6 ms·

Beam Living is just the property management company that runs buildings Blackstone owns in New York City. There are thousands of companies like this all over th

by tptacek 2mo ago

Beam Living is just the property management company that runs buildings Blackstone owns in New York City. There are thousands of companies like this all over the country and if you poke hard at any of them you will find stuff like this. There's nothing wrong with pitching stories this way, but for context, if you look at this researcher's archive, they're all basically "I found a vulnerability in some big company's thingy". The news hook here is literally just "I found a GraphQL bug". This is not Alex Schapiro's most interesting front-page story (by which I mean: they've posted some genuinely interesting stuff before).

consensus1 2mo ago
There absolutely is everything wrong with implicating a company that has no knowledge of and no responsibility for the breach.
- tptacek 2mo ago
  You mean the Blackstone namedrop? I had the same reaction. Beam is an internal division of Blackstone, for whatever that's worth, but I don't think there's a news hook about Blackstone here. This is, like, every property management company everywhere, whether indie or corporate.
  - bearsyankees 2mo ago
    If this is the case then IMO all the more reason to publicize it -- my SSN shouldn't be exposed just because I applied for a lease [ and we shouldn't just brush that off as something that is a given ]
    - tptacek 2mo ago
      I mean, that's true, and I'm not saying there's anything misleading about the post, just that this is true of basically all the companies that do this. All I'm saying is that there isn't a meaningful Blackstone hook here.
      - DANmode 2mo ago
        If you’re too big to manage your subsidiaries, don’t buy them/build them. This is no different than blaming the big AI tool because it messed up doing work in your spaghetti codebase - “how else was I supposed to do it?”. Stay small enough to do business properly. Yes, this is a ding on the parent company. How indicative it is of their other companies making the exact same mistakes is a different question. But I’d expect issues somewhere.
        tptacek 2mo ago
        Beam Living manages giant high-rise housing developments in New York City. It's not a mom-and-pop problem space, unless you're for some reason opposed to density.
        DANmode 2mo ago
        I’m opposed to using your scale as an excuse to be an incompetent. It’s one of the major ethical / effectiveness issues with business - especially American business - today.
        tptacek 2mo ago
        You'd much rather rent from someone like Beam Living than a mom-and-pop operator that owns a small apartment building. Things will get fixed, and you'll get most of your security deposit back.
        tmnvix 2mo ago
        Personally, I've always had a better experience dealing directly with small time landlords than with property managers. For a start, they have been less likely to raise rents at every opportunity. I also prefer when my money goes to someone in my community/local area.
        tptacek 2mo ago
  - jimbo89 2mo ago
    Beam is actually a little bit unique here. They have a spent a lot of money building a lot of custom software that most other property managers just buy off the shelf.
  - consensus1 2mo ago
    Yes, that's what I meant, but I thought your comment meant that it was a property management company hired by Blackstone, not an internal division of Blackstone. That changes things completely.
bearsyankees 2mo ago
Yeah I hear you but I think this community loves writeups like these -- I personally have learned a TON about how to be an effective security researcher by reading technical writeups others have posted here. Agreed this vuln wasn't a complicated one by any means but I feel like this is the forum for sharing this stuff
- tptacek 2mo ago
  Yeah, you're totally fine.
- dylan604 2mo ago
  But as GP stated, if as a security researcher you discover this as Company X using Company Y's product that has the vuln but your write up lays the blame at Company X's feet leaves a lot to be said about your skillz as a researcher. If you wrote it up as Company Y's product has a vuln and is used in this market by companies like X you'd sound like a much more skilled researcher.
bearsyankees 2mo ago
Also, as far as I know, no residents were ever alerted that their data was exposed so this also is a bit of a public disclosure angle
- ldoughty 2mo ago
  It has to be 18 months after public disclosure before the company has to send out a letter letting them know that someone might use their information, and they are eligible for yet another free credit monitoring service...... /S
jordanb 2mo ago
I'm glad HN can be counted on to defend Blackstone's good name.
- tptacek 2mo ago
  That's not what I'm doing, but if you want me to, I'll bite, because Blackstone does more for housing than activists do (if you measure housing outcomes in terms of how many people end up housed, as opposed to whether or not the "right" people get to live in the "right" neighborhoods). I think the expectation on a message board is that you can name drop a big private equity firm and count on voting support for them. Unfortunately for you, I've spent the last 5 years working on rolling back single-family zoning in my municipality, and an alarming amount of that work has involved pushing back on NIMBYs arguing that if we allow housing construction Blackstone (very specifically Blackstone) will just come snap all the real estate up and hoard it. So I've had some time to marinate in this particular bit of populist rhetoric.
ilamont 2mo ago
Well, the other notable fact about this story is it's Blackstone, which has a record of giving managers a lot of leeway to do anything to juice the numbers. Two examples: 1) Hiring 14 year old slaughterhouse workers (https://www.nbcnews.com/news/us-news/pssi-hired-same-child-twice-clean-slaughterhouses-document-rcna71633 https://www.nbcnews.com/news/us-news/pssi-hired-same-child-t...) 2) Gamifying of one its genealogy websites that tracked cemetery markers, which resulted in people "claiming" victims of mass shootings for points (https://dna-explained.com/2022/06/02/find-a-grave-owned-by-ancestry-seriously-just-stop-incentivizing-the-creation-of-memorials-of-the-recently-deceased/ https://dna-explained.com/2022/06/02/find-a-grave-owned-by-a...) ETA People have asked about the second example. In a nutshell, Ancestry purchased Find-A-Grave in 2013, and Blackstone acquired Ancestry in 2020. Originally, Find a Grave was basically used by amateur genealogists to check the names and dates on gravestones across North America. So, if you want to verify Grandma Smith's burial location and other gravestone data three states away, you could search the database for free. Volunteers could submit photos and other data. Blackstone brought in a Facebook executive to run its genealogy business, and gamified Find A Grave for engagement/revenue purposes (Find A Grave is top of funnel for Ancestry subscriptions and also is heavily blanketed in ad networks.) Gamification led to some very ugly situations, and as I recall they barely backed down over this. Per Roberta Estes, an experienced genealogist cited above: The problem is that finding your loved one’s memorial, often with incorrect information, created by a stranger is unexpectedly jarring, at best. Especially to discover that your family member was only a trophy harvest whose memorial was created hours after they died. Then, having to ask (sometimes beg an unresponsive person) for the transfer of their memorial to you, only to have the creator’s name forever associated with the memorial adds insult to injury. ... Who in their right mind would think that entering those massacred children into Find a Grave immediately was acceptable by any criteria? Any standards of decency? And why would Find a Grave tolerate this for even a minute? Death is traumatic for family members under the “best” of circumstances and it only goes downhill from there.
- rationalist 2mo ago
  Geez... Item 2 could be its own HN post.
phkahler 2mo ago
Yeah like why is Blackstone named and not the actual company? Clickbait.

