ago
Ha my actual question was downvoted. I guess people are as entitled as they say.
- hpen 2y ago
  Actually, I think entitlement is the wrong word. Maybe more like "window washing panhandler who's upset because you don't give them money for their service"

hedora 2y ago

Neko! https://en.wikipedia.org/wiki/Neko_%28software%29 https://en.wikipedia.org/wiki/Neko_%28software%29 The Wikipedia article is missing the implementation in the article. Too bad they don't pay bounties. ^ ^ 0 - * -

very_good_man 2y ago

how do I disable the cat following my cursor animation on your website? how insanely distracting

neilv 2y ago
uBlock Origin -> Dashboard -> My Filters -> add the line: ||www.kibty.town/files/js/oneko.js^$important

deleted 2y ago

[deleted]

paxys 2y ago

Stuff like this is what gives the entire security and white hat community a bad name. 1. "Surprise pentests" are illegal in the US and pretty much every jurisdiction in the world. If you are actively breaking into websites without a prior agreement, you are not doing anyone a favor. Save your efforts for companies that actually want you. 2. If the company doesn't have a published bug bounty program, they don't owe you anything. Yes they can still be nice and pay you, but they definitely won't if you disclose the vulnerability to the rest of the world without giving them a heads up and enough time to fix it. 3. "Oh I couldn't find an email address" is the worst excuse in the world. I found one after exactly 5 seconds of Googling (at the bottom of https://a16z.com/connect https://a16z.com/connect). And even otherwise there's Twitter, Instagram, LinkedIn and a hundred other ways to reach someone at the company if you really want to. This is classic case of clout chasing over responsible disclosure.

pavel_lishin 2y ago
> If you are actively breaking into websites They viewed the source code. Despite what the governor of Missouri[1] thinks, that's not hacking. [1]: https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code https://www.theverge.com/2021/12/31/22861188/missouri-govern...
- csmpltn 2y ago
  > They viewed the source code. No. "i like to do this thing where i search twitter, looking for companies, and then try giving them a quick pentest" "the compromised list of services: their database (containing PII), their AWS, their salesforce (never checked, account may be limited), mailgun (arbitrary emails from a16z domains, and also could read older emails) ... and probably more" By their own admission, this is a "pentest", and they were able to access a16z's "database" and ascertain that it contains PII. Amongst other services used by a16z. I'm not the one to judge whether they crossed any legal (or moral) lines though.

deleted 2y ago

[deleted]

udev4096 2y ago

The HN mods changed the title to a less embarrassing one. Not surprised

tux3 2y ago
Oh, my comment must have been too critical of a16z as well. I see it has been moved from top to way bottom without a score change. That's certainly one way to offer a response!

cromulent 2y ago

It's really hard to generate "all due respect" for a16z.

janjones 2y ago

https://archive.is/Wk6OO https://archive.is/Wk6OO

throw16z 2y ago

even web3 could protect a16z ugh, thats very bad

sourcecodeplz 2y ago

Too much javascript for everything (front & back) seems easy but for new developers it kind of blurs the lines between what should be on the server vs the client.

qwertox 2y ago

That's what security.txt is there for. They don't even have a robots.txt file.

deleted 2y ago

[deleted]

notfed 2y ago

> i publicly reached out Means what exactly? What information did your public reach-out include? EDIT: Ah, I think it's a tweet that said: > someone from @a16z get in touch, now. its bad. security related. Lol, ok. I guess they don't want anyone to know they had a security vuln. I wonder if they make you sign an NDA too when you get the bounty.

helic 2y ago

Why does this read like a 9 year old TikToker wrote it? This reads like some little script kiddie who runs fuzzing tools (and can't make any of their own) ranting online unprofessionally.

QkPrsMizkYvt 2y ago

Question to the community. I managed to expose all customer data of a well-funded D2C brand and when I reached out to them I did not ask for bounty before I shared the fix/the security hole. I only got a 200 USD gift card for their shop :D What is best practice here? Do you first tell the company that they have a security issue, ask for bounty and then help? Is that unethical? Blackmail?

Donaldkenneth 2y ago

[dead]