[deleted]
Shopify employees accessed customer databases without authorization
11–20 of 39 posts
Re: Shopify employees accessed customer databases without authorization
#12How do you protect against this sort of thing as a SaaS developer?
Re: Shopify employees accessed customer databases without authorization
#13We have recourse against platform employees who snoop user data for personal reasons, and even share it with their friends or political organizations? Literally thought that was a perk of their jobs. Someone should tell reddit/google/facebook/amazon as that will blow things up pretty badly. Wait until they are subject to normal privacy regulations that require the companies to list the names of people who have access…
Something like this should probably legislated https://cloud.google.com/access-transparency
But it doesn't stop the government from bulk copying "business data" via powers granted by the Patriot Act.
Re: Shopify employees accessed customer databases without authorization
#14The only icing in the cake is that at least Shopify has been both transparent and quick - it's only taken a couple months and they've managed to get bottom of the case. Couple months might seem long but from what I've seen it takes about a year of lag time from the start of the breach to when the company finds out/acknowledges.
In any case I'm wondering - how did Shopify discover this intrusion? Do they check logs regularly? Did they receive a tip off?
Re: Shopify employees accessed customer databases without authorization
#15I sometimes go out of my way to hide my identity from sites/services I sign up with. Easiest way to get doxxed is for someone to ask one of their polticially-aligned buddies working at a site to pull up your info.
Re: Shopify employees accessed customer databases without authorization
#16How do you protect against this sort of thing as a SaaS developer?
A step in the right direction is to use encrypted backend data / databases. This is still fraught with problems, but it provides another layer of protection and can demonstrate the difference between "The data was just sitting there" and "We had to manually exfiltrate the encryption keys to read the data".
It's not perfect, but it adds another layer to prove malicious intent.
Re: Shopify employees accessed customer databases without authorization
#17How do you protect against this sort of thing as a SaaS developer?
A step in the right direction is to use encrypted backend data / databases. This is still fraught with problems, but it provides another layer of protection and can demonstrate the difference between "The data was just sitting there" and "We had to manually exfiltrate the encryption keys to read the data". It's not perfect, but it adds another layer to prove malicious intent.
I've thought about this, and researched it too, and see two problems with encrypting user data in the DB:
1. You would have to use an external search engine to index user data, and that would need encryption too.
2. If the user forgets their password then their data is inaccessible.
Re: Shopify employees accessed customer databases without authorization
#18Earlier quoted context omitted.
A step in the right direction is to use encrypted backend data / databases. This is still fraught with problems, but it provides another layer of protection and can demonstrate the difference between "The data was just sitting there" and "We had to manually exfiltrate the encryption keys to read the data". It's not perfect, but it adds another layer to prove malicious intent.
I've thought about this, and researched it too, and see two problems with encrypting user data in the DB: 1. You would have to use an external search engine to index user data, and that would need encryption too. 2. If the user forgets their password then their data is inaccessible. There are ways around 2, but the most obvious way is to encrypt the password with answers to 3 common but difficult to know questions.
The encryption key doesn’t have to be per-user.
If your data is stored in a 3rd party database its common to just use one secret key (which only your app has access to) for all the data to prevent the 3rd party from reading it.
Re: Shopify employees accessed customer databases without authorization
#19Earlier quoted context omitted.
Um what? The problem was the lack of internal authorization to do so. Do you not see how that's a huge liability? It's basically an "inside job". If one employee can do it, then anybody with similar credentials can. The "oh shit" scenario is when the stolen data is used against to commit crimes against customers, e.g., identity theft, stalking, you name it.
Again, youre assuming internal controls exist implicitly. They dont. Theyre a risk exercise not a requirement.
They have very loose controls at shopify - no ISMS, no standard key controls - bluntly, it’s a miracle they haven’t had much worse happen yet. They’re not even ISO27001 compliant or certified.
Re: Shopify employees accessed customer databases without authorization
#20How do you protect against this sort of thing as a SaaS developer?
A step in the right direction is to use encrypted backend data / databases. This is still fraught with problems, but it provides another layer of protection and can demonstrate the difference between "The data was just sitting there" and "We had to manually exfiltrate the encryption keys to read the data". It's not perfect, but it adds another layer to prove malicious intent.
In the vast majority of situations where I have seen unauthorized use of data in this fashion it was customer support people. All the encryption in the world doesn't help if you build tools that allow relatively low paid and under-trained employees to access the data at will.
Effective things you can do to reduce risk:
- Deploy honeypot accounts that email multiple people if they are accessed
- Create a two-man system that requires a second person to approve "risky" things
- Require a 2FA token for your internal tools
- Email the user when they log in from a new IP address
- Have support staff use two different browsers - one to access the ticket system and another to access internal tools