Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gigabytes of user data from hack of Patreon donations site dumped online

arstechnica.com

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#111

Post by untilHellbanned »

kevinnk wrote: post #35
dublinclontarf wrote: post #22

I'm wondering what their setup is? Are they running on their own machines? AWS? Heroku? From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node. I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.

Looks like they use AWS, MySQL, and Python. They also use Stripe for payments (all their secret keys and source are in the dump).

wait, they store their Stripe API keys in their database?

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#112

Post by [deleted] »

raesene4 wrote: post #46
icebraining wrote: post #14

Earlier quoted context omitted.

How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

You can't :) There is a huge Market for Lemons ( https://en.wikipedia.org/wiki/The_Market_for_Lemons ) style scenario in IT systems with relation to security. Everyone will say "we take security seriously", but there's no way for ordinary consumers (or indeed most companies) to determine what the company meant by their statement, and to evaluate the relative security of the systems of two companies. This could actual…

[deleted]

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#113

Post by lt »

deanCommie wrote: post #21

This is the first time I've been Pwned ( https://haveibeenpwned.com/ ) Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?

Through the API: https://haveibeenpwned.com/api/v2/breachedaccount/foo@bar.co...

I also couldn't find the details in the site anywhere.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#114

Post by yrro »

ceejayoz wrote: post #75
rjtavares wrote: post #26

Earlier quoted context omitted.

The same way you do it for medical negligence: courts.

I'd really rather not see web developers have to carry malpractice insurance and be licensed by state boards.

I really think web^W developers should up their game if they want to avoid this fate.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#116

Post by nitrogen »

clebio wrote: post #86

This just got me thinking, which would be worse -- your account data from any one site leaked, or metadata about your internet activities leaked? Thinking about the arguments about mass data collection and metadata, I'm pretty certain I'd be most worried about metadata. Do metadata-collecting companies tend to be more secure, or more security aware, or it just hasn't happened yet? What I mean is, if your private brow…

AIUI most states don't require breaches to be announced unless they get some combo of credit cards, passwords, email/name/phone, and govt' IDs. So metadata spying companies like Adobe/Omniture might never report being hacked at all.

Frankly it bothers me how lackadaisically business types treat security sometimes, caring more about company image than customer privacy, to the point of never revealing massive breaches if they don't hit states' ridiculous requirements for disclosure.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#117

Post by nissehulth »

mwarkentin wrote: post #92

Apparently they were compromised via a publicly exposed Werkzeug debugger: http://labs.detectify.com/post/130332638391/how-patreon-got-...

If bored, perform a shodan search like https://www.shodan.io/search?query=werkzeug and check all the results for enabled debug...

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#118

Post by jzd »

the_mitsuhiko wrote: post #110
gozo wrote: post #103

Earlier quoted context omitted.

Command line flag, environment variable or interactive prompt could help. Maybe the interactive shell should be enabled separately from debug itself, since some only use debug for the exceptions. It could also explicitly try to figure out if it's running in production mode by detecting WSGI, disabling setting app.debug in favor of app.run or when listening on 0.0.0.0 and if not block that make you use "public_debug"…

> explicitly try to figure out if it's running in production mode Does not help. The cases I saw in the past were people putting Werkzeug's stuff behind ngrok, proxies, nginx in which cases it will all look like local requests.

Not true. For example nginx can use the proxy_pass directive to forward real IP address information and log it

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#119

Post by masonicb00m »

ceejayoz wrote: post #75
rjtavares wrote: post #26

Earlier quoted context omitted.

The same way you do it for medical negligence: courts.

I'd really rather not see web developers have to carry malpractice insurance and be licensed by state boards.

On the bright side, maybe we'd get to append "W.D." to our signatures.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#120

Post by 6stringmerc »

facetube wrote: post #115

Hey, guess what? To delete your account, you have to e-mail delete@patreon.com "from your registered e-mail address". There is no way to do it over a secure connection. What could go wrong?

Not sure why you're being downvoted other than expressing doubt at the decisions Patreon has made / is making with respect to best practices. I'm getting slammed for understanding and pointing out they've had some suspect practices in the past based on copyright law in music. Shrug
Post reply on HN