7 ms·
Zendesk was hacked
- emptyage 14y agoThe three companies were Twitter, Tumblr and Pinterest: http://www.wired.com/threatlevel/?p=54338 http://www.wired.com/threatlevel/?p=54338
- creativityland 14y agoSo what kind of integration did Twitter, Tumblr and Pinterest have with Zendesk? How much of risk are the users are with their passwords?
- unreal37 14y agoNo password data was stored there - so zero. No passwords, password hashes or encrypted passwords were lost.
- viscanti 14y agoBut there's a greater than 0% chance that zendesk had an API token for at least one of those services. That could easily allow a hacker to make authenticated requests to those services to gain user info. The fact that usernames and passwords weren't stored on zendesk doesn't mean much, if a hacker can gain full admin access to those other services through an admin token that might have been stored on zendesk.
- kelnos 14y agoI seriously doubt any company (especially the three listed) would give Zendesk admin access to their service. Why would such a thing be necessary, anyway?
- jorts 14y agoI think he meant it the other way around. Having their API token would allow the attacker to have access to all of Twitter/Tumblr/Pinterest's information that's accessible via the Zendesk API.
- businessleads 14y agoWow, all three customers?
- mparlane 14y agoDoes anyone know how many customers they do have to put this into perspective ?
- bobsoap 14y agoMy thoughts exactly, lol. The headline is truly hilarious when you consider the typically quite spectacular number of compromised accounts reported in most other high-caliber incidents. Well done Zendesk.
- bobsoap 14y agoThanks for the downvotes everyone. For the record, when I wrote the above comment, the headline of this thread was "Zendesk was hacked, 3 customers affected". It has been changed since, without due notice of course. I wonder why... Now, my comment looks like I'm a nutjob and have a personal gripe with Zendesk or something. That the three customers were Twitter, Pinterest and Tumblr didn't come out until later as well. Carry on.
- kelnos 14y agoThe original title still makes perfect sense. Maybe "3 customers" made sense to me because I'm already familiar with Zendesk, but it immediately struck me as a big deal.
- deleted 14y ago[deleted]
- codenerdz 14y agoGiven Zendesk is a Rails shop, Id love to hear if this hack was related to any of the recent Rails exploits
- mef 14y agoIf it was, at it occurred after the vulnerabilities were made public, they probably wouldn't say so as it would look pretty bad given the amount of advance warning they had.
- scorpion032 14y agoAre you suggesting most popular rails (if not all) apps are upgraded by now?
- klapinat0r 14y agoNo, but he's suggesting that you should've upgraded by now. It would be difficult to defend such a position: "We didn't upgrade because, well, we didn't think it was a big deal"? There's really no good answer to that question when the exploit has been public for so long (and widely covered in media, and by rails officially).
- deleted 14y ago[deleted]
- tlrobinson 14y agoNo, he's suggesting the ones that aren't are run by incompetent people.
- scorpion032 14y agoIf thats the case, there are so many incompetent people.
- jcoder 14y ago"As soon as we learned of the attack, we patched the vulnerability and closed the access that the hacker had." Ok, so striking out so far. The machine is still running? With the same software (patched) and user accounts? How do you know only 3 users were exposed?
- tomhallett 14y agoIf you have a mid-sized Rails app, with say 2-3 developers working on it, a full time security engineer would probably be overkill. Anyone have any recommendations of services/consultancies to be able to tell "oh, someone is hacking us right now" or "our page which has stripe.js on it has been compromised"? I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the box package. This is the only automated tool I know about: http://brakemanscanner.org/ http://brakemanscanner.org/
- diziet 14y agoTinfoil Security (https://www.tinfoilsecurity.com/ https://www.tinfoilsecurity.com/) has automated scanners and seems to keep up to date with all the vulnerabilities quickly, like in case of the rails vulnerability recently.
- tomhallett 14y agovery cool - thanks!
- phillmv 14y agoShameless self promotion: we've entered closed beta, and will be opening up to everyone soon – https://gemcanary.com/ https://gemcanary.com/ We don't do code analysis, but we think it's a useful service.
