9 ms·
Ask HN: Buffer got hacked - does anyone know details?
It seems like @buffer got hacked.
https://twitter.com/search?q=%40buffer&src=typd&f=realtime
The guys seem to be on it.
Last information: They confirmed they got hacked turned of publishing and they are investigating the issue.
- iriche 13y agoI posted something on Facebook too it seemed, removed it instant. But yeah, kind of makes you think twice of what services to use
- dylanhassinger 13y agoshit happens buffer rocks and is handling this in an A+ way
- tokanizar 13y agoI don't think you can find a service that makes a promise that they will never got hacked or be down. Common, look at what they've done to the situation.
- edcrfv 13y agoAll our recent posts on social media (facebook, twitter) via buffer seem to have been automatically deleted. That's a lot of engaging posts, gone in a poof!
- iriche 13y agoSo it seems that they deleted all old posts without checking source?
- cloudwalking 13y agoNo, they just temporarily disabled their FB app. Once they re-enable, the posts should reappear...
- darwinia 13y agoHow can the posts reappear? Aren't they just pushed and then stored on the FB database?
- thomasdavies 13y ago"We've temporarily disabled our app for Facebook. All previous Buffer posts on FB are hidden for now. We'll update again soon. - Carolyn" Source: https://twitter.com/buffer/status/394182270522646529 https://twitter.com/buffer/status/394182270522646529
- leowidrich 13y agoI greatly apologize for the mess. Thanks for posting this! We're looking into this right now. - All FB posts via Buffer are temporarily deleted. They will reappear again once we've enabled the FB app again (which we'll do once we're sure we're not compromised anymore). - All Tweets are also stopped from sending. We'll keep you updated from the @Buffer twitter and FB account. - Leo
- FredericJ 13y agoDo you know what has been compromised? How do you store the Buffer passwords? SHA1(password+salt)?
- mnordhoff_ 13y agoPublic Service Announcement: "SHA1(password+salt)" is an extremely unsafe way to store passwords. Use PBKDF2, bcrypt or scrypt. Edit (T+7 minutes): Rewritten to not be a jerk.
- darkarmani 13y agoI know that PBKDF1 is deprecated, but using SHA1 is an upgrade to PBKDF1 which was once the standard. I'm not sure if "extremely unsafe" is the right level of worry. You can still do iterations to make the hashing slower, if for some reason you don't do the right thing and use the methods you listed.
- julien_c 13y agoExtremely unsafe? Care to explain why?
- MasterScrat 13y agoRead this: How To Safely Store A Password http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- nucleardog 13y ago
- ericabiz 13y agoThey're asking people to revoke Buffer as an app: https://www.facebook.com/bufferapp/posts/566007046805080 https://www.facebook.com/bufferapp/posts/566007046805080 Brutal. Once you revoke it, there's little to no chance that you're going to re-invoke it. I've seen stuff like this get ugly in the past [1] -- I really like and respect the Buffer founders and hope they can recover from this. [1]: http://en.wikipedia.org/wiki/Gnolia http://en.wikipedia.org/wiki/Gnolia
- dylanhassinger 13y agopeople love buffer we'll re-invoke it
- AznHisoka 13y agoUnfortunately not everyone is as forgiving.
- jamesaguilar 13y agoThat said, HN pathologically overestimates the impact of mistakes that companies make. It probably won't be as bad as people say here.
- AznHisoka 13y agoTrue. In the end, they'll lose a LOT of free users who won't bother to reactivate Buffer. A good % of paid users might stay. Hell, that might even be a net benefit - less resources to devote to supporting the free users.
- chmars 13y agoI will certainly use Buffer App again. For the same reason I used Buffer App before this incident. That might be easier because my accounts were not affected. In addition, the Buffer App team seems to be working hard to resolve the incident. Security issues are unpleasant but unavoidable.
- 13y ago
- antr 13y agoI'm sorry for the Buffer team, it's not going to be a fun Saturday. The Buffer team is superb, both on product and customer service, so I'm sure things will be sorted out pretty quickly.
- denzil_correa 13y agoBuffer is a great app, particularly for Twitter. I use it regularly across all devices. I don't use it for Facebook though. I haven't observed anything untoward on my Twitter account. I am tempted to temporarily revoke app permissions on Twitter though.
- nav 13y ago@fredwilson account also got hacked. batch.me anyone (product plug ;)
- gregimba 13y agoIn my opinion its poor form in my opinion to be plugging your product here.
- nav 13y agoAgreed. Unf. can't delete what I posted - didn't mean the plug in a malicious way. Buffer is a far superior and loved product (I/friends use it). batch.me is a small weekend experiment a few friends and I put together about a year ago. PS: Buffer team is doing an incredible job trying to put out this fire - so props.
- nwh 13y agoCan anybody explain weight loss spam to me? Is it just to gain credit card details, advertising clicks?
- deweerdt 13y ago>Accounting for how much spam actually reaches the inbox, we estimate that only about 1 in 25,000 people needs to succumb to the temptation to make a grey-market purchase to make it pro table for spammers to inundate everyone with advertisements at current levels. http://www.davidreiley.com/papers/SpamEconomics.pdf http://www.davidreiley.com/papers/SpamEconomics.pdf
- lesterbuck 13y agoThanks for the link, that's a fascinating paper. One thing that drives me nuts about that paper format (a LaTEX template, I guess) is that it doesn't have a date. And this happens a lot. If the topic was an abstract mathematical concept, evergreen and timeless, then the date isn't so important. But a paper about spam that is vague on the date? I don't understand. That field is always changing, and I presume the economics are changing, too.
