9 ms·

FYI Anyone can see your name, email, and AWS ID/Access Key. The games on Stripe's CTF were more secure than this site... EDIT: Looks like it was just patched.

FYI Anyone can see your name, email, and AWS ID/Access Key. The games on Stripe's CTF were more secure than this site... EDIT: Looks like it was just patched. Still managed to get a few dozen AWS keys though.

smeagol 14y ago
sorry about that. like i said before, we accidentally "launched" today. be nice? if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for.
- dfc 14y ago
  You should think about sending an email to all of your users. I realize its a tough call pointing out a problem so early but it might also be a good way to garner user's trust.
  - smeagol 14y ago
    good idea. actually, we'll just wipe them and force new ones.
    - zacharyvoase 14y ago
      But you still should let your users know that their old keys have been compromised.
      - adgar2 14y ago
        Dude... this guy clearly doesn't understand security. I'm glad you're trying to help him out... but your time will be better spent elsewhere.
        interg12 14y ago
        Well that's not a very helpful attitude. People should be instructive rather than discourage someone from pursuing a reasonable project.
        adgar2 14y ago
        It's not helpful, it's realistic. My exact wording was "your time will be better spent elsewhere." We each have 24 hours in a day. I spend 8-9 of mine sleeping, 9-10 at work. That doesn't leave much leftover for me. If zacharyvoase wants to spend his precious free time educating people who haven't done any due diligence to learn how to build a secure web app, that's his prerogative. But I don't see it as a good use of his time - there's already tons of resources out there that will do a better job than zachary. Is HN supposed to be a newbie education destination?
        philiac 14y ago
        No, but it's not reddit either so if you enjoy this site, be constructive with your comments.
        adgar2 14y ago
        I'm being constructive to zacharyvoase. You can't please everybody with every statement you make without being a sycophant.
    - jspthrowaway 14y ago
      "Whoops, we disclosed everybody's AWS credentials. I know! Rather than tell our users, I'll wipe the database and remove all evidence of it ever happening."
    - ainsleyb 14y ago
      Legally you must disclose any sort of security breach to your users: http://en.wikipedia.org/wiki/Security_breach_notification_laws http://en.wikipedia.org/wiki/Security_breach_notification_la...
- RKearney 14y ago
  Many of these keys aren't IAM keys, or they were made with full access to the users AWS account.
  - Zombieball 14y ago
    Luckily you can rotate keys even for the root level accounts.
- smeagol 14y ago
  in case you have issues with your AWS keys. RKearny's email: ryan@ryankearney.com https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb2861503ab1?size=70&default=https://cdn.uservoice.com/images/admin/icons/user_70.png https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286...
  - RKearney 14y ago
    enginerd@wepay.com https://si0.twimg.com/profile_images/2550813276/qnltv3bylbd6lkhiz5gp.jpeg https://si0.twimg.com/profile_images/2550813276/qnltv3bylbd6... I can search for email addresses too! Don't direct users to me because you failed to secure your web application. It's nice to know someone who works at a company that handles credit card and bank payments would just post someones email address and photo. Granted this is all public since I posted on the Uservoice post, it was still unnecessary.
    - smeagol 14y ago
      WePay is in no way related to IceBox. they're terrific guys; don't trash on their reputation. i left WePay ages ago. also, our info is publicly displayed here: http://www.iceboxpro.com/about/team http://www.iceboxpro.com/about/team we're not a company. we're two nerds.
      - citricsquid 14y ago
        then you may wish to remove that email from your profile.
      - jarek 14y ago
        > we're not a company. we're two nerds. Oh, so if you get sued for mishandling personal data or PII it'll be your personal responsibility rather than a company's?
      - bdcravens 14y ago
        If you were a company, you'd have insulation against lawsuits. Two nerds mean you and your family's assets are at risk; launching an app with such a spectacular security hole seriously puts the two of you and your families in danger.
dfc 14y ago
Your edit/addendum would have been way cooler if it read: "Looks like it was just patched. Still managed to get a few dozen AWS keys though. I sent emails to the affected parties." EDIT: effected-> affected (I'm not sure what's up with the snarky comment. Do most people think its inappropriate/snarky to urge proper notification?)
- StavrosK 14y ago
  Grammar mistakes aren't cool.
  - natch 14y ago
    Hate to even dignify this with a reply, but confusing spelling mistakes with grammar mistakes isn't cool either.
- matthewowen 14y ago
  That's a moot point, surely? Everyone who used the app should receive an email from the people behind it very, very quickly - they've all been compromised. The concern isn't just that RKearney has the keys - it is that anyone could have the keys for anyone on the site. Sending an email to the people whose keys he snagged would help them - but the people whose keys he didn't are still vulnerable too.
  - dfc 14y ago
    I imagine you were a little unsure of the timeline of things when you commented. Please keep in mind that I wrote this comment before the "never give your info" story and before the website developer commented here on HN. With that in mind I am not sure what point is a moot point? Do I think the developer should email all of the users? Yes, which is why in my response to the developer's comment about destroying the IAM keys I said "You should think about sending an email to all of your users..." Do I think that the right thing for rkearney to do is send emails to the people whose information he has? Yes. Is it the best possible scenario? No, but it is better than no notification at all, which at the time was a possibility.
erenemre 14y ago
Update: I misunderstood, I'm sorry. I wasn't trying to attack but trying to show my concern because I thought he saved some id/keys for himself. Please ignore my comment below. -- "Still managed to get a few dozen AWS keys though" Good for you! What a nice person you are. Please abuse more small projects like this. Even if they say they say it was "was only meant for friends to test out". Oh I see, you just found a security hole and trying to get some reputation? Cute. Please do it by abusing the small power you found and hurting innocent users. That's really, really nice of you. "Still managed to get a few dozen AWS keys though" Wow. Just wow. You sir, just ruined my night. Thank you. Ps. I am really concerned about your company and its users. If you can do something like this, I wonder what else you could do (or doing) at your current company. I hope, I'm assuming wrong. edit: "the" » "your". last paragraph.
- zacharyvoase 14y ago
  It's massively important that people bring security issues into the open. Talking about these things creates pressure on developers to build secure web apps. Not talking about them because people like you get 'upset' about "hurting 2 nerds' inspiration" means we get poor information security policies all over the Internet. As it stands we don't know whether hostile agents (silently) got copies of the AWS keys of every user on the site. That should be incredibly concerning for you, but apparently it's not.
  - erenemre 14y ago
    Thank you, yes I'm aware of these. I was trying to focus on the fact that the person who found this security hole used it to get some of this data to himself. But apparently I wasn't clear enough. I'm still trying to improve my English. Next time I'll try to be more clear. Thank you.
- amalag 14y ago
  Why are you upset with him, at least he informed people. You should be more upset with an insecure app. A less talkative person would just keep it and use the AWS accounts for bitmining.