- dotmanish 14y agoThere's also Detectify : http://detectify.com http://detectify.com They are in beta.
- throaway132 14y agoActually, I've had really bad experiences with Detectify. Their results didn't provide anything useful that I couldn't have gotten from something like Nessus. They have a pretty nice design, but not much in the way of actual useful security.
- tstactplsignore 14y agoFrom the perspective of a complete server administrator novice, are all of the mainstream "hacks" due to the complexity of these applications? For example, if I were to setup a basic, updated Ubuntu Server LAMP stack with a MySQL database, is this system vulnerable? I understand how to protect against XSS and SQL injection and how to hash and salt passwords properly, but where can I begin to learn about implementing basic, hard server security? Additionally, how can I hope to secure my web app if corporations with entire security departments are failing to secure theirs?
- 0x0 14y ago> a basic, updated Ubuntu Server LAMP stack with a MySQL database After just apt-get'ing that, the system is of course always vulnerable to the next as-of-yet-undisclosed 0day vulnerability in the base software. As soon as you start adding useful scripts of the "P" variety (as in "LAMP") then you are at the mercy of those scripts not having any vulnerabilities. If you wrote those scripts yourself, then yes, xss, sqli, rfi etc are all issues you need to consider. The OWASP pages could be a useful place to start getting a feeling of the most common pitfalls.
- ams6110 14y agohow can I hope to secure my web app if corporations with entire security departments are failing to secure theirs Excellent question. The answer really is, if you are running a "web app" with any kind of sensitive information, you need to have a security expert configure and administer your systems, or become one yourself, and you need to stay on top of every update. Now, there are basic things you can do that will eliminate most of the casual script kiddie attackers. Firewalls. Defense in depth. Keeping up with patches. Google or any good book on computer security will provide this information. But the sad truth is, if a smart, determined attacker has you in his sights, you will most likely lose. And even the automated tools are getting better and better. I think we are starting to see a tipping point in the web. More and more high profile sites are getting compromised. We have learned that China has been inside US government, utility, and industrial systems for years. Right now I would not trust any sensitive, personal information to any website or cloud service. I think we are going to see some major, consequential attacks on government, banks, and other commercial entities in the coming years. At some point I believe we are going to need to rethink the cost/benefit equation of having everything connected to everything.
- lawnchair_larry 14y agoFirst, thanks for disclosing this. Second - and any incident response team will tell you this - patching and removing the backdoor is not enough. You have to wipe that machine. It's not uncommon for an attacker to leave multiple backdoors. Even if you don't think they got root, you have to wipe it completely.
- jpswade 14y agoDestroying data is never a solution.
- deleted 14y ago[deleted]
- randallsquared 14y agoThat's certainly not true, but in any case, I don't think Larry was suggesting you shouldn't take a backup first. :)
- martinced 14y agoYou got downvoted by several people because what you say is not related to the person you answered to. Typically when a breach-in happens you do two things: 1. backup the entire disks for forensics purposes 2. wipe everything clean, re-install the latest version of the OS + all the latest patches, re-install the latest version of the apps. Nowhere did parent suggest to "destroy evidence".
- amw 14y agoNot that this guy said "evidence" either ("data" was the word), but otherwise I agree
- pifflesnort 14y agoNowadays, it's not enough to wipe the machine. You have to toss (or, at least, re-image) the hardware. Modern servers have firmware running on internal devices, including Linux runnning on full ARM cores, that can be 1) imaged from the base OS, and 2) have full control over hardware or other important data. This includes: - IPMI Modules: http://fish2.com/ipmi/itrain.html http://fish2.com/ipmi/itrain.html - HDD Controllers (in your HDD/SSD drives): http://www.arm.com/markets/enterprise/hdd-ssd.php http://www.arm.com/markets/enterprise/hdd-ssd.php ... as well as ethernet controllers, any devices with PCI option ROMs (they can control boot), and quite a few other things. This essentially means that you have a bunch of fixed, poorly documented, runtime reconfigurable and re-imageable hardware, with full access to data and system resources.
