Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zendesk was hacked

zendesk.com

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Zendesk was hacked

#11

Post by shawnee_ »

businessleads wrote: post #2

Wow, all three customers?

The big picture here is that three customers' data was compromised -- customers in this context means entire platforms using Zendesk for support, not users. If the customers were, say, WePay, Box.net and OpenTable (random companies taken from their portfolio), this is potentially hundreds of thousands of users.

Also, it is a big deal because (as a former support person I know this), users often send in sensitive info with their support requests: SSNs, full credit card info with CVV data, date of birth (yes, sometimes all in the same message).

Re: Zendesk was hacked

#12

Post by tomhallett »

If you have a mid-sized Rails app, with say 2-3 developers working on it, a full time security engineer would probably be overkill. Anyone have any recommendations of services/consultancies to be able to tell "oh, someone is hacking us right now" or "our page which has stripe.js on it has been compromised"?

I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the box package.

This is the only automated tool I know about: http://brakemanscanner.org/

Re: Zendesk was hacked

#13

Post by tstactplsignore »

From the perspective of a complete server administrator novice, are all of the mainstream "hacks" due to the complexity of these applications? For example, if I were to setup a basic, updated Ubuntu Server LAMP stack with a MySQL database, is this system vulnerable? I understand how to protect against XSS and SQL injection and how to hash and salt passwords properly, but where can I begin to learn about implementing basic, hard server security? Additionally, how can I hope to secure my web app if corporations with entire security departments are failing to secure theirs?

Re: Zendesk was hacked

#15

Post by diziet »

tomhallett wrote: post #12

If you have a mid-sized Rails app, with say 2-3 developers working on it, a full time security engineer would probably be overkill. Anyone have any recommendations of services/consultancies to be able to tell "oh, someone is hacking us right now" or "our page which has stripe.js on it has been compromised"? I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the…

Tinfoil Security (https://www.tinfoilsecurity.com/) has automated scanners and seems to keep up to date with all the vulnerabilities quickly, like in case of the rails vulnerability recently.

Re: Zendesk was hacked

#17

Post by unreal37 »

shawnee_ wrote: post #11
businessleads wrote: post #2

Wow, all three customers?

The big picture here is that three customers' data was compromised -- customers in this context means entire platforms using Zendesk for support, not users. If the customers were, say, WePay, Box.net and OpenTable (random companies taken from their portfolio), this is potentially hundreds of thousands of users. Also, it is a big deal because (as a former support person I know this), users often send in sensitive info…

The customers were Twitter, Tumblr and Pinterest. Wow, three of the biggest customers they have probably.

And two, the body of the emails was not exposed, only the subject line. People typically don't but their SSN in the subject line...

Re: Zendesk was hacked

#18

Post by unreal37 »

creativityland wrote: post #16
emptyage wrote: post #14

The three companies were Twitter, Tumblr and Pinterest: http://www.wired.com/threatlevel/?p=54338

So what kind of integration did Twitter, Tumblr and Pinterest have with Zendesk? How much of risk are the users are with their passwords?

No password data was stored there - so zero. No passwords, password hashes or encrypted passwords were lost.

Re: Zendesk was hacked

#19

Post by 0x0 »

tstactplsignore wrote: post #13

From the perspective of a complete server administrator novice, are all of the mainstream "hacks" due to the complexity of these applications? For example, if I were to setup a basic, updated Ubuntu Server LAMP stack with a MySQL database, is this system vulnerable? I understand how to protect against XSS and SQL injection and how to hash and salt passwords properly, but where can I begin to learn about implementing…

> a basic, updated Ubuntu Server LAMP stack with a MySQL database

After just apt-get'ing that, the system is of course always vulnerable to the next as-of-yet-undisclosed 0day vulnerability in the base software.

As soon as you start adding useful scripts of the "P" variety (as in "LAMP") then you are at the mercy of those scripts not having any vulnerabilities.

If you wrote those scripts yourself, then yes, xss, sqli, rfi etc are all issues you need to consider. The OWASP pages could be a useful place to start getting a feeling of the most common pitfalls.

Re: Zendesk was hacked

#20

Post by tomhallett »

diziet wrote: post #15
tomhallett wrote: post #12

If you have a mid-sized Rails app, with say 2-3 developers working on it, a full time security engineer would probably be overkill. Anyone have any recommendations of services/consultancies to be able to tell "oh, someone is hacking us right now" or "our page which has stripe.js on it has been compromised"? I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the…

Tinfoil Security ( https://www.tinfoilsecurity.com/ ) has automated scanners and seems to keep up to date with all the vulnerabilities quickly, like in case of the rails vulnerability recently.

very cool - thanks!
Post reply on HN