Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Weebly hacked, 43M credentials stolen

techcrunch.com

Post reply on HN
Print view View original

41–50 of 99 posts

Re: Weebly hacked, 43M credentials stolen

#41

Post by drusenko »

tptacek wrote: post #39
nso wrote: post #34

Earlier quoted context omitted.

nd of course the email adress should be encrypted (2 way)

Anyone who tells you they're "encrypting" email addresses in their SaaS app is almost certainly describing a cosmetic security feature. Every day of the week and four times and Tuesday I'd prefer the team that spends their marginal dollar on finding the next marginal reflected XSS bug than the one that wastes it on "two-way encryption of email addresses". I don't know what Weebly does for appsec (I've never worked wi…

In terms of appsec, we run quarterly black box pen tests and annual comprehensive white box pen tests with well regarded firms, and have been rotating vendors on a regular basis for diversity. We also do a lot of stuff internally, like regular scanning, and internal sprints focused on vuln detection. We've been doing this for years. That's not to say we're perfect (we clearly are not) but we do take it seriously.

Re: Weebly hacked, 43M credentials stolen

#42

Post by dsacco »

Puts wrote: post #40
drusenko wrote: post #14

Obviously, this is a very disappointing situation for us -- we've always taken security very seriously since day 1, it's something that's been core to who we are from the beginning. That said, how you respond in this situation can be just as important, and so we are making sure to be incredibly proactive in addressing the situation & transparent in how we communicate the details with our customers. Our top and immedi…

"we've always taken security very seriously since day 1" No you have not because then this would not have happened. The only one who should be able to query passwords from the database should be the DBA. Everyone else should only be able to validate against it. So either it's an inside job by your DBA, or you thought your users security was less important then avoiding the friction such high security standards would…

Security is hard. It is very possible to take it seriously, do many things right (perhaps everything right, insofar as it's in your power), and still have your company end up in a headline like this.

You can parameterize your queries until you're blue in the face, but that won't help you if the right employee is phished (for example). This is an inherently imperfect and chaotic world, and it's unrealistic to assume that you're insulated from these scenarios just because you locked down database access correctly.

Personally, I believe David when he says Weebly takes security very seriously.

Re: Weebly hacked, 43M credentials stolen

#43

Post by dsacco »

teej wrote: post #31
matt_wulfeck wrote: post #20

Earlier quoted context omitted.

Bonus points for mentioning the hashing algo and for not confusing "hashed" with "encrypted".

That incident response firm seems to be worth it.

Weebly's team made the conscious decision to use security protections like bcrypt hashing on passwords, and they've been doing that for a long time (years). They're well aware of security best practices, and that did not come out of work with an incident response team for discovery.

Re: Weebly hacked, 43M credentials stolen

#44

Post by joncalhoun »

ryanburk wrote: post #12
cyberferret wrote: post #4

Earlier quoted context omitted.

Well, the breach was back in February this year, so I hope they have put better security in place since then. I've seen ads for Weebly all over the place, but never realised they had that many users. Good luck with your application... :)

accounts doesn't mean the same thing as current or active users. a company very likely doesn't delete accounts right away or at all, even if the service has been cancelled. for example, a few years ago microsoft's live ID system had well over a billion accounts. but MAU was only around 450M. and that is with culling / deleting accounts after a year if they were unused.

While I agree the two are different, I also think in weeks case accounts could translate into multiple users. I know for a fact that my wife and her sister both share a weebly account for their business and I believe they have to share a login to do this.

Re: Weebly hacked, 43M credentials stolen

#45

Post by drusenko »

kitanata wrote: post #26
drusenko wrote: post #14

Obviously, this is a very disappointing situation for us -- we've always taken security very seriously since day 1, it's something that's been core to who we are from the beginning. That said, how you respond in this situation can be just as important, and so we are making sure to be incredibly proactive in addressing the situation & transparent in how we communicate the details with our customers. Our top and immedi…

Just tried updating my password for my weebly account. It appears this functionality is broken. It keeps telling me that "Your current password must be correct". I logged in and out with the same password a couple times to confirm I'm not crazy.

Can you email me at david@weebly.com? We looked into this shortly after you posted this comment and can't replicate (also not receiving other complaints)... If you can email me we'll get to the bottom of it -- thanks for letting us know!

