Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub sued for aiding hacking in Capital One breach

zdnet.com

Post reply on HN
Print view View original

71–80 of 104 posts

Re: GitHub sued for aiding hacking in Capital One breach

#71

Post by ilkkao »

wolf550e wrote: post #44
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

SSNs don't have a checksum like credit card numbers do (or like national identity card numbers do), because the SSN is not meant to be used the way it is used. https://www.youtube.com/watch?v=Erp8IAUouus

In many countries they have. Which leads me wonder if github is expected to detect all formats there are around the globe

Re: GitHub sued for aiding hacking in Capital One breach

#73

Post by beecat »

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data

I can't wait until I get to debug our first build that won't run because we uploaded some data, however broadly that ends up being defined, with 9 digits in a row...

Re: GitHub sued for aiding hacking in Capital One breach

#74

Post by buzzerbetrayed »

dantillberg wrote: post #48
colejohnson66 wrote: post #39

Earlier quoted context omitted.

I’m reminded of a webpage that claimed to know your pin for your credit card; just do a find in page to see! In reality, it just had all 10,000 possible numbers listed in numerical order

Once you search for it, then the web page could actually know.

Is this true? I wasn’t aware that websites could capture your find-in-page searches. I’d be interested to know if they can capture your key events when the find-in-page box has focus. Intuition tells me they can’t, and that it would be outside of the websites “sandbox”. But I can’t say for sure.

Re: GitHub sued for aiding hacking in Capital One breach

#75

Post by moomin »

noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

I’ve got to say, I think the “common carrier” argument is suspect if you’re running targeted advertising and recommendation on the page, but GitHub isn’t doing any of those things.

Re: GitHub sued for aiding hacking in Capital One breach

#76

Post by throwawaywego »

antpls wrote: post #25
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

What I think happened: Someone contacted Capital One by email to responsibly disclose to them that there were SSN's and other data on a Gist. That person found them with a simple crawler or search.

Then Cap 1 thought: If some rando can find this after a lot of damage has been done, why can't Github find these seconds after upload?

And, really, there is no technical excuse. It is perfectly possible to do this, and lots of big companies do this (or hire security companies to do this for them). Mention their name on some deep web hacking forum, a pastebin, or inside Github code, and somewhere an alarm goes off.

Github could (and should) warn if a user uploads loads of PII-like data. For the cost of running a search server and a few moderators. "Are you sure you want to upload your AWS credentials in a public repository?".

Github is somewhere halfway between moderated and a content platform. They already have a history of taking down repositories if they link to PII data (or infringe copyright, or damage U.S. national security): http://web.archive.org/web/20180619172528/https://github.com... so not acting on this specific repo with SSN numbers could be seen as a poor/shoddy job on their part. Github is certainly in the dominant position to mitigate spread of PII data, so they should have their stuff in order.

Re: GitHub sued for aiding hacking in Capital One breach

#77

Post by stordoff »

dfcmt wrote: post #19
brianzelip wrote: post #2

‘The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking.”[0]’ Oh brother. [0] https://github.com/Hack-with-Github/Awesome-Hacking

"A collection of awesome lists for hackers, pentesters & security researchers." They are not using "hacker" in the "Hacker News" sense of the word, they are using meaning breaking into some system. So no "oh brother" moment here.

So? Trying to break into a system can be the only way to know it's reasonably secure. This is like saying locksmiths are bad. Preventing this makes systems _less_ secure, defeating the point of trying to ensure privacy.

It doesn't even appear to be an official GitHub page (Hack with GitHub - location: Bangalore, India, email: hackwithgithub@gmail.com). Just because someone creates an "X-with-Github" repository, it doesn't GitHub are actively encouraging X.

Re: GitHub sued for aiding hacking in Capital One breach

#78

Post by karma20 »

BoorishBears wrote: post #33
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline? Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag. Why would you even for a second entertain this nonsense? Non-technical people who think this: https://github.com/Hack-with-Github/Awesome-Hacking is a smoking gun to prove Github as a company…

Agree. This kind of DLP-like scanning is totally infeasible at GitHub scale.

In particular, one excerpt from the complaint reads like output from a noisy scanner that has detected “exposed SSNs” in client-side code:

> [...] Social Security numbers are readily identifiable: they are nine digits in the XXX-XX-XXXX sequence.

Re: GitHub sued for aiding hacking in Capital One breach

#79

Post by kadoban »

buzzerbetrayed wrote: post #74
dantillberg wrote: post #48

Earlier quoted context omitted.

Once you search for it, then the web page could actually know.

Is this true? I wasn’t aware that websites could capture your find-in-page searches. I’d be interested to know if they can capture your key events when the find-in-page box has focus. Intuition tells me they can’t, and that it would be outside of the websites “sandbox”. But I can’t say for sure.

At the very least, javascript can tell where you are scrolled to on the page. With minor cleverness that should be enough.

Re: GitHub sued for aiding hacking in Capital One breach

#80

Post by buzzerbetrayed »

dfcmt wrote: post #19
brianzelip wrote: post #2

‘The lawsuit also makes a bold claim that "GitHub actively encourages (at least) friendly hacking." It then links to a GitHub repository named "Awesome Hacking.”[0]’ Oh brother. [0] https://github.com/Hack-with-Github/Awesome-Hacking

"A collection of awesome lists for hackers, pentesters & security researchers." They are not using "hacker" in the "Hacker News" sense of the word, they are using meaning breaking into some system. So no "oh brother" moment here.

It’s a repository to help people learn computer security. Of course this is an “oh brother” moment.
Post reply on HN