Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

micahflee.com

Post reply on HN
Print view View original

91–100 of 209 posts

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#91

Post by formerly_proven »

pigbearpig wrote: post #45
jfim wrote: post #22

Earlier quoted context omitted.

Sounds like someone had a Java app and mistakenly exposed all of the JMX endpoints over HTTP. It's not the default configuration, and likely done out of carelessness.

From the Wired article, it may not have even been a mistake, depending on the version of Spring Boot. "Spring Boot Actuator. “Up until version 1.5 (released in 2017), the /heapdump endpoint was configured as publicly exposed and accessible without authentication by default."

This was also part of the exploit chain in the "Volksdaten" incident.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#92

Post by treebeard901 »

barbazoo wrote: post #3
Aurornis wrote: post #2

So one of their servers had a /heapdump endpoint that publicly served a heap dump of the server? This whole saga is out of control. This group didn’t really “publish” anything, though. They’re offering access to journalists through a request form. They’re also not saying how much actual message content they have because the 410GB of heap dumps makes for a bigger headline number.

Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it. I hope the message dump is juicy.

After all the concern over China and TikTok, why is the USG using a foreign chat program at all?

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#93

Post by TeMPOraL »

hristov wrote: post #79
donnachangstein wrote: post #73

Earlier quoted context omitted.

> The users (i.e. high level U.S. officials) did no due diligence. But why would they? It's not their job. They have massive IT staff supporting them. "High level U.S. officials" are just executives; the pointy-haired bosses to the pointy-haired boss. Only difference is these wear little decorative pins over their breast pocket. Every Fortune 500 company has dedicated IT staff for execs; someone you can call 24/7 and…

Their massive it staff provides them with a way to communicate securely and they ignore it deliberately so that their communications are not preserved for history or for future court cases.

One man's low Integrity (in the "CIA triad" sense) of communications is another man's improved plausible deniability.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#95

Post by mmooss »

jfritsch1984 wrote: post #84

We‘re doing something way less critical at my job. But we have two pentests per year by external companies. How on earth is this level of incompetence even legal.

Because software engineering is not taken seriously as engineering. What liability is there, for example?

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#97

Post by gregorvand »

TeleMessage CEO LinkedIn bio - reads like a terrible AI hatchet job:

"At the helm of TeleMessage, my leadership is defined by strategic innovation and a steadfast commitment to advancing telecommunications solutions. With a focus on SaaS products, our team has successfully navigated the industry's evolution, ensuring that we remain at the forefront of technological advancements. My role encompasses not only the oversight of our direction but also the cultivation of a culture that values ethical standards and collaborative success.

Our achievements are anchored in a proven track record of delivering results and solving complex problems with efficiency. Spearheading business development and marketing initiatives, we have established a reputation for excellence within the telecom sector. The acquisition of TeleMessage by Smarsh in 2024 stands as a testament to our team's dedication and my leadership in driving growth and fostering a united vision."

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#98

Post by landl0rd »

0xbadcafebee wrote: post #21

> Because the data is sensitive and full of PII, DDoSecrets is only sharing it with journalists and researchers. Yeah I'm normally a big proponent of responsible disclosure, but in this case, I think the more painful, damaging leak is required. Firstly, autocrats, fascists & oligarchs don't care that much if you hack them. They will just keep using these tools (or another one just like it) ignoring the correct proced…

[flagged]

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#99

Post by notpushkin »

gregorvand wrote: post #97

TeleMessage CEO LinkedIn bio - reads like a terrible AI hatchet job: "At the helm of TeleMessage, my leadership is defined by strategic innovation and a steadfast commitment to advancing telecommunications solutions. With a focus on SaaS products, our team has successfully navigated the industry's evolution, ensuring that we remain at the forefront of technological advancements. My role encompasses not only the overs…

This just reads like a terrible LinkedIn-speak to me.
Post reply on HN