Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was a senior VP of tech at Starwood: here’s my take on the guest data breach

phocuswire.com

Post reply on HN
Print view View original

31–40 of 61 posts

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#31

Post by adrr »

lawnchair_larry wrote: post #30

This guy appears to have no clue what he is talking about, and is painfully ignorant of both security and technology. I realize that’s not a very substantive comment, but wow. ”The Valhalla system was fully activated in 2009, and my understanding is that all best practices were followed in its design (firewalls, DMZs, encryption, etc.).” ”It is difficult to imagine how an architectural or platform vulnerability would…

You don't get to SVP of a big corporation by being an expert in technology or security. That high up, your skill set is on organization, process, prioritization/planning, and budgeting. Sometimes you do see technical CTOs.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#32

Post by verst »

kenneth wrote: post #26

I'm amongst the most frequent guests at Starwood, spending >100 nights a year in their hotels. I wasn't thrilled when it was announced they'd be acquired by Marriott. This year, they began the switchover process to migrating to Marriott's technology, and the full switch officially happened in mid-August. It was a complete and utter disaster. Everything was buggy, points mysteriously disappeared, reservations disappea…

Agreed that their migration from SPG to Marriott has been painful. It ended up creating 3 new logins for me before finally consolidating everything under a new number.

Out of curiosity, do you find your Marriott / SPG Ambassador to be useful? I reached Platinum Premier Elite with Ambassador status in November but my ambassador hasn't been helpful at all. The Your24 perk also rarely works in practice. It's a nice marketing gimmick, but definitely not worth it so far.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#33

Post by hanniabu »

bdhess wrote: post #28
will4274 wrote: post #25

Earlier quoted context omitted.

> The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key, and another 5 had come and gone (and had had access to the same key) in the previous 6 months. What's so wrong with any of this? Software requires operators and developers. If you can't trust…

> Such access should be restricted (requiring approval) and logged, of course, but it's difficult to eliminate entirely at scale. It’s not clear how you could practically enforce this requirement if devs just have the raw key on their workstations.

Would be nice to use a multi-sig so the dev would need their key which they always have access to plus a key from an approver.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#34

Post by btown »

kenneth wrote: post #26

I'm amongst the most frequent guests at Starwood, spending >100 nights a year in their hotels. I wasn't thrilled when it was announced they'd be acquired by Marriott. This year, they began the switchover process to migrating to Marriott's technology, and the full switch officially happened in mid-August. It was a complete and utter disaster. Everything was buggy, points mysteriously disappeared, reservations disappea…

You might be very interested in the following talk, where a Marriott tech lead describes how as recently as 2013 (and it's ambiguous, but it's likely still the case), much of the Marriott pricing engine was running on a single "green screen" (his words) IBM mainframe. He speaks about how only in ~2014 with a management shakeup did culture begin to shift towards acceptance of open source components. But, as we all know, these types of organizations don't turn on a dime, and sadly this breach is likely to make them more conservative (and increase reliance on those old-school systems) rather than less. I'm not surprised at all about your experience.

https://www.youtube.com/watch?v=wdFYEuWWpzo&t=5m30s

Disclosure: I'm working on a project (currently stealth) in the alternative accommodations (vacation rentals) space. Lots of people all over trying to reinvent these types of booking engines, and it's a tough challenge to get right. I don't blame them for not wanting to deal with distributed systems on top of those challenges. But IMO that's part and parcel of a modern approach to the problem.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#35

Post by cjhopman »

tdb7893 wrote: post #6

He seemed to say the database wouldn't have 500 million records in it at a time since they are deleted but that seems irrelevant with how the breach took place over 4 years. Anyway the article seems to be just speculation, which is disappointing. Edit: this article has gotten a lot more upvotes than I would expect if something this quality, is there something about it I'm missing that makes it particularly insightful…

Your expectations of HN users does not match reality.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#36

Post by antonvs »

will4274 wrote: post #25
lowercased wrote: post #14

Earlier quoted context omitted.