- DanBlake 14y agoCPanel was also hacked which is a way bigger deal imo- Led to thousands(!) of other server compromises: http://www.webhostingtalk.com/showthread.php?t=1235797 http://www.webhostingtalk.com/showthread.php?t=1235797
- meaty 14y agoCPanel is always hacked so it's hardly news.
- TheOnly92 14y agoApparently the 3 customers are Twitter, Pinterest and Tumblr. http://www.wired.com/threatlevel/2013/02/twitter-tumblr-pinterest/ http://www.wired.com/threatlevel/2013/02/twitter-tumblr-pint...
- deleted 14y ago[deleted]
- cing 14y agoHere's the email from Tumblr: For the last 2.5 years, we've used a popular service called Zendesk to store, organize, and answer emails to Tumblr Support. We've learned that a security breach at Zendesk has affected Tumblr and two other companies. We are sending this notification to all email addresses that we believe may have been affected by this breach. This has potentially exposed records of subject lines and, in some cases, email addresses of messages sent to Tumblr Support. While much of this information is innocuous, please take some time today to consider the following: The subject lines of your emails to Tumblr Support may have included the address of your blog which could potentially allow your blog to be unwillingly associated with your email address. Any other information included in the subject lines of emails you’ve sent to Tumblr Support may be exposed. We recommend you review any correspondence you've addressed to support@tumblr.com, abuse@tumblr.com, dmca@tumblr.com, legal@tumblr.com, enquiries@tumblr.com, or lawenforcement@tumblr.com. Tumblr will never ask you for your password by email. Emails are easy to fake, and you should be suspicious of unexpected emails you receive. Your safety is our highest priority. We're working with law enforcement and Zendesk to better understand this attack. Please monitor your email and Tumblr accounts for suspicious behavior, and notify us immediately if you have any concerns.
- OGinparadise 14y agoAll kinds of sites, some supposedly super-secure, have been hacked. Now a serious question: What does this say for storing everything, including tax filings, in the Cloud?
- dirtyaura 14y agoI'm curious why you picked tax filings as an example of information that would be catastrophic to leak. Here in Finland tax information is public and it doesn't seem to be that bad. As you guess, yellow papers embarrasingly make yearly rankings of rich people and they lose some anonymity. But anybody that was in any way interested in their life likely knew that they were rich. I don't say that this Finnish practice of having public tax information is a good one, but it just shows that it's not the end of world. Leaked Tumblr support information that allows associating Tumblr blogs to email addresses can cause a similar level of agony that leaked tax information.
- eurleif 14y agoWhether your neighbor's tax information is also public might make a difference in how harmful it is for your tax information to be public.
- willvarfar 14y agoSame in Sweden. On balance, I think its actually a positive thing. Thinking about it and the few occasions I've seen it referred to, I think its a positive thing.
- jlmendezbonini 14y ago>I'm curious why you picked tax filings as an example of information that would be catastrophic to leak. I'm assuming that the original poster is from U.S. One reason why tax filling are considered sensitive is that they include the individual(s) social security number (SSN). This number is meant to be private and, since it's often used as an identifier, it's frequently used for identity theft. See the wikipedia article below. http://en.wikipedia.org/wiki/Social_Security_number#Identity_theft http://en.wikipedia.org/wiki/Social_Security_number#Identity...
- Argorak 14y agoI cannot access the page from germany: it immediately redirects me to the (german) front page. (Firefox 19, german edition)
- tomjen3 14y agoAnybody knows a good alternative? Leaking my personal info is one thing, loosing customers personal info is simply far too boneheaded to begin with.
- TallGuyShort 14y agoNobody is unhackable. They've dealt with this honestly . What makes you think any other service could make further guarantees?
- amw 14y agoSeconded. The sheer fact of the matter is that the state-of-the-art on offense is outpacing the state-of-the-art on defense. These guys didn't expose any password data, and evidently, not even the contents of the support cases (just the subject lines). That's small potatoes.
- webhostuk 14y agoReally a bad news at http://www.webhost.uk.net http://www.webhost.uk.net we used the same software but we are luck we migrated to http://www.thevisionworld.com http://www.thevisionworld.com and download license is the best option rather than saas.