Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker Has Wiped a Spyware Company’s Servers

motherboard.vice.com

Post reply on HN
Print view View original

41–50 of 120 posts

Re: A Hacker Has Wiped a Spyware Company’s Servers

#41

Post by jstarfish »

jim_dow_jones wrote: post #23
larrik wrote: post #12

Earlier quoted context omitted.

They also store extensive sensitive data and media about/from/with children with piss poor security. Is that not unambiguously bad?

Their security was bad, no doubt. I don't see how that justifies deleting their data, though.

Like handling nuclear material, if a company is going to collect intelligence on consumers, they have a social obligation to secure that intelligence. Encrypt it, tokenize/anonymize it, or delete it after use. Anything less and you're simply positioning yourself as a facilitator of doxxing or stalking when data leakage or exfiltration inevitably happens.

If it was this easy to break in and access the data, the hacker did consumers a kind mercy by deleting it before someone else got in and did something more nefarious.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#42

Post by JumpCrisscross »

HarryHirsch wrote: post #36
JumpCrisscross wrote: post #33

Earlier quoted context omitted.

> The software may not be illegal, but particular uses of the software are If you profit from selling software that is predominantly used for illegal purposes, or in the course of illegal activities, and you know it; you should be liable. Not put in jail. Not shut down. Just commercially liable. This is a conservative test (commercial sale, predominantly illegal use, and wilfulness) and a conservative solution. In th…

We put thieves into prison because if theft were common it would increase distrust, society as a whole has an interest to fight theft, and we permit victims to sue the for restitution. In the same way society has a reason to put strict limits on surveillance. There's the other problem: what damages can someone with a spy app on their phone ask for? There is no monetery value, they can at most ask for relief, that's n…

> We put thieves in prison...In the same way society has a reason to put strict limits on surveillance

On one hand, we have a stylised burglar. On the other, a stylised lockpicking tool maker. The former is illegal; the latter is more complicated.

I am conservative about expanding the scope of the law. You criminalise surveillance apps in one decade and in the next, a security researcher disclosing a bug gets bitten.

> what damages can someone with a spy app on their phone ask for?

If someone snooped on my phone without my permission, they would see a lot of confidential client information. They may also see my and my loved ones’ protected health information. Finally, they will have sought and procured illicit access to my device, which is itself illegal. Lots of potential monetary damage in there, if only in legal time to ensure everyone who needs to be notified gets notified.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#43

Post by davidsong »

HarryHirsch wrote: post #13
jim_dow_jones wrote: post #7

I see no reason to praise the hacker. He destroyed a legitimate company's private data for no purpose other than his flawed moral reasoning. The company provides a way for parents to monitor their children and other legitimate business practices. Obviously, the software can be used for nefarious purposes but so can almost any other software. U.S. representatives and senators try to ban encryption using the same exact…

I see a legitimate business opportunity, a phone walking service. You collect the children's phones and take them to the mall, the library or wherever teenagers go these days, and meanwhile the kids can enjoy life without parental surveillance. You do wonder what the 24-hour panopticon does to adolescents' mental health and to the health of the parent-child relationship.

How about a USB OTG microphone, GPS and camera that tell a pack of lies, ideally implemented as an app on a second phone.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#44

Post by wlll »

falcolas wrote: post #2

This is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now. If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.

I feel like this is a better way of putting it:

"If you are in the business of collecting data without users' explicit permission you shoudln't be in business."

Re: A Hacker Has Wiped a Spyware Company’s Servers

#45

Post by bshacklett »

kuschku wrote: post #37
andrewflnr wrote: post #5

They stored the master key to their entire data store in a publicly distributed app? > ...we have been taking steps to enhance our data security measures. Sharing details of security measures could only serve to potentially compromise those efforts. Maybe they used ROT13 on the API key twice this time!

This is a common issue, and many apps do this mistake. Another common mistake is having /.git/ available on the domain itself, often with PHP sites or backend-less SPAs this is common, giving full access to the source, including those API keys. Even major sites do this – The Hill until recently had their git repo, including API tokens and access keys for everything, publicly available.

It should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#46

Post by Nicksil »

It seems there's an attempt to quell customer discussion via locking such a thread on their forum[0]. A particularly upset customer's remarks[1].

[0] https://forums.flightsimlabs.com/index.php?/topic/16236-furt...

[1] https://forums.flightsimlabs.com/index.php?/topic/16236-furt...

Re: A Hacker Has Wiped a Spyware Company’s Servers

#47

Post by greglindahl »

HarryHirsch wrote: post #34
greglindahl wrote: post #18

Earlier quoted context omitted.

A better question is how can we give the owner a say without the typical owner getting pwned roughly 100% of the time? Which is what's happening on Android at the moment.

Someone invoking "personal responsibility" usually means that they try to drop their responsibilities on someone else, but for car maintenance it actually works. People know they should change tires when they are getting bald and leave brake maintenance to their mechanic unless they really know what they are doing. Anyone who gives a game access to their contacts really had it coming to them. (Disclaimer: don't own a…

I recall that there are regulations about cars that make it more likely that a wide variety of owners will be able to maintain them successfully.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#48

Post by figgis »

sowbug wrote: post #40
andrewflnr wrote: post #5

They stored the master key to their entire data store in a publicly distributed app? > ...we have been taking steps to enhance our data security measures. Sharing details of security measures could only serve to potentially compromise those efforts. Maybe they used ROT13 on the API key twice this time!

It's all the more pathetic that they responded to the first hack by "obfuscating" the client-side secret, as if that could even theoretically stop any attacker with a budget of more than about an hour. Future service designers: if your client is talking directly to AWS, then your attacker will, too. Take the week to write a CRUD frontend server that enforces the policy you want.

Do you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to find it and my search results are... unhelpful at best.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#49

Post by quadrangle »

This is a good case of vigilante justice, but vigilantism is problematic in general. We should probably be formally outlawing the sort of practices these companies have and also putting in place far stronger real privacy measures for all data-collecting companies. Until (if ever) the law catches up, vigilantism will be better than nothing.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#50

Post by mulmen »

greglindahl wrote: post #47
HarryHirsch wrote: post #34

Earlier quoted context omitted.

Someone invoking "personal responsibility" usually means that they try to drop their responsibilities on someone else, but for car maintenance it actually works. People know they should change tires when they are getting bald and leave brake maintenance to their mechanic unless they really know what they are doing. Anyone who gives a game access to their contacts really had it coming to them. (Disclaimer: don't own a…

I recall that there are regulations about cars that make it more likely that a wide variety of owners will be able to maintain them successfully.

Really? That's interesting, can you elaborate?
Post reply on HN