Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gigabytes of user data from hack of Patreon donations site dumped online

arstechnica.com

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#101

Post by griffinmb »

6stringmerc wrote: post #100

Wow, I avoided Patreon because I didn't trust that all the music being hosted was following proper licensing and compensation rules (e.g. looked like >50% of songs were covers), so this is kind of a double shock to me about how they ran their operation. Believe it or not, this re-inforces my commitment to SoundCloud, which isn't monetized (yet), thereby keeping listeners' financial information off the table for the p…

I believe you are thinking of a different platform. Patreon is a Kickstarter-like site, but with a monthly pledge. It is not for music hosting.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#102

Post by andy_ppp »

the_mitsuhiko wrote: post #97
theintern wrote: post #95

Earlier quoted context omitted.

There's almost no hack needed here, as the article says, they basically opened up remote code execution to anyone. That's shockingly bad.

Makes me wonder what can be done to prevent this from happening without making it a terrible experience from a user point of view. Maybe the solution would be to store a password for the debugger and ask for it on first usage.

It said the guys name in the subdomain that this was available on. I can only imagine how that guy must feel, worst thing that I can imagine happening as a dev.

We've all made stupid mistakes and not paid a price as high as this!

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#103

Post by gozo »

the_mitsuhiko wrote: post #97
theintern wrote: post #95

Earlier quoted context omitted.

There's almost no hack needed here, as the article says, they basically opened up remote code execution to anyone. That's shockingly bad.

Makes me wonder what can be done to prevent this from happening without making it a terrible experience from a user point of view. Maybe the solution would be to store a password for the debugger and ask for it on first usage.

Command line flag, environment variable or interactive prompt could help. Maybe the interactive shell should be enabled separately from debug itself, since some only use debug for the exceptions. It could also explicitly try to figure out if it's running in production mode by detecting WSGI, disabling setting app.debug in favor of app.run or when listening on 0.0.0.0 and if not block that make you use "public_debug" or whatever.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#104

Post by dspillett »

RyanZAG wrote: post #71
dspillett wrote: post #66

Earlier quoted context omitted.

If the keys are only ever held in memory then getting a dump of all the stored data from all the database and font-end servers would not reveal the keys. To achieve that you would need human interaction to bring up a new box (or after an existing box is restarted) in order to hand over the keys (if the server could request the key from somewhere on the local network, then perhaps so can an attacker if they get access…

One more weak spot: if they have full access to the server, they can just dump the ram. This is incredibly simple to do on Linux for example. In a big company though, having that one developer with full keys to the kingdom and is the only way to start up new servers is obviously out of the picture. Especially if the system works by having the keys on an easily stolen or damaged laptop...

They keys would need to be much better looked after than that, of course. They just need to not be easily accessible from the machine they protect. You'd need a procedure in place so anyone with access to the relevant machines is able to obtain and use the keys as needed in an emergency.

Being able to dump RAM pretty much breaks the protection that this offers though, as you correctly point out.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#105

Post by paulmd »

anc84 wrote: post #55
dennisnedry wrote: post #34

Earlier quoted context omitted.

So content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?

Simple standard bank transaction? If you want to support the creator regularly, you can easily set that up as well.

I'm assuming you're a Euro - most places don't have giro transfers like you guys do.

A long time ago the US and the European financial systems diverged. The US banks optimized for check processing and credit cards, while the Euro banks optimized for bank transfers. Domestic bank transfers typically cost around $25-35 a pop and take several days to clear in the US. Checks usually post instantly but take about as long to clear - the time between it posting and clearing is basically a loan, and the check may still bounce. Until a few years ago, many banks didn't even allow you to do bank transfers online. Stores will sometimes use "electronic checks" where you provide a blank check and they read the account numbers off it, but this is just a shortcut to avoid handling the piece of paper. The funds are still moved through the checking system. These are not available to regular account-holders either.

That's why we come up with all these systems like Paypal and Patreon to move money around - the bank-level tools are cumbersome, slow, and expensive for us.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#106

Post by aikah »

paulmd wrote: post #90

All the data breaches lately have demonstrated the need for some kind of professional engineering license to ensure compliance with best practices. Even if your app is meaningless in and of itself, a data breach can reveal Personally Identifying Information or credentials for other sites and accounts. There's too much of a "code cowboy" mentality out there right now. As a community we've become very feature-driven an…

> All the data breaches lately have demonstrated the need for some kind of professional engineering license to ensure compliance with best practices

But these licenses already exist. And sites are still compromised, even government sites which are supposed to be hold to a higher standard.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#107

Post by 6stringmerc »

griffinmb wrote: post #101
6stringmerc wrote: post #100

Wow, I avoided Patreon because I didn't trust that all the music being hosted was following proper licensing and compensation rules (e.g. looked like >50% of songs were covers), so this is kind of a double shock to me about how they ran their operation. Believe it or not, this re-inforces my commitment to SoundCloud, which isn't monetized (yet), thereby keeping listeners' financial information off the table for the p…

I believe you are thinking of a different platform. Patreon is a Kickstarter-like site, but with a monthly pledge. It is not for music hosting.

No, I'm not mistaken, at all. I'm very clear on what I understand about Patreon.

If you want, you can probably get into the hacked data and see my email warning them that by being a financial conduit they were not abiding by Safe Harbors with respect to the real rights owners.

It may not have "hosted" the music, but if you click on the music page, what do you see? Music videos. Then Patreon was the method to give those people money. People who may or may not have secured the proper licenses and paid the original artists.

Also, if I was an artist on the site, my personal information would be part of that dump - SSN, etc - so my reluctance to engage with them was prudent.

Edit: Downvoting my observations? I guess there are more people here that don't understand copyright than I figure, oh well.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#108

Post by chatmasta »

I've never heard of Patreon until now. This might be the most press they've ever gotten. At what point do we start asking questions like, did this company "hack" themselves for the publicity? There is a great moral hazard in providing so much free publicity to companies that get "hacked."

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#109

Post by 6stringmerc »

chatmasta wrote: post #108

I've never heard of Patreon until now. This might be the most press they've ever gotten. At what point do we start asking questions like, did this company "hack" themselves for the publicity? There is a great moral hazard in providing so much free publicity to companies that get "hacked."

Unlikely, due to the rumored personal information of all the artists being compromised. That's not a rational avenue.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#110

Post by the_mitsuhiko »

gozo wrote: post #103
the_mitsuhiko wrote: post #97

Earlier quoted context omitted.

Makes me wonder what can be done to prevent this from happening without making it a terrible experience from a user point of view. Maybe the solution would be to store a password for the debugger and ask for it on first usage.

Command line flag, environment variable or interactive prompt could help. Maybe the interactive shell should be enabled separately from debug itself, since some only use debug for the exceptions. It could also explicitly try to figure out if it's running in production mode by detecting WSGI, disabling setting app.debug in favor of app.run or when listening on 0.0.0.0 and if not block that make you use "public_debug"…

> explicitly try to figure out if it's running in production mode

Does not help. The cases I saw in the past were people putting Werkzeug's stuff behind ngrok, proxies, nginx in which cases it will all look like local requests.

Post reply on HN