- graue 13y agoPublished in February 2012, revised in June 2012, according to this: http://www.davidreiley.com/papers/SpamEconomics.html http://www.davidreiley.com/papers/SpamEconomics.html
- PeterisP 13y agoThis is rather typical, because when you prepare a paper you don't yet know the publication date, so your submitted/final version can't include any date, but the published version tends to be behind a paywall.
- lost-theory 13y agohttp://www.slate.com/articles/business/moneybox/2013/07/how_one_weird_trick_conquered_the_internet_what_happens_when_you_click_on.html http://www.slate.com/articles/business/moneybox/2013/07/how_...
- borski 13y agoBuffer is handling this exceptionally well; I'm impressed and it isn't easy. We've caught bugs that lead to this sort of exploitation in the past, so if anyone from Buffer is reading this: we're happy to help you out and offer a few free months of website security scanning while you figure out exactly what happened. Just email me at borski@tinfoilsecurity.com
- iriche 13y agoJust got this email: Hi there, I wanted to get in touch to apologize for the awful experience we've caused many of you on your weekend. Buffer was hacked around 1 hour ago, and many of you may have experienced spam posts sent from you via Buffer. I can only understand how angry and disappointed you must be right now. Not everyone who has signed up for Buffer has been affected, but you may want to check on your accounts. We're working hard to fix this problem right now and we're expecting to have everything back to normal shortly. We're posting continual updates on the Buffer Facebook page and the Buffer Twitter page to keep you in the loop on everything. The best steps for you to take right now and important information for you: Remove any postings from your Facebook page or Twitter page that look like spam Keep an eye on Buffer's Twitter page and Facebook page Your Buffer passwords are not affected No billing or payment information was affected or exposed All Facebook posts sent via Buffer have been temporarily hidden and will reappear once we've resolved this situation I am incredibly sorry this has happened and affected you and your company. We're working around the clock right now to get this resolved and we'll continue to post updates on Facebook and Twitter. If you have any questions at all, please respond to this email. Understandably, a lot of people have emailed us, so we might take a short while to get back to everyone, but we will respond to every single email. - Joel and the Buffer team
- abracar 13y agoOutstanding email. Being hacked sucks but Buffer is handling it very well, at least communication-wise.
- jlees 13y agoHmm, I was affected (my twitter account sent a spam post) but I didn't receive an email. I only found out about it via HN. :/
- jc4p 13y agoSame here, I found out from text messages from friends this morning saying my Facebook had been hacked, but no e-mail from them and the "Delete Account" functionality on their website does nothing.
- 13y ago
- swatkat7 13y agoThey have since disabled the Facebook app.
- langer 13y agoKudos to Joel, Leo and the team for how they're handling it so far. The speed with which Joel had a comprehensive email update out to every user was impressive. I hope they resolve it soon.
- zaidf 13y agoHow did they store the Facebook Graph tokens in the db? It's akin to a password so here's hoping they used 2-way encryption.
- OoTheNigerian 13y agoBefore rushing to disable, do note: All updates have been paused. Passwords and payment information have NOT been compromised. -- It would be sorted out in a bit.
- pearjuice 13y agoAs bad publicity is publicity too; what is Buffer if I may ask? First time I heard of it.
- nathas 13y agoBuffer is a service where you can link your Twitter/Facebook/etc accounts and share them at timed intervals. It "buffers" your updates for you so you can release them on a specific timeline.
- tehwalrus 13y agoMy twitter account seems unaffected - I've disabled the app in setting for now though. (I will be re-enabling ASAP - I use this app a lot!)
- brackin 13y agoThere were no spam posts no the 5 accounts I've enabled so doesn't seem to effect everyone.
- joelgascoigne 13y agoSorry about this everyone, I know we messed up a lot of peoples' weekends. We're working pretty hard to get to the bottom of everything. Let me know if you have questions, I'll try and answer them all.
- boy88 13y agoHi Joel, any thing you would recommend other devs who're connecting with facebook or any other social media API to look into? maybe you can share what you guys have learned reg: security and how to do it better from this
- joelgascoigne 13y agoThe best thing we've learned here is to enable a setting Facebook has called "Require AppSecret Proof for Server API calls". They actually have a lot of great security features which we've not been making use of.
- chime 13y agoI think considering the gravity of the situation, you and your team has handled this nightmare pretty well so far. Any of us who write software could end up in a similar situation - be it caused by a small configuration mistake, a slightly out of date 3rd party library, or a skilled, determined attacker. When I see a local credit union site written in VBScript get hacked, I don't worry too much because it was probably riddled with SQL-injection bugs that any script kiddie can exploit. However, I know that you guys take data security seriously (you and I Skyped a while ago) and yet this happened. That's what worries devs like me the most. I think it would be very helpful to us all (including many of your tech-savvy users) if you would write a detailed blog entry describing what actually happened and how. I believe you're encrypting tokens now but how did they get exposed in the first place? Was it a framework issue? Unhandled exceptions? Wrong chmod on a log file? New employee hooking up trojan'ed PC to your internal network? Here's hoping you feel comfortable in sharing.
- tomphoolery 13y agoHere's the full, official response from Buffer: http://open.bufferapp.com/buffer-has-been-hacked-here-is-whats-going-on/ http://open.bufferapp.com/buffer-has-been-hacked-here-is-wha...
- titomc 13y agoGlad I used desktop twitter management apps like this one http://bit.ly/auto_app http://bit.ly/auto_app
- morgante 13y agoI really feel for the Buffer team. They make an awesome product and it's hard to prevent things like this, especially when social media doesn't generally have great security right now. Though I don't want to be crass, I can't help but mention that I'm working on a project to help minimize the damage from these sorts of things. Would be interested in any feedback. (http://socialsecurity.io http://socialsecurity.io)
- deleted 13y ago[deleted]
- homakov 13y agoProviders should create anti-spam system, so when Clients get hacked they don't receive tons of spam on users' walls