Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dell Computers Has Been Hacked

10zenmonkeys.com

Post reply on HN
Print view View original

41–50 of 218 posts

Re: Dell Computers Has Been Hacked

#41

Post by benevol »

imbellish wrote: post #15
nthitz wrote: post #11

Earlier quoted context omitted.

Axciom, Epsilon and similar companies track your credit card purchases and correlate them with a profile of who they think you are. If you work for a large corporation that is probably easier to identify than a small one. http://www.acxiom.com/ http://www.epsilon.com/

It's the isolating arm of capitalism drilling its elbow grease directly into your personal life.

Now think about what a company like Google or Facebook knows about you. And then ask yourself if you ever want to use their services again (besides those that everybody is forced to "use", such as GoogleAnalytics.).

Re: Dell Computers Has Been Hacked

#42

Post by janvidar »

josteink wrote: post #26
Johnny555 wrote: post #16

Earlier quoted context omitted.

Maybe its really high time for C and its buffer overflows to go... And SQL injection. Because no one ever wrote an insecure website in Java? And certainly PHP must also be completely safe since it has no buffer overflows to worry about. Are you sure the language is at fault?

Assuming an averagely careless programmer, a language made out of shotguns will produce more errors than a language with the occasional presence of shotguns. When simply trying to concatenate 2 strings can result in arbitrary code getting executed, memory leaks, actual data-loss or fatal program instability (or all of those), it's pretty obvious the C language itself is made out of shotguns. Making simple things simp…

C doesn't even have strings, but you would typically be using char arrays instead. All you need is a pointer to the array in order to access it. However, if you just have the pointer then you are lacking to essential pieces of information, the length of the string and the capacity of the string.

The length of the string is however by convention determined by the first NULL byte (zero termination), so it is important that there is a NULL byte within the bounds of the allocated array.

Concatenating two "strings", is not particularily difficult, it just needs to be done with care.

If you find it complicated, then you should not use C, nor should you use it for things it's not intended for.

Re: Dell Computers Has Been Hacked

#43

Post by jodrellblank »

ketralnis wrote: post #39
ommunist wrote: post #30

I'd rather bet that real Dell outsourced tech support to some company in India, where very often business ethics towards customer records is virtually non-existent. But what else can you expect? If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it. I seriously doubt that Dell tech support is ISO 27000 compliant.

What do I expect? I expect the people that I send sensitive data to to be able to protect it. Blaming their overseas offices and partners doesn't make it better or relieve them of responsibility. And Dell isn't some too-cheap-to-be-true, fly-by-night operation. Saying that their customers were basically asking for it is bollocks as well.

What do I expect? I expect the people that I send sensitive data to to be able to protect it.

Desire, maybe, but expect? That's so far from reality are there any grounds for expecting that these days? Has any company successfully kept /all/ sensitive data from hackers?

Re: Dell Computers Has Been Hacked

#44

Post by z3t4 »

I don't know about you, but where I live (Sweden) there are strict rules on how you can store personal data and who has access to it. It's also against the law to put people in "databases". I guess we still remember WW2 and how the Nazi used such registers ...

Re: Dell Computers Has Been Hacked

#45

Post by dogma1138 »

I actually wonder if Dell was hacked or this is some 3rd party info sharing that got leaked the old fashion way.

The problem with these types of cold call scams is that they do not scale, it seems a bit odd that a group could target a company the the likes of Dell would resort to such tactics (And yes I am fully aware that they could've breached Dell and sold the data but then I'm not sure that phone scammers would be in their price range).

My bet would be on a 3rd party losing some data or getting hit, or even just employees doing it the really old fashion way print out couple of 1000's of profiles and go to work your operation most likely wont scale much beyond that anyhow.

But in general allot of that info could've been fished even the Dell support tag. Dell's own support website has an auto detect feature that scans for it on your machine it supports .NET HTTP distro app, ActiveX and a few other plugin methods and if you have the Dell Support bloat ware installed I think even JavaScript could potentially work.