by tptacek 2mo ago

consensus1 2mo ago

There absolutely is everything wrong with implicating a company that has no knowledge of and no responsibility for the breach.

tptacek 2mo ago
You mean the Blackstone namedrop? I had the same reaction. Beam is an internal division of Blackstone, for whatever that's worth, but I don't think there's a news hook about Blackstone here. This is, like, every property management company everywhere, whether indie or corporate.
- bearsyankees 2mo ago
  If this is the case then IMO all the more reason to publicize it -- my SSN shouldn't be exposed just because I applied for a lease [ and we shouldn't just brush that off as something that is a given ]
  - tptacek 2mo ago
    I mean, that's true, and I'm not saying there's anything misleading about the post, just that this is true of basically all the companies that do this. All I'm saying is that there isn't a meaningful Blackstone hook here.
    - DANmode 2mo ago
      If you’re too big to manage your subsidiaries, don’t buy them/build them. This is no different than blaming the big AI tool because it messed up doing work in your spaghetti codebase - “how else was I supposed to do it?”. Stay small enough to do business properly. Yes, this is a ding on the parent company. How indicative it is of their other companies making the exact same mistakes is a different question. But I’d expect issues somewhere.
      - tptacek 2mo ago
        Beam Living manages giant high-rise housing developments in New York City. It's not a mom-and-pop problem space, unless you're for some reason opposed to density.
        DANmode 2mo ago
        I’m opposed to using your scale as an excuse to be an incompetent. It’s one of the major ethical / effectiveness issues with business - especially American business - today.
        tptacek 2mo ago
        You'd much rather rent from someone like Beam Living than a mom-and-pop operator that owns a small apartment building. Things will get fixed, and you'll get most of your security deposit back.
        tmnvix 2mo ago
        Personally, I've always had a better experience dealing directly with small time landlords than with property managers. For a start, they have been less likely to raise rents at every opportunity. I also prefer when my money goes to someone in my community/local area.
        tptacek 2mo ago
- jimbo89 2mo ago
  Beam is actually a little bit unique here. They have a spent a lot of money building a lot of custom software that most other property managers just buy off the shelf.
- consensus1 2mo ago
  Yes, that's what I meant, but I thought your comment meant that it was a property management company hired by Blackstone, not an internal division of Blackstone. That changes things completely.

