Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zendesk was hacked

zendesk.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Zendesk was hacked

#31

Post by throaway132 »

dotmanish wrote: post #30
tomhallett wrote: post #12

If you have a mid-sized Rails app, with say 2-3 developers working on it, a full time security engineer would probably be overkill. Anyone have any recommendations of services/consultancies to be able to tell "oh, someone is hacking us right now" or "our page which has stripe.js on it has been compromised"? I'm hoping for automated tools, services to install on our servers, or security auditors who have an out of the…

There's also Detectify : http://detectify.com They are in beta.

Actually, I've had really bad experiences with Detectify. Their results didn't provide anything useful that I couldn't have gotten from something like Nessus. They have a pretty nice design, but not much in the way of actual useful security.

Re: Zendesk was hacked

#33

Post by dirtyaura »

OGinparadise wrote: post #32

All kinds of sites, some supposedly super-secure, have been hacked. Now a serious question: What does this say for storing everything, including tax filings, in the Cloud?

I'm curious why you picked tax filings as an example of information that would be catastrophic to leak.

Here in Finland tax information is public and it doesn't seem to be that bad. As you guess, yellow papers embarrasingly make yearly rankings of rich people and they lose some anonymity. But anybody that was in any way interested in their life likely knew that they were rich.

I don't say that this Finnish practice of having public tax information is a good one, but it just shows that it's not the end of world.

Leaked Tumblr support information that allows associating Tumblr blogs to email addresses can cause a similar level of agony that leaked tax information.

Re: Zendesk was hacked

#34

Post by eurleif »

dirtyaura wrote: post #33
OGinparadise wrote: post #32

All kinds of sites, some supposedly super-secure, have been hacked. Now a serious question: What does this say for storing everything, including tax filings, in the Cloud?

I'm curious why you picked tax filings as an example of information that would be catastrophic to leak. Here in Finland tax information is public and it doesn't seem to be that bad. As you guess, yellow papers embarrasingly make yearly rankings of rich people and they lose some anonymity. But anybody that was in any way interested in their life likely knew that they were rich. I don't say that this Finnish practice o…

Whether your neighbor's tax information is also public might make a difference in how harmful it is for your tax information to be public.

Re: Zendesk was hacked

#35

Post by SomeCallMeTim »

ams6110 wrote: post #23
tstactplsignore wrote: post #13

From the perspective of a complete server administrator novice, are all of the mainstream "hacks" due to the complexity of these applications? For example, if I were to setup a basic, updated Ubuntu Server LAMP stack with a MySQL database, is this system vulnerable? I understand how to protect against XSS and SQL injection and how to hash and salt passwords properly, but where can I begin to learn about implementing…

how can I hope to secure my web app if corporations with entire security departments are failing to secure theirs Excellent question. The answer really is, if you are running a "web app" with any kind of sensitive information, you need to have a security expert configure and administer your systems, or become one yourself, and you need to stay on top of every update. Now, there are basic things you can do that will e…

> Right now I would not trust any sensitive, personal information to any website or cloud service.

A friend of mine put together an open source project that uses cryptography to store your data in the cloud securely, so it's certainly possible. [1]

It's also possible to write complex software and not be vulnerable, though 99.999% of the time companies (start-ups and otherwise) seem more concerned with an MVP and new features than security. If you design a system from the ground up with security as a core feature, then you have a CHANCE of having a system that won't be vulnerable to script kiddies every other week. On top of that you need to be sure to protect against social engineering, but that's another discussion.

I don't even know if it's possible to use something like Rails (or Ruby, even) and be secure for the long term without having to deal with constant updates and patches. On the other hand, I HAVE used complex systems that were designed from the ground up to be secure and that simply NEVER turned out to have a security vulnerability after the first few releases. (Anything by DJB, for example. [2] Some of those tools have gone 15+ years with no vulnerabilities. Compare the constant sendmail or bind security exploits, numbering in the hundreds at this point, to DJB's qmail and djbdns.)

Until it's a priority, it's always going to be an afterthought, by definition. People will use Rails or the framework du jour, despite the fact that such frameworks are designed with the same "get it done and release ASAP" philosophy that most commercial sites are developed with, and then everyone wonders at security holes. Sigh.

[1] https://tahoe-lafs.org/trac/tahoe-lafs

[2] http://cr.yp.to/

Re: Zendesk was hacked

#37

Post by tomjen3 »

Anybody knows a good alternative?

Leaking my personal info is one thing, loosing customers personal info is simply far too boneheaded to begin with.

Re: Zendesk was hacked

#39

Post by willvarfar »

dirtyaura wrote: post #33
OGinparadise wrote: post #32

All kinds of sites, some supposedly super-secure, have been hacked. Now a serious question: What does this say for storing everything, including tax filings, in the Cloud?

I'm curious why you picked tax filings as an example of information that would be catastrophic to leak. Here in Finland tax information is public and it doesn't seem to be that bad. As you guess, yellow papers embarrasingly make yearly rankings of rich people and they lose some anonymity. But anybody that was in any way interested in their life likely knew that they were rich. I don't say that this Finnish practice o…

Same in Sweden.

On balance, I think its actually a positive thing. Thinking about it and the few occasions I've seen it referred to, I think its a positive thing.

Re: Zendesk was hacked

#40

Post by scorpion032 »

mef wrote: post #10
codenerdz wrote: post #7

Given Zendesk is a Rails shop, Id love to hear if this hack was related to any of the recent Rails exploits

If it was, at it occurred after the vulnerabilities were made public, they probably wouldn't say so as it would look pretty bad given the amount of advance warning they had.

Are you suggesting most popular rails (if not all) apps are upgraded by now?
Post reply on HN