Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MDN Database Disclosure

blog.mozilla.org

Post reply on HN
Print view View original

11–20 of 50 posts

Re: MDN Database Disclosure

#11

Post by anaphor »

ygjb wrote: post #9
billyhoffman wrote: post #8

There is much that could be done to improve this announcement: 1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail. 2- They talk about a "data sanitization process" failing, but then talk about a "d…

Sha256+salt. See https://github.com/mozilla/kuma We are still working on the rest.

Why did you decide to use sha256 instead of a kdf like bcrypt or pbkdf2? I'm not attacking you, genuinely curious.

Re: MDN Database Disclosure

#12

Post by Rapzid »

jzwinck wrote: post #10
mp4box wrote: post #6

Can someone explain the meaning of "data sanitization process of the site database had been failing" Isn't that another way of saying SQL injection ?

I wondered about this too. At a guess, perhaps they were doing a straight database dump from a production system which had sensitive information as well as public data. They would then run a script to delete the sensitive columns before posting the dump. This seems likely to have been broken at the design stage: systems should fail safe. The first-order fix might be to check the return value of the sanitizer script a…

Yep, naive bash scripts don't stop on failure and your non-sanitized file will happily get uploaded.

Does anyone know why Mozilla was posting database dumps(sanitized or otherwise) onto public servers?

Re: MDN Database Disclosure

#13

Post by jvehent »

anaphor wrote: post #11
ygjb wrote: post #9

Earlier quoted context omitted.

Sha256+salt. See https://github.com/mozilla/kuma We are still working on the rest.

Why did you decide to use sha256 instead of a kdf like bcrypt or pbkdf2? I'm not attacking you, genuinely curious.

It's what django uses, and this site uses django.

Re: MDN Database Disclosure

#14

Post by jvehent »

Rapzid wrote: post #12
jzwinck wrote: post #10

Earlier quoted context omitted.

I wondered about this too. At a guess, perhaps they were doing a straight database dump from a production system which had sensitive information as well as public data. They would then run a script to delete the sensitive columns before posting the dump. This seems likely to have been broken at the design stage: systems should fail safe. The first-order fix might be to check the return value of the sanitizer script a…

Yep, naive bash scripts don't stop on failure and your non-sanitized file will happily get uploaded. Does anyone know why Mozilla was posting database dumps(sanitized or otherwise) onto public servers?

It's useful to contributors who work on the site development.

Re: MDN Database Disclosure

#15

Post by ygjb »

anaphor wrote: post #11
ygjb wrote: post #9

Earlier quoted context omitted.

Sha256+salt. See https://github.com/mozilla/kuma We are still working on the rest.

Why did you decide to use sha256 instead of a kdf like bcrypt or pbkdf2? I'm not attacking you, genuinely curious.

also the feature was built a long time ago.

current standards for sites not using persona are here: https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines

Re: MDN Database Disclosure

#16

Post by jvehent »

billyhoffman wrote: post #8

There is much that could be done to improve this announcement: 1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail. 2- They talk about a "data sanitization process" failing, but then talk about a "d…

A process failed, and the DB dump that is published to help contributors improve the MDN site got out unsanitized. The sanitization/publication process will be redesigned to include stricter controls. For now, it is shut down.

MDN has been using persona for a while now, meaning that most accounts don't have passwords in the database. But older accounts still had the SHA256 salted hash that Django creates.

We traced back as much as we could. Access logs, netflow data, etc... We found that the tar.gz containing the DB dump had been downloaded only a small number of times. Mostly by known contributors. But we can't rule out that someone with malicious intentions got access to it.

Re: MDN Database Disclosure

#17

Post by jeffbryner »

Rapzid wrote: post #12
jzwinck wrote: post #10

Earlier quoted context omitted.

I wondered about this too. At a guess, perhaps they were doing a straight database dump from a production system which had sensitive information as well as public data. They would then run a script to delete the sensitive columns before posting the dump. This seems likely to have been broken at the design stage: systems should fail safe. The first-order fix might be to check the return value of the sanitizer script a…

Yep, naive bash scripts don't stop on failure and your non-sanitized file will happily get uploaded. Does anyone know why Mozilla was posting database dumps(sanitized or otherwise) onto public servers?

It was requested in https://bugzilla.mozilla.org/show_bug.cgi?id=932869

Re: MDN Database Disclosure

#18

Post by [deleted] »

jvehent wrote: post #16
billyhoffman wrote: post #8

There is much that could be done to improve this announcement: 1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail. 2- They talk about a "data sanitization process" failing, but then talk about a "d…

A process failed, and the DB dump that is published to help contributors improve the MDN site got out unsanitized. The sanitization/publication process will be redesigned to include stricter controls. For now, it is shut down. MDN has been using persona for a while now, meaning that most accounts don't have passwords in the database. But older accounts still had the SHA256 salted hash that Django creates. We traced b…

[deleted]

Re: MDN Database Disclosure

#19

Post by flaviojuvenal »

jvehent wrote: post #13
anaphor wrote: post #11

Earlier quoted context omitted.

Why did you decide to use sha256 instead of a kdf like bcrypt or pbkdf2? I'm not attacking you, genuinely curious.

It's what django uses, and this site uses django.

Django 1.3 or lower. Django uses PBKDF2 [1] since 1.4 (March 23, 2012) [2].

[1] https://docs.djangoproject.com/en/1.5/topics/auth/passwords/...

[2] https://docs.djangoproject.com/en/dev/releases/1.4/

Re: MDN Database Disclosure

#20

Post by meowface »

billyhoffman wrote: post #8

There is much that could be done to improve this announcement: 1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail. 2- They talk about a "data sanitization process" failing, but then talk about a "d…

This was one of the least detailed and helpful disclosures I've ever seen.

Reading "encrypted passwords", and then "salted hashes" without any specification of the hash algorithm from a tech company like Mozilla is utterly astonishing to me.

I feel like whoever discovered this breach sent it over to the PR department without any sort of final review of the release by an engineer.

Post reply on HN