Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

71–80 of 526 posts

Re: Slack was hacked

#71

Post by legohead »

rattray wrote: post #45

How does one discover that they were hacked? The post states that the breach occurred during February, and this is the end of March... did it just take them a long time to react and write a post about it, or did they likely discover after the fact? If so, how?

At a place I worked at we discovered it in a couple ways. One was a routine scan done by our host provider, looking for malicious files meant to do things like create a web-shell. After they found the malicious files they had logs to determine the time frame of the attack(s).

And in another instance the hacker emailed us asking for ransom.

Re: Slack was hacked

#72

Post by azinman2 »

elchief wrote: post #50

Assuming (no evidence, it's just very common) that this was a SQL Injection, here are some ways to protect yourself: * Use http://en.wikipedia.org/wiki/Database_activity_monitoring . If you don't list users on your site and you get a query that would return more than one user record, it's a hacker * Add some http://en.wikipedia.org/wiki/Honeytoken s to your user table, and sound the alarm if they leave your db * Use…

Why would you assume that? There are plenty of ways to hack into stuff without sql injections.

Re: Slack was hacked

#73

Post by tracker1 »

rattray wrote: post #45

How does one discover that they were hacked? The post states that the breach occurred during February, and this is the end of March... did it just take them a long time to react and write a post about it, or did they likely discover after the fact? If so, how?

Logging every API request through every layer into ElasticSearch/Logstash or something similar for starters.

Re: Slack was hacked

#74

Post by blfr »

nvk wrote: post #19

Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!

It will take you more than 10 minutes to just choose the ircd to use. Not to mention configuration and maintenance.

I looked through the ircds available in Debian repositories the other day and they didn't look very fresh. So you might also have to package them from source and make sure that stays up to date.

Hosting your own services has some appealing security qualities (like being able to put them in your VPN) but it's far from a panacea and definitely harder than signing up for Slack/Gmail/GitHub.

Re: Slack was hacked

#75

Post by loumf »

rattray wrote: post #45

How does one discover that they were hacked? The post states that the breach occurred during February, and this is the end of March... did it just take them a long time to react and write a post about it, or did they likely discover after the fact? If so, how?

logs -- perhaps they hired a security firm to do periodic audits.

Re: Slack was hacked

#76

Post by jahewson »

larsiusprime wrote: post #6

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?

Buy a smartphone. You can get a Huawei on eBay for $20. You don't even need a sim or a contract, just connect to wifi and download the Authenticator app.

Re: Slack was hacked

#77

Post by biot »

eridius wrote: post #31

> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. Is this true even when the attacker is specifically focusing on a single account, or is it only computationally infeasible to recover passwords for accounts in general?

Yes, depending on the work factor chosen. See http://wildlyinaccurate.com/bcrypt-choosing-a-work-factor/#b... for a table of work factors and associated time to check a single password. The work factor is a trade-off involving burning CPU cycles, load on the servers processing logins, and user experience. If you choose a work factor resulting in each password verification taking half a second, it's essentially computationally infeasible to brute force any decently chosen password.

Someone could go through the list of the top million passwords in a week of CPU time and, because each hash has its own randomly generated salt, the effort spent cracking one user's password yields no insight into anyone else's password; the entire effort needs to be repeated per user. If your password has sufficient entropy (eg: long and randomly generated, not appearing in any password lists) then -- barring some revolutionary mathematical breakthrough -- you don't need to worry about someone discovering your password before the heat death of the universe.

Re: Slack was hacked

#78

Post by tracker1 »

3princip wrote: post #54

Lot's of hype (IMO) around Slack, but lot's of money thrown at them so I kept thinking that I'm missing something! Just being skeptical as usual. The other day an invitation arrives to use Slack. Great! Let's see it, this killer feature or killer combination of features. What have these smart people come up with that hasn't been done countless times in the same space to make them so successful? It's literally nothing…

You could do something similar with an IRC server and bots with webhooks... Just the same, they did do this, and offer a web based interface that people are more comfortable with (no need for an irc client), and does more than IRC clients do.

IT's not that anyone else couldn't do this, it's that they've done it relatively well.

Re: Slack was hacked

#79

Post by elchief »

azinman2 wrote: post #72
elchief wrote: post #50

Assuming (no evidence, it's just very common) that this was a SQL Injection, here are some ways to protect yourself: * Use http://en.wikipedia.org/wiki/Database_activity_monitoring . If you don't list users on your site and you get a query that would return more than one user record, it's a hacker * Add some http://en.wikipedia.org/wiki/Honeytoken s to your user table, and sound the alarm if they leave your db * Use…

Why would you assume that? There are plenty of ways to hack into stuff without sql injections.

It's the most common vulnerability. https://www.owasp.org/index.php/Top_10_2013-A1-Injection

Re: Slack was hacked

#80

Post by azinman2 »

eridius wrote: post #61
NobleLie wrote: post #48

Earlier quoted context omitted.

Coincidentally, I was just looking into your question; this should answer your concern. "Since every user has their own unique random salt, two users who happen to have the same password get different salted hashes. [If] the dictionary attack is foiled, the attacker cannot compute the hashes of every word in a dictionary once and then check every hash in the table for matches anymore. Rather, the attacker is going to…

Yeah, salts mean you can't use rainbow tables. But you can still attack a single user. The question is what "computationally infeasible" actually means. How much computing power would it take to crack a single user's password? How about if it's a weak one? A strong one? If the answer is "it would take $1000 worth of Amazon EC2 computing to crack a single weak password", well, that's certainly feasible to do if you ha…

And given th usernames and emails are out there, it reveals (a) all the companies using slack, (b) potentially very high value targets. I wonder who they had specifically emailed. My guess is those people aren't using slack anymore.
Post reply on HN