Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StockX was hacked, exposing millions of customers’ data

techcrunch.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: StockX was hacked, exposing millions of customers’ data

#81

Post by jnbiche »

gruez wrote: post #75
jnbiche wrote: post #63

Earlier quoted context omitted.

While I don't agree with the way he spoke, was C# one of the de facto or explicit in-house languages of the company, and Ruby was not? If so, he may have been referring to the fact that the company already had many libraries in C# that you could use. Plus, if C# was one of their areas of expertise, it's typically best to use that as opposed to a new, unfamiliar language unless you're explicitly testing out a new appr…

>While I don't agree with the way he spoke, was C# one of the de facto or explicit in-house languages of the company, and Ruby was not? If so, he may have been referring to the fact that the company already had many libraries in C# that you could use. Plus, if C# was one of their areas of expertise, it's typically best to use that as opposed to a new, unfamiliar language unless you're explicitly testing out a new app…

It sounds like they were pretty well-integrated into Quicken engineering, although we'll have to hear from the OP to know for sure.

Re: StockX was hacked, exposing millions of customers’ data

#82

Post by adrr »

gruez wrote: post #78
kokowawa393 wrote: post #50

Earlier quoted context omitted.

It should be criminal.

Good luck proving that a "reasonable person" shouldn't have done it. Most people on HN probably do, but I wouldn't be surprised if everyone coming out of a 3 month coding bootcamp only knew to hash passwords and nothing else. The other comments in this thread seems to suggest that the company is filled with bootcamp programmers.

I just googled how to store passwords in a DB and the first result said I shouldn’t use MD5 or SHA. Reasonable person would do a cursory search for information if they didn’t have the knowledge. I am willing to bet they knew better. When I worked for a company that stored passwords in clear text, we knew it was wrong but never prioritized fixing it. If the execs would have faced jail time, I bet it would have been prioritized.

Re: StockX was hacked, exposing millions of customers’ data

#83

Post by fortran77 »

doctorpangloss wrote: post #68
barbecue_sauce wrote: post #54

Earlier quoted context omitted.

Jeez. Even coding bootcamps teach developers to use at least bcrypt for passwords.

It’s just a Wordpress site using ancient defaults. It’s not exactly a technology business.

It sure looks like Wordpress, but are you sure? They don't have the wordpress login page at /wp-login.php and I don't see references to /wp-* in the source.

Re: StockX was hacked, exposing millions of customers’ data

#84

Post by perl4ever »

TeMPOraL wrote: post #4
hacker_9 wrote: post #2

> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…

> The stolen data is shoe sizes? StockX is a platform for trading shoes, among other things.

I never heard of them before, so I checked Wikipedia and read this:

"The platform works by buyers undercutting each other in a fashion similar to the stock market, eventually causing limited items to lose all value. "

Can someone elucidate how this is like the stock market, because I don't get it.

Re: StockX was hacked, exposing millions of customers’ data

#86

Post by Thorrez »

xwdv wrote: post #13
cm2187 wrote: post #11

Earlier quoted context omitted.

Usually the salt is stored along the login and password.

That’s not on the list of things stolen, so the passwords are safe. The salts were kept elsewhere, as they should be.

Why should salts be stored elsewhere? If you have some high-security other storage, why don't you store the password hashes there?

Re: StockX was hacked, exposing millions of customers’ data

#87

Post by txcwpalpha »

dehrmann wrote: post #32
xwdv wrote: post #23

Earlier quoted context omitted.

Show me the benchmarks.

https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... Looking at phpass (one of the md5 algorithms), a high-end GPU can do 7M hashes per sec.

If StockX was using phpass (which is a KDF that uses MD5 as a base but adds multiple permutations on top), it is quite a bit safer (but still not recommended and these hashes should be considered to be compromised).

The bigger issue is if they were actually using raw MD5 (which is sadly quite common), which is benchmarked at 25 billion (with a B) hashes per sec per GPU.

Re: StockX was hacked, exposing millions of customers’ data

#88

Post by throwawayfoc »

pgm8705 wrote: post #45
PopeDotNinja wrote: post #40

Earlier quoted context omitted.

I had a similar experience, but I made the mistake of taking the job. I spent several months in denial about how smart people who act so... not smart. At one point, I asked the CTO for guidance on how to work with the team architect whose feelings I kept hurting. For example, I wrote a constructor for a class, and the architect asked me what "def initialize" was for, and got upset when I asked if they knew how OOP in…

I used to work closely with Quicken Loans and other FoCs and can attest that this behavior is commonplace. There is this strange culture within the Family of Companies where non-tech leaders think that tenured Quicken engineers and tech people are these sort of super-geniuses. Many years back I was a part of a company in the Quicken led start-up space. We were often "encouraged" to meet with Quicken or FatHead senior…

Yikes. I worked on a team whose de facto tech lead (it wasn’t explicit because we were “flat”) had no idea what SQL parameter binding was (I had to explain why interpolating strings in SQL queries is dangerous). And we apparently went to the same university and got the same degree, and he had at least ten years of “industry experience”.

I’ve also had to explain why logging is a good idea and how to use SSH. What frustrates me isn’t that people don’t know these basics (nobody is born an expert), but that people get hired to do a job for which they lack core competencies. If your job is to fix engines and you don’t know what a spark plug does, you probably shouldn’t be fixing engines. This was at least an issue for me. I know people at Quicken proper who have told me even more ridiculous stories.

It’s a shame. Detroit’s got a lot going for it, but I think most of the tech companies there have some connection to Gilbert and Quicken, and no amount of coneys will get that taste out of my mouth.

Re: StockX was hacked, exposing millions of customers’ data

#89

Post by SkyPuncher »

perl4ever wrote: post #84
TeMPOraL wrote: post #4

Earlier quoted context omitted.

> The stolen data is shoe sizes? StockX is a platform for trading shoes, among other things.

I never heard of them before, so I checked Wikipedia and read this: "The platform works by buyers undercutting each other in a fashion similar to the stock market, eventually causing limited items to lose all value. " Can someone elucidate how this is like the stock market, because I don't get it.

Wikipedia gives a terrible description.

It's basically eBay, but focused specifically on limited release/high value fashion - sneakers, bags, streetwear, eatches, etc. Since the market rate for these items changes over time, the gimick (hence the name) is to track them like stocks.

Stockx basically facilitates the sale and exchange of items, taking a cut of the sale and verifying the integrity of the items.

Re: StockX was hacked, exposing millions of customers’ data

#90

Post by SkyPuncher »

xwdv wrote: post #9
txcwpalpha wrote: post #7

> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted) This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators shoul…

Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware . You are probably not cracking the password in any reasonable time, period. And when you have a unique salt per user, that’s basically game over.

You need to update yourself on the vulnerability of MD5.

5 years ago, a run of the mill gaming PC could crack an MD5 hash in a reasonable amount of time. Worst case, you'd have to let it run overnight.

One of the big issues is collisions. You might not find the original key, but you'd find something that hashed to the equivalent output.

Post reply on HN