smeagol 14y ago

sorry about that. like i said before, we accidentally "launched" today. be nice? if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for.

dfc 14y ago
You should think about sending an email to all of your users. I realize its a tough call pointing out a problem so early but it might also be a good way to garner user's trust.
- smeagol 14y ago
  good idea. actually, we'll just wipe them and force new ones.
  - zacharyvoase 14y ago
    But you still should let your users know that their old keys have been compromised.
    - adgar2 14y ago
      Dude... this guy clearly doesn't understand security. I'm glad you're trying to help him out... but your time will be better spent elsewhere.
      - interg12 14y ago
        Well that's not a very helpful attitude. People should be instructive rather than discourage someone from pursuing a reasonable project.
        adgar2 14y ago
        It's not helpful, it's realistic. My exact wording was "your time will be better spent elsewhere." We each have 24 hours in a day. I spend 8-9 of mine sleeping, 9-10 at work. That doesn't leave much leftover for me. If zacharyvoase wants to spend his precious free time educating people who haven't done any due diligence to learn how to build a secure web app, that's his prerogative. But I don't see it as a good use of his time - there's already tons of resources out there that will do a better job than zachary. Is HN supposed to be a newbie education destination?
        philiac 14y ago
        No, but it's not reddit either so if you enjoy this site, be constructive with your comments.
        adgar2 14y ago
        I'm being constructive to zacharyvoase. You can't please everybody with every statement you make without being a sycophant.
  - jspthrowaway 14y ago
    "Whoops, we disclosed everybody's AWS credentials. I know! Rather than tell our users, I'll wipe the database and remove all evidence of it ever happening."
  - ainsleyb 14y ago
    Legally you must disclose any sort of security breach to your users: http://en.wikipedia.org/wiki/Security_breach_notification_laws http://en.wikipedia.org/wiki/Security_breach_notification_la...
RKearney 14y ago
Many of these keys aren't IAM keys, or they were made with full access to the users AWS account.
- Zombieball 14y ago
  Luckily you can rotate keys even for the root level accounts.
smeagol 14y ago
in case you have issues with your AWS keys. RKearny's email: ryan@ryankearney.com https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb2861503ab1?size=70&default=https://cdn.uservoice.com/images/admin/icons/user_70.png https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286...
- RKearney 14y ago
  enginerd@wepay.com https://si0.twimg.com/profile_images/2550813276/qnltv3bylbd6lkhiz5gp.jpeg https://si0.twimg.com/profile_images/2550813276/qnltv3bylbd6... I can search for email addresses too! Don't direct users to me because you failed to secure your web application. It's nice to know someone who works at a company that handles credit card and bank payments would just post someones email address and photo. Granted this is all public since I posted on the Uservoice post, it was still unnecessary.
  - smeagol 14y ago
    WePay is in no way related to IceBox. they're terrific guys; don't trash on their reputation. i left WePay ages ago. also, our info is publicly displayed here: http://www.iceboxpro.com/about/team http://www.iceboxpro.com/about/team we're not a company. we're two nerds.
    - citricsquid 14y ago
      then you may wish to remove that email from your profile.
    - jarek 14y ago
      > we're not a company. we're two nerds. Oh, so if you get sued for mishandling personal data or PII it'll be your personal responsibility rather than a company's?
    - bdcravens 14y ago
      If you were a company, you'd have insulation against lawsuits. Two nerds mean you and your family's assets are at risk; launching an app with such a spectacular security hole seriously puts the two of you and your families in danger.