Re: Weebly hacked, 43M credentials stolen

#46

Post by dsacco »

markdown wrote: post #18
drusenko wrote: post #14

Obviously, this is a very disappointing situation for us -- we've always taken security very seriously since day 1, it's something that's been core to who we are from the beginning. That said, how you respond in this situation can be just as important, and so we are making sure to be incredibly proactive in addressing the situation & transparent in how we communicate the details with our customers. Our top and immedi…

Can't blame you for being hacked, but how can security be "core to who we are" if it took 6 months to discover a breach?

In a perfect world companies would recognize and react to security breaches almost as soon as they happen. But if you have ever managed the logging pipeline or incident response practice for a company, you understand that this is deeply unrealistic.

There is virtually no company which discovers that it has been breached within a short period of time - the nature of a security breach is such that it doesn't generally become apparent until some time later. This pattern continually plays itself out with just about every large breach you can think of.

In that respect, considering Weebly actually hashed their passwords with bcrypt and is reacting to the breach in the same year, they're fairly far ahead of the curve on this one.

Re: Weebly hacked, 43M credentials stolen

#47

Post by houssc »

Puts wrote: post #40
drusenko wrote: post #14

Obviously, this is a very disappointing situation for us -- we've always taken security very seriously since day 1, it's something that's been core to who we are from the beginning. That said, how you respond in this situation can be just as important, and so we are making sure to be incredibly proactive in addressing the situation & transparent in how we communicate the details with our customers. Our top and immedi…

"we've always taken security very seriously since day 1" No you have not because then this would not have happened. The only one who should be able to query passwords from the database should be the DBA. Everyone else should only be able to validate against it. So either it's an inside job by your DBA, or you thought your users security was less important then avoiding the friction such high security standards would…

Seriously dude? People fuck up all the time, it doesn't mean the company doesn't take security seriously. Furthermore taking something seriously and being successful at your serious undertaking are different things.

Re: Weebly hacked, 43M credentials stolen

#48

Post by Puts »

dsacco wrote: post #42
Puts wrote: post #40

Earlier quoted context omitted.

"we've always taken security very seriously since day 1" No you have not because then this would not have happened. The only one who should be able to query passwords from the database should be the DBA. Everyone else should only be able to validate against it. So either it's an inside job by your DBA, or you thought your users security was less important then avoiding the friction such high security standards would…

Security is hard. It is very possible to take it seriously, do many things right (perhaps everything right, insofar as it's in your power), and still have your company end up in a headline like this. You can parameterize your queries until you're blue in the face, but that won't help you if the right employee is phished (for example). This is an inherently imperfect and chaotic world, and it's unrealistic to assume t…

I'm kind of tired of the "Security is hard, every one gets hacked eventually and we are just victims" mentality. This is not true. Why don't we see peoples banking information plastered over the web every month? That if something would be a high value target. No, it's always these Web 2.0 services this happens to. Now, you could argue that a small SAAS service can not possibly afford security as rigorous as a bank, but guess what, if you are going to handle peoples information, and don't have the assets to protect it, then maybe your business is not viable enough?

Re: Weebly hacked, 43M credentials stolen

#49

Post by sroussey »

jc4p wrote: post #19
hueving wrote: post #13

Earlier quoted context omitted.

Organizations that heavily rely on git? It might seem trivial to you, but the last thing I want in a CI/CD pipeline is senior engineers that don't understand the underlying technology. Believe me, I've interviewed lots of people for senior positions that just haven't had to properly learn revision control. It's not a given.

Perhaps I should've gone in more detail. I'm not upset about them wanting people who are proficient in git, I'm saddened that the job listing doesn't mention anything about what a Senior Android Developer does at Weebly. The only Android related things on the job listing are proficiency with the IDE (Android Studio) and generic "frameworks". I am an Android engineer, I clicked this job listing earlier today when it w…

What are your suggestions?

Re: Weebly hacked, 43M credentials stolen

#50

Post by sroussey »

hiou wrote: post #28
hueving wrote: post #13

Earlier quoted context omitted.

Organizations that heavily rely on git? It might seem trivial to you, but the last thing I want in a CI/CD pipeline is senior engineers that don't understand the underlying technology. Believe me, I've interviewed lots of people for senior positions that just haven't had to properly learn revision control. It's not a given.

How long would you estimate it takes someone to "properly learn version control"? When I work with very junior developers they pick up git quite well in a week or two at most. Beyond that almost every team I work with uses their own special homegrown git workflow anyway. I don't mean to put you down for you requirements but git is really really easy to learn. It would be a shame to miss out on a talented developer fo…

What is bad in job listings is made up in the trial week:

https://www.sequoiacap.com/article/trial-week-our-hiring-sec...

Post reply on HN