bearsyankees 2mo ago

Yeah I hear you but I think this community loves writeups like these -- I personally have learned a TON about how to be an effective security researcher by reading technical writeups others have posted here. Agreed this vuln wasn't a complicated one by any means but I feel like this is the forum for sharing this stuff

tptacek 2mo ago
Yeah, you're totally fine.
dylan604 2mo ago
But as GP stated, if as a security researcher you discover this as Company X using Company Y's product that has the vuln but your write up lays the blame at Company X's feet leaves a lot to be said about your skillz as a researcher. If you wrote it up as Company Y's product has a vuln and is used in this market by companies like X you'd sound like a much more skilled researcher.

bearsyankees 2mo ago

Also, as far as I know, no residents were ever alerted that their data was exposed so this also is a bit of a public disclosure angle

ldoughty 2mo ago
It has to be 18 months after public disclosure before the company has to send out a letter letting them know that someone might use their information, and they are eligible for yet another free credit monitoring service...... /S

jordanb 2mo ago

I'm glad HN can be counted on to defend Blackstone's good name.

tptacek 2mo ago
That's not what I'm doing, but if you want me to, I'll bite, because Blackstone does more for housing than activists do (if you measure housing outcomes in terms of how many people end up housed, as opposed to whether or not the "right" people get to live in the "right" neighborhoods). I think the expectation on a message board is that you can name drop a big private equity firm and count on voting support for them. Unfortunately for you, I've spent the last 5 years working on rolling back single-family zoning in my municipality, and an alarming amount of that work has involved pushing back on NIMBYs arguing that if we allow housing construction Blackstone (very specifically Blackstone) will just come snap all the real estate up and hoard it. So I've had some time to marinate in this particular bit of populist rhetoric.

ilamont 2mo ago

Well, the other notable fact about this story is it's Blackstone, which has a record of giving managers a lot of leeway to do anything to juice the numbers. Two examples: 1) Hiring 14 year old slaughterhouse workers (https://www.nbcnews.com/news/us-news/pssi-hired-same-child-twice-clean-slaughterhouses-document-rcna71633 https://www.nbcnews.com/news/us-news/pssi-hired-same-child-t...) 2) Gamifying of one its genealogy websites that tracked cemetery markers, which resulted in people "claiming" victims of mass shootings for points (https://dna-explained.com/2022/06/02/find-a-grave-owned-by-ancestry-seriously-just-stop-incentivizing-the-creation-of-memorials-of-the-recently-deceased/ https://dna-explained.com/2022/06/02/find-a-grave-owned-by-a...) ETA People have asked about the second example. In a nutshell, Ancestry purchased Find-A-Grave in 2013, and Blackstone acquired Ancestry in 2020. Originally, Find a Grave was basically used by amateur genealogists to check the names and dates on gravestones across North America. So, if you want to verify Grandma Smith's burial location and other gravestone data three states away, you could search the database for free. Volunteers could submit photos and other data. Blackstone brought in a Facebook executive to run its genealogy business, and gamified Find A Grave for engagement/revenue purposes (Find A Grave is top of funnel for Ancestry subscriptions and also is heavily blanketed in ad networks.) Gamification led to some very ugly situations, and as I recall they barely backed down over this. Per Roberta Estes, an experienced genealogist cited above: The problem is that finding your loved one’s memorial, often with incorrect information, created by a stranger is unexpectedly jarring, at best. Especially to discover that your family member was only a trophy harvest whose memorial was created hours after they died. Then, having to ask (sometimes beg an unresponsive person) for the transfer of their memorial to you, only to have the creator’s name forever associated with the memorial adds insult to injury. ... Who in their right mind would think that entering those massacred children into Find a Grave immediately was acceptable by any criteria? Any standards of decency? And why would Find a Grave tolerate this for even a minute? Death is traumatic for family members under the “best” of circumstances and it only goes downhill from there.

rationalist 2mo ago
Geez... Item 2 could be its own HN post.

phkahler 2mo ago

Yeah like why is Blackstone named and not the actual company? Clickbait.