dfc 14y ago

Your edit/addendum would have been way cooler if it read: "Looks like it was just patched. Still managed to get a few dozen AWS keys though. I sent emails to the affected parties." EDIT: effected-> affected (I'm not sure what's up with the snarky comment. Do most people think its inappropriate/snarky to urge proper notification?)

StavrosK 14y ago
Grammar mistakes aren't cool.
- natch 14y ago
  Hate to even dignify this with a reply, but confusing spelling mistakes with grammar mistakes isn't cool either.
matthewowen 14y ago
That's a moot point, surely? Everyone who used the app should receive an email from the people behind it very, very quickly - they've all been compromised. The concern isn't just that RKearney has the keys - it is that anyone could have the keys for anyone on the site. Sending an email to the people whose keys he snagged would help them - but the people whose keys he didn't are still vulnerable too.
- dfc 14y ago
  I imagine you were a little unsure of the timeline of things when you commented. Please keep in mind that I wrote this comment before the "never give your info" story and before the website developer commented here on HN. With that in mind I am not sure what point is a moot point? Do I think the developer should email all of the users? Yes, which is why in my response to the developer's comment about destroying the IAM keys I said "You should think about sending an email to all of your users..." Do I think that the right thing for rkearney to do is send emails to the people whose information he has? Yes. Is it the best possible scenario? No, but it is better than no notification at all, which at the time was a possibility.

erenemre 14y ago

Update: I misunderstood, I'm sorry. I wasn't trying to attack but trying to show my concern because I thought he saved some id/keys for himself. Please ignore my comment below. -- "Still managed to get a few dozen AWS keys though" Good for you! What a nice person you are. Please abuse more small projects like this. Even if they say they say it was "was only meant for friends to test out". Oh I see, you just found a security hole and trying to get some reputation? Cute. Please do it by abusing the small power you found and hurting innocent users. That's really, really nice of you. "Still managed to get a few dozen AWS keys though" Wow. Just wow. You sir, just ruined my night. Thank you. Ps. I am really concerned about your company and its users. If you can do something like this, I wonder what else you could do (or doing) at your current company. I hope, I'm assuming wrong. edit: "the" » "your". last paragraph.

zacharyvoase 14y ago
It's massively important that people bring security issues into the open. Talking about these things creates pressure on developers to build secure web apps. Not talking about them because people like you get 'upset' about "hurting 2 nerds' inspiration" means we get poor information security policies all over the Internet. As it stands we don't know whether hostile agents (silently) got copies of the AWS keys of every user on the site. That should be incredibly concerning for you, but apparently it's not.
- erenemre 14y ago
  Thank you, yes I'm aware of these. I was trying to focus on the fact that the person who found this security hole used it to get some of this data to himself. But apparently I wasn't clear enough. I'm still trying to improve my English. Next time I'll try to be more clear. Thank you.
amalag 14y ago
Why are you upset with him, at least he informed people. You should be more upset with an insecure app. A less talkative person would just keep it and use the AWS accounts for bitmining.