Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoHQ Security breach

security.mongohq.com

Post reply on HN
Print view View original

51–60 of 130 posts

Re: MongoHQ Security breach

#51

Post by eli »

computer wrote: post #46
joelgascoigne wrote: post #42

Hi everyone. Joel here from Buffer. Some of you might have heard about our security breach on Saturday. I just wanted to leave a quick note and clarify that this MongoHQ security breach was the method used to obtain our users' access tokens, which led to the wave of spam on Saturday. This is a key final piece of our investigation which brings it back full circle. I'm very happy that we have been able to gain the full…

Have you considered not outsourcing critical parts of your company to startups that are iterating fast and potentially breaking things? Could you share the reasoning behind Buffer choosing to store their customers' private data with MongoHQ, instead of your own secure infrastructure?

That's sort of a loaded question, no? A database is, in one way or another, critical to almost every business. I don't think that means every business should build one in house.

Re: MongoHQ Security breach

#52

Post by WestCoastJustin »

joelgascoigne wrote: post #42

Hi everyone. Joel here from Buffer. Some of you might have heard about our security breach on Saturday. I just wanted to leave a quick note and clarify that this MongoHQ security breach was the method used to obtain our users' access tokens, which led to the wave of spam on Saturday. This is a key final piece of our investigation which brings it back full circle. I'm very happy that we have been able to gain the full…

Just trying to develop a timeline here.

  Buffer security breach - October 26, 2013 [1]
  MongoHQ security breach - October 28, 2013 [2]
But the Buffer security breach was via MongoHQ, so MongoHQ has likely had the issue since at least the 26th, and probably earlier, since the attackers had to have enough situational awareness to target Buffer. I guess my point is, MongoHQ likely had the issue for a while and it went undetected.

[1] http://open.bufferapp.com/buffer-has-been-hacked-here-is-wha...

[2] http://security.mongohq.com/notice

Re: MongoHQ Security breach

#53

Post by [deleted] »

biot wrote: post #12

Long story short: MongoHQ is securing access to critical administration functionality behind a VPN and will be requiring two-factor authentication instead of having that functionality available to anyone on the internet via a simple password. What's interesting is that I think we've all been there at one point. You start building something, it gains momentum, then you get so bogged down with adding functionality and…

[deleted]

Re: MongoHQ Security breach

#54

Post by jimmytidey »

So is the story here that someone targeted and broke into a mongoDB employee's email account, found a password for an admin panel, then used that to extract details stored by Buffer to access people's FB & Twitter accounts? I wonder if Buffer was the target, or if it was just the first valuable thing the attacker happened across?

Re: MongoHQ Security breach

#55

Post by [deleted] »

eli wrote: post #51
computer wrote: post #46

Earlier quoted context omitted.

Have you considered not outsourcing critical parts of your company to startups that are iterating fast and potentially breaking things? Could you share the reasoning behind Buffer choosing to store their customers' private data with MongoHQ, instead of your own secure infrastructure?

That's sort of a loaded question, no? A database is, in one way or another, critical to almost every business. I don't think that means every business should build one in house.

[deleted]

Re: MongoHQ Security breach

#56

Post by reidrac »

eli wrote: post #51
computer wrote: post #46

Earlier quoted context omitted.

Have you considered not outsourcing critical parts of your company to startups that are iterating fast and potentially breaking things? Could you share the reasoning behind Buffer choosing to store their customers' private data with MongoHQ, instead of your own secure infrastructure?

That's sort of a loaded question, no? A database is, in one way or another, critical to almost every business. I don't think that means every business should build one in house.

"The backdoor that was created through one of our partners, MongoHQ who are managing our database."

Looks like the database is managed by MongoHQ. That's what OP is talking about.

Re: MongoHQ Security breach

#58

Post by akkartik »

eli wrote: post #51
computer wrote: post #46

Earlier quoted context omitted.

Have you considered not outsourcing critical parts of your company to startups that are iterating fast and potentially breaking things? Could you share the reasoning behind Buffer choosing to store their customers' private data with MongoHQ, instead of your own secure infrastructure?

That's sort of a loaded question, no? A database is, in one way or another, critical to almost every business. I don't think that means every business should build one in house.

He's not talking about building the database, he's talking about hosting the database. And he's not claiming you shouldn't use third-party hosts, he's suggesting restraint in who you choose, in waiting for a track record to accumulate.

Re: MongoHQ Security breach

#59

Post by benmccann »

Putting support functionality on the VPN means folks from outside the organization can't get to it without VPN access. It also means that you must give more people within your organization access to your VPN which raises the chances of having a compromised account be able to access other valuable assets on the VPN such as your production hardware. How do you make a trade-off between these?

Re: MongoHQ Security breach

#60

Post by JshWright »

WestCoastJustin wrote: post #52
joelgascoigne wrote: post #42

Hi everyone. Joel here from Buffer. Some of you might have heard about our security breach on Saturday. I just wanted to leave a quick note and clarify that this MongoHQ security breach was the method used to obtain our users' access tokens, which led to the wave of spam on Saturday. This is a key final piece of our investigation which brings it back full circle. I'm very happy that we have been able to gain the full…

Just trying to develop a timeline here. Buffer security breach - October 26, 2013 [1] MongoHQ security breach - October 28, 2013 [2] But the Buffer security breach was via MongoHQ, so MongoHQ has likely had the issue since at least the 26th, and probably earlier, since the attackers had to have enough situational awareness to target Buffer. I guess my point is, MongoHQ likely had the issue for a while and it went und…

I'm not sure what the implication (if any) of your post is, but the timeline seems fairly reasonable to me.

I wouldn't be surprised if it was Buffer's investigation that tipped MongoHQ off to the breach.

Post reply on HN