(Don't remember if Dell was affected but over the years multiple laptop vendors were found to leak support info over LAN/Ethernet as they run various services both during boot and later through the bloatware they ship the machines with)

If you have the support tag you usually can access old tickets opened on that tag either online or by social engineering their support team (With IBM support in the UK if you have the S/N you'll see all past tickets in their system) the rest of the data like name and phone numbers can be found out quite easily.

So if you want to scam people by pretending to be Dell support you should be able to do it without actually needing access to their customer DB.

Re: Dell Computers Has Been Hacked

#46

Post by geocar »

It doesn't sound like Dell has been very effective here: likely attackers downloaded the database raw or it's one of their many contractors who log in remotely. Last time I saw that interface it was a web form that someone could access from any machine!

This is serious.

If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a zero-tolerance policy. This isn't trivial to set up, but it's necessary; The CTO is responsible here, not some "website hackers".

Re: Dell Computers Has Been Hacked

#47

Post by chaostheory »

tzs wrote: post #40
ommunist wrote: post #30

I'd rather bet that real Dell outsourced tech support to some company in India, where very often business ethics towards customer records is virtually non-existent. But what else can you expect? If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it. I seriously doubt that Dell tech support is ISO 27000 compliant.

> If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it From what I can see from a bit of Googling, Dell does pay their tech support people decent money. If Glassdoor is to be believed [1] [2], Dell tech support people in India make about 340k rupees a year, or about 28k per month. That appears to be a middle class income for an Indian city…

ommunist can correct me but I believe he was referring to having Dell tech support being located in a western country, instead of being based in asia. Yes it's more expensive to keep operations here, but we are more familiar with the business practices as well as the laws. Of course this is a price of "the race to the bottom".

Re: Dell Computers Has Been Hacked

#48

Post by Animats »

viraptor wrote: post #22
adventured wrote: post #10

Earlier quoted context omitted.

> People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Not quite sure I understand your premise on that one. You can't stop people from pretending to be from the IRS any more than you can stop criminal activity by outlawing it. Essentially anyone can call anyone else and pretend to be from a government agency. Ultimately you're going to have to verify that or otherwis…

These scams rely on nobody tracing them back. The phone system is completely insecure, loses are too small to prosecute properly, and it hits mostly people who don't know how to defend themselves. The whole idea of unauthorized phone systems and impersonating officials is probably only going to go away after it actually hits someone who "matters". For example soon after a well known politician's house gets swated a f…

SS7, which carries telephony routing and ID info, doesn't have anything like message signing or SSL certs. It was designed with the assumption that telcos trusted each other. Then came VoIP, and with it, signal transfer points which forward call ID info. There's firewall-type filtering at signal transfer points, but it doesn't help much with validating the original source of a call.

Re: Dell Computers Has Been Hacked

#49

Post by DrScump »

ommunist wrote: post #30

I'd rather bet that real Dell outsourced tech support to some company in India, where very often business ethics towards customer records is virtually non-existent. But what else can you expect? If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it. I seriously doubt that Dell tech support is ISO 27000 compliant.

At one point in the 1990s, Dell shifted all of its tech support to India, ruining its world-class staff in Round Rock (TX).

Complaints got so bad that they re-established the Round Rock organization for corporate customers; retail buyers were still stuck with the offshore staff.

Re: Dell Computers Has Been Hacked

#50

Post by rms_returns »

geocar wrote: post #46

It doesn't sound like Dell has been very effective here: likely attackers downloaded the database raw or it's one of their many contractors who log in remotely. Last time I saw that interface it was a web form that someone could access from any machine! This is serious. If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a z…

Second this. In fact, I would rather argue that its better to stop forcing online registration of computers until the privacy of those who register is guaranteed. Its not as if registration is even needed, they already have a tag attached to each device, so they can track sales using that.

On the other hand, this problem is not specific to only Dell. Take the online web-forms of any other major Tech seller like Asus, Samsung, Motorola or HTC and their website sucks. Almost every one of them looks poorly designed and unprofessional which is more worrying.

Post reply on HN