Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker Has Wiped a Spyware Company’s Servers

motherboard.vice.com

Post reply on HN
Print view View original

31–40 of 120 posts

Re: A Hacker Has Wiped a Spyware Company’s Servers

#31

Post by twohlix_ »

stryk wrote: post #3

> " Friday morning, after the hacker told us he had deleted much of Retina-X’s data, the company again said it had not been hacked. " I have to admit that, despite all the seriousness of the actual SPYware this obviously terrible company sells, that one sentence brightened up my normal depressing morning experience of reading the weekday morning news on the Internet. That's just funny.

I think this is a great example of the saying "There are two types of companies: those who have been hacked, and those who know they've been hacked"

Re: A Hacker Has Wiped a Spyware Company’s Servers

#32

Post by lighttower »

JumpCrisscross wrote: post #28
falcolas wrote: post #2

This is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now. If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.

I wish they had done one more thing: notified everyone on whose devices this software was installed. If someone put this on my phone without my knowledge, I would want to know. (I would also almost certainly sue.)

Yes. I want to see that happen also. But I want to separate the part of me who wants to see fireworks from the "right thing to do" I think we need to think through the technicalities of notifying the hacked people, would they even know what to do with your email? Would they consider it spam or phishing and just delete it l? Assuming you're successful, what societal fallout could result? I don't know the answers to these questions. Ultimately it's similar to emailing the partners of the users of Ashley Madison and sending the user profiles to them. What's the intended outcome?

Re: A Hacker Has Wiped a Spyware Company’s Servers

#33

Post by JumpCrisscross »

JustSomeNobody wrote: post #21
erikrothoff wrote: post #8

I'm torn by a lot of things here. The validity of the claims in the article, the correctness of the hacker to simply delete data, but also the "stalkerware" as described by the article. Surely there's got to be a better way of dealing with this atrocious software? How can it be legal in the first place?

The software may not be illegal, but particular uses of the software are. I think[0] I prefer it that way less we go down a slippery slope of deciding what software should be legal vs illegal. [0] And do please try and convince me if I should think differently about this.

> The software may not be illegal, but particular uses of the software are

If you profit from selling software that is predominantly used for illegal purposes, or in the course of illegal activities, and you know it; you should be liable. Not put in jail. Not shut down. Just commercially liable.

This is a conservative test (commercial sale, predominantly illegal use, and wilfulness) and a conservative solution. In the long run, however, it balances commercial incentives with broader social ones.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#34

Post by HarryHirsch »

greglindahl wrote: post #18
HarryHirsch wrote: post #9

Earlier quoted context omitted.

Isn't Google supposed to be reviewing the apps? The real question is: who gets to say in what someone's phone is going to be doing: the programmer, the manufacturer or the phone's owner. Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Germany takes another approach: no one gets to do surveillance outside strict limits, privacy is highly regarded…

A better question is how can we give the owner a say without the typical owner getting pwned roughly 100% of the time? Which is what's happening on Android at the moment.

Someone invoking "personal responsibility" usually means that they try to drop their responsibilities on someone else, but for car maintenance it actually works. People know they should change tires when they are getting bald and leave brake maintenance to their mechanic unless they really know what they are doing. Anyone who gives a game access to their contacts really had it coming to them. (Disclaimer: don't own a smartphone)

Re: A Hacker Has Wiped a Spyware Company’s Servers

#35

Post by sosborn »

Thriptic wrote: post #26

I'm always amazed that people feel the need to utilize these products. People are aware that trust is the bedrock layer of relationships right? The minute someone installs this product, their relationship with the person they are monitoring is already over, they just don't know it yet.

I get what you are saying, but there can be legal/financial concerns attached to these things.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#36

Post by HarryHirsch »

JumpCrisscross wrote: post #33
JustSomeNobody wrote: post #21

Earlier quoted context omitted.

The software may not be illegal, but particular uses of the software are. I think[0] I prefer it that way less we go down a slippery slope of deciding what software should be legal vs illegal. [0] And do please try and convince me if I should think differently about this.

> The software may not be illegal, but particular uses of the software are If you profit from selling software that is predominantly used for illegal purposes, or in the course of illegal activities, and you know it; you should be liable. Not put in jail. Not shut down. Just commercially liable. This is a conservative test (commercial sale, predominantly illegal use, and wilfulness) and a conservative solution. In th…

We put thieves into prison because if theft were common it would increase distrust, society as a whole has an interest to fight theft, and we permit victims to sue the for restitution. In the same way society has a reason to put strict limits on surveillance.

There's the other problem: what damages can someone with a spy app on their phone ask for? There is no monetery value, they can at most ask for relief, that's not much of an incentive to stop.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#37

Post by kuschku »

andrewflnr wrote: post #5

They stored the master key to their entire data store in a publicly distributed app? > ...we have been taking steps to enhance our data security measures. Sharing details of security measures could only serve to potentially compromise those efforts. Maybe they used ROT13 on the API key twice this time!

This is a common issue, and many apps do this mistake.

Another common mistake is having /.git/ available on the domain itself, often with PHP sites or backend-less SPAs this is common, giving full access to the source, including those API keys. Even major sites do this – The Hill until recently had their git repo, including API tokens and access keys for everything, publicly available.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#38

Post by stryk »

jim_dow_jones wrote: post #23
larrik wrote: post #12

Earlier quoted context omitted.

They also store extensive sensitive data and media about/from/with children with piss poor security. Is that not unambiguously bad?

Their security was bad, no doubt. I don't see how that justifies deleting their data, though.

??!? Their 'data' includes all the photos YOUR KIDS take on their phones. Do you not realize how much absolutely idiotic shit kids do with their smartphones these days? Which they store in an an obviously unsafe way, as evidenced by the fact that they've been hacked via a super-super-super obvious software flaw... twice (that was widely reported on, most likely many more times). They deserve, and they should get, no sympathy. They sure as shit don't deserve to make any money off of it.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#39

Post by larrik »

jim_dow_jones wrote: post #23
larrik wrote: post #12

Earlier quoted context omitted.

They also store extensive sensitive data and media about/from/with children with piss poor security. Is that not unambiguously bad?

Their security was bad, no doubt. I don't see how that justifies deleting their data, though.

So that actual bad guys don't get it and use it for what could be incredibly sophisticated and damaging things.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#40

Post by sowbug »

andrewflnr wrote: post #5

They stored the master key to their entire data store in a publicly distributed app? > ...we have been taking steps to enhance our data security measures. Sharing details of security measures could only serve to potentially compromise those efforts. Maybe they used ROT13 on the API key twice this time!

It's all the more pathetic that they responded to the first hack by "obfuscating" the client-side secret, as if that could even theoretically stop any attacker with a budget of more than about an hour.

Future service designers: if your client is talking directly to AWS, then your attacker will, too. Take the week to write a CRUD frontend server that enforces the policy you want.

Post reply on HN