> It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys. I worked some place where lots data was encrypted with a key. The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key,…

> The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key, and another 5 had come and gone (and had had access to the same key) in the previous 6 months. What's so wrong with any of this? Software requires operators and developers. If you can't trust…

> What's so wrong with any of this?

A very basic principle of security is the principle of least authority. To implement that, you don't use one key for many different purposes over a long period of time and give it to anyone who needs it. You use different keys for different purposes, and replace the keys periodically to help ensure that they're only available to a limited group.

Another way to answer your question is "because that's how all these breaches happen."

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#37

Post by hn_throwaway_99 »

abhorrence wrote: post #2

This article seems full of points that a lay person might nod along with, yet don't hold up to scrutiny. > The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. It does not mean that. It means that we don't know of any exploited vulnerabilities before that point. > If the detection tool was used prior to this September, why…

Honestly, after seeing this article upvoted so high and then reading it, I was relieved to see these comments. At it's root, security for always-on networked systems is extremely difficult, even at tech-first companies with an ingrained "security culture", nevermind a hospitality company like Starwood where "IT" is another department. And this guy comes forth with clueless statement after clueless statement about "The system was already operating securely for five years" and the one about the primary encryption keys. This whole article is incredibly self serving.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#38

Post by hn_throwaway_99 »

scarcely wrote: post #11
agotterer wrote: post #7

> It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys. I was reasonably sold on what was being said until that comment. Impossible is a strong word to use when it comes to computer security. It seems that everyone who has claimed that there system is unhackable, always ends up being hacked.

He said 'almost impossible'. Big difference.

I think it's actually pretty easy to imagine a scenario where private encryption keys were stolen.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#39

Post by jnbiche »

tdb7893 wrote: post #6

He seemed to say the database wouldn't have 500 million records in it at a time since they are deleted but that seems irrelevant with how the breach took place over 4 years. Anyway the article seems to be just speculation, which is disappointing. Edit: this article has gotten a lot more upvotes than I would expect if something this quality, is there something about it I'm missing that makes it particularly insightful…

Upvotes don't necessarily mean quality or correctness. Sometimes they just need newsworthy, or interesting.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#40

Post by kenneth »

verst wrote: post #32
kenneth wrote: post #26

I'm amongst the most frequent guests at Starwood, spending >100 nights a year in their hotels. I wasn't thrilled when it was announced they'd be acquired by Marriott. This year, they began the switchover process to migrating to Marriott's technology, and the full switch officially happened in mid-August. It was a complete and utter disaster. Everything was buggy, points mysteriously disappeared, reservations disappea…

Agreed that their migration from SPG to Marriott has been painful. It ended up creating 3 new logins for me before finally consolidating everything under a new number. Out of curiosity, do you find your Marriott / SPG Ambassador to be useful? I reached Platinum Premier Elite with Ambassador status in November but my ambassador hasn't been helpful at all. The Your24 perk also rarely works in practice. It's a nice mark…

Ambassador status is highly dependent on who you get. Overall, my ambassador is a nice guy who's professional, friendly, and helpful. I also really appreciate having a dedicated line of support considering how awful Marriott's customer support otherwise are. They're organized a few upgrades for me when they really mattered, and are my main point of contact for support, especially for some pretty complex issues which would've been much more painful through traditional channels. Beyond that, I can't say it's made that meaningful of a difference.

The quality of the service has gone markedly down since the August integration. My understanding is that ambassadors have been bogged down with technical issues, an influx of new customers (going from 50 guests per ambassador to >300), and a big drop in morale. A lot of the issues they can't help with aren't their fault, but rather problems with Marriott policies and technology.

And oh: on Your24, I've only tried to use it a couple times, and had it work about 50% of the time. I've checked in before 3pm many times and pretty much always get a room. (Except one frustrating time after a red-eye where I needed a shower desperately and the hotel had no rooms available or any showers in the gym. I was not a happy camper.)

Post reply on HN