Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gigabytes of user data from hack of Patreon donations site dumped online

arstechnica.com

Post reply on HN
Print view View original

41–50 of 151 posts

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#41

Post by JulianMorrison »

Udo wrote: post #32

There is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally,…

Yeah. I feel like an ideal architecture would be to use NSQ and transmit not queries, but a minified JSON bundle of query "name" with query parameters. Then have stateless DB service nodes preloaded with canned, named queries on secured VMs whose only access to the outside world is NSQ. Bonus, you can tap off DB requests with an ephemeral channel and log them.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#42

Post by icebraining »

Udo wrote: post #32

There is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally,…

If the frontend layer needs to access the data anyway, how does that separation help? And why is it easier to monitor for unusual activity?

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#43

Post by indiv0 »

dennisnedry wrote: post #34
anc84 wrote: post #30

The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?

So content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?

Bitcoin would be the obvious choice.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#44

Post by jhh »

I had just been listening to the "Talk Python to Me" podcast episode with Albert Sheu of Patreon (http://talkpython.fm/episodes/show/14/moving-from-php-to-pyt...). Having heard the guy's voice and his enthusiasm for his work makes me really feel sorry for the team at Patreon. This is pretty much worst case and may end the company.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#45

Post by RyanZAG »

atmosx wrote: post #29
reidrac wrote: post #18

Earlier quoted context omitted.

I guess we could argue that if you get security seriously enough you don't get hacked. EDIT: I was being sarcastic. This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process...

No actually we don't. Security, if taken seriously is a set of policies related to software and hardware (in the post-Snowden era). Applying patches like grsecurity, running services through chroot jails, installing IDS systems and reporting tools makes a system (every system) extremely inflexible. Updates become nightmare. Tuning a system to avoid false positives might take a forever and then the topology/setup/clie…

Agree completely. To take it a step further - even if you assume that you have all of the above locked down and have inspected all of your servers - someone still has to connect to those servers.

Let's assume they are connecting using an iOS device or OSX on a Mac to run commands on the server. As everyone knows, Apple devices allow full root access from the cloud for Apple to install new applications etc. These same backdoors can often be exploited [1] or leveraged by governments. If we assume an attacker has full control of the laptop the devops engineer is using to secure the system it becomes trivial for him to insert a backdoor in the servers too.

[1] https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-...

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#46

Post by raesene4 »

icebraining wrote: post #14
steckerbrett wrote: post #4

That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.

How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

You can't :)

There is a huge Market for Lemons (https://en.wikipedia.org/wiki/The_Market_for_Lemons) style scenario in IT systems with relation to security.

Everyone will say "we take security seriously", but there's no way for ordinary consumers (or indeed most companies) to determine what the company meant by their statement, and to evaluate the relative security of the systems of two companies.

This could actually provides a market incentive for companies not to spend too much on security, as those that do will have lower profits than those that don't.. until they get breached, and even then companies with good security can be breached...

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#47

Post by raesene4 »

jhh wrote: post #44

I had just been listening to the "Talk Python to Me" podcast episode with Albert Sheu of Patreon ( http://talkpython.fm/episodes/show/14/moving-from-php-to-pyt... ). Having heard the guy's voice and his enthusiasm for his work makes me really feel sorry for the team at Patreon. This is pretty much worst case and may end the company.

I like patreon a lot and feel sorry that they've been breached. Luckily (for them) I'd guess that with the number of breaches these days, the negative publicity on them will be a lot less than it would have been a couple of years back, so hopefully they'll be able to carry on ok.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#48

Post by [deleted] »

atmosx wrote: post #29
reidrac wrote: post #18

Earlier quoted context omitted.

I guess we could argue that if you get security seriously enough you don't get hacked. EDIT: I was being sarcastic. This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process...

No actually we don't. Security, if taken seriously is a set of policies related to software and hardware (in the post-Snowden era). Applying patches like grsecurity, running services through chroot jails, installing IDS systems and reporting tools makes a system (every system) extremely inflexible. Updates become nightmare. Tuning a system to avoid false positives might take a forever and then the topology/setup/clie…

[deleted]

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#49

Post by Axsuul »

jhh wrote: post #44

I had just been listening to the "Talk Python to Me" podcast episode with Albert Sheu of Patreon ( http://talkpython.fm/episodes/show/14/moving-from-php-to-pyt... ). Having heard the guy's voice and his enthusiasm for his work makes me really feel sorry for the team at Patreon. This is pretty much worst case and may end the company.

Why do you think it'll end the company? It's a marketplace with network effects. And not to mention, many people depend on Patreon for their primary source of income. It won't simply just go away.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#50

Post by mpeg »

JulianMorrison wrote: post #41
Udo wrote: post #32

There is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally,…

Yeah. I feel like an ideal architecture would be to use NSQ and transmit not queries, but a minified JSON bundle of query "name" with query parameters. Then have stateless DB service nodes preloaded with canned, named queries on secured VMs whose only access to the outside world is NSQ. Bonus, you can tap off DB requests with an ephemeral channel and log them.

That sounds like SOAP + SQL Server stored procedures (full replication mode to log db requests, then monitor any SQL queries). I'm assuming other vendors have similar set ups.

I've ran systems like that, and I'm glad things are a lot easier to maintain now (stored procs are a pain in the ass, whether they exist in the database or in the app layer).

Query injection is solved by parameterising queries (never sanitising them yourself), it should not be an issue nowadays, "advanced SQL injection" is a lie, either you can inject or you can't.

If you can inject, it doesn't matter how many protections you put in place, you can always extract data via timing attacks or boolean conditions.

Post reply on HN