Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opera server breach incident

opera.com

Post reply on HN
Print view View original

1–10 of 19 posts

Re: Opera server breach incident

#4

Post by cyberferret »

I am always intrigued by a lot of these announcements that clarify that only 'some' of the user information was obtained by the infiltrators.

I would have assumed that if a database was breached, then the bad guys could access the entire user or password hash table? Would 'only some' data mean that they detected a 'SELECT * FROM users' query being run and shut down the connection before it could complete? Is it the database sharding they use which means the entire table is not visible at one time?

I'd be interested to hear more about technique or technologies available to prevent global queries to scrape entire tables once someone has gained access to your database.

Re: Opera server breach incident

#7

Post by taspeotis »

cyberferret wrote: post #4

I am always intrigued by a lot of these announcements that clarify that only 'some' of the user information was obtained by the infiltrators. I would have assumed that if a database was breached, then the bad guys could access the entire user or password hash table? Would 'only some' data mean that they detected a 'SELECT * FROM users' query being run and shut down the connection before it could complete? Is it the d…

Say there's two tables, users and user_preferences. Someone goes in, takes the contents of users (hashes and salts and all). Only some of the user information was obtained!

Re: Opera server breach incident

#8

Post by moonshinefe »

cyberferret wrote: post #4

I am always intrigued by a lot of these announcements that clarify that only 'some' of the user information was obtained by the infiltrators. I would have assumed that if a database was breached, then the bad guys could access the entire user or password hash table? Would 'only some' data mean that they detected a 'SELECT * FROM users' query being run and shut down the connection before it could complete? Is it the d…

Not every user has access to every table or database. So if a company separates such things based on various categories, brandnamecars.com's hacker exploited account might get all the car users' credentials, but not the case for brandnametrucks.com, who had a separate table or database, and restricted the brandnamecars.com user account properly with permissions so it couldn't get that info, even if the same server handles both the databases or tables.

Re: Opera server breach incident

#9

Post by moonshinefe »

digi_owl wrote: post #2

Is it just me, or have there been an uptick in such activity recently?

if the news has been any indication on TV in the last couple decades I've experienced, it's often hard to tell if things are actually getting bad vs. if things are actually just getting reported a certain way and with more volume.
Post reply on HN