Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

micahflee.com

Post reply on HN
Print view View original

141–150 of 209 posts

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#141

Post by rsynnott »

rainworld wrote: post #140
rsynnott wrote: post #121

Earlier quoted context omitted.

I'm not sure why you'd expect intelligence agency types to be particularly good at engineering, tbh.

Spooks in general like to project a veneer of competence, downright invincibility. Entertainment media, journalists, experts play a big role in this. And by and large it works. It’s especially true for spooks of a certain entity. Also, it’s easy to confuse brazenness, being protected from consequences, and usually downplayed or secret Western complicity with competence.

I mean, I'm sure they're competent in some stuff, but being competent in one field doesn't generally mean being magically competent in _all_ fields.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#142

Post by Yizahi »

CobrastanJorji wrote: post #29
0xbadcafebee wrote: post #21

> Because the data is sensitive and full of PII, DDoSecrets is only sharing it with journalists and researchers. Yeah I'm normally a big proponent of responsible disclosure, but in this case, I think the more painful, damaging leak is required. Firstly, autocrats, fascists & oligarchs don't care that much if you hack them. They will just keep using these tools (or another one just like it) ignoring the correct proced…

> The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions. This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have to get Americans to really feel the pain, and to do that I need to to them to wake them…

If we really think about the issue, then it is clear that 99.99% of the government information can be public with zero consequences to the citizens. I'm guessing the only few exceptions are active military ops, active spy ops and ways to access secure systems (passwords etc.). Everything else is more or less safe. Embarrassing to the politicians, but safe.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#143

Post by Yizahi »

diggan wrote: post #139
Yizahi wrote: post #136

I love when politicians, lobbying for the backdooring all communication software are getting pwned in the same way. Too bad they lack either brain cells or basic human empathy to make a connection between these events.

> Too bad they lack either brain cells or basic human empathy to make a connection between these events. I think that's giving them too much benefits. They know what they're doing, it's clear they want "security for me, but not for you", and claiming they're too dumb to know exactly what they're doing is playing it exactly like how they want it.

Yeah, that the "lacking empathy part". Most of them are sociopaths and psychopaths, in the medical sense. They only want power for themselves at any cost to others.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#144

Post by kennywinker »

gruez wrote: post #19
barbazoo wrote: post #3

Earlier quoted context omitted.

Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it. I hope the message dump is juicy.

I thought Israel has mandatory military service, so ex-mossad or ex-military signals intelligence doesn't really say much? Presumably they're directing people based on their skill set, so you'd expect most hackers to end up in mossad for their mandatory service.

> Presumably they're directing people based on their skill set

Big presumption.

If I were israeli, there’s no way in hell anybody with half a brain would want me near their spy agency.

When a gov is committing a genocide, their decisions are based on control and fear, not getting the best out of people.

Edit: downvote all you want. Israel is still committing a genocide. No hospitals left standing. Killing aid workers, journalists, and doctors. A million people on the brink of starvation. Literally salting the earth to prevent crops from being grown. That is war crimes, ghettoization, and genocide.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#145

Post by calvinmorrison »

miki123211 wrote: post #125
mingus88 wrote: post #4

Earlier quoted context omitted.

Can you imagine co-opting a trusted and secure (and free) bit of software and just making it worse at seemingly every turn? And charging for it?! I’m not sure what is more embarrassing: to be the company or to be a user.

This is why Signal is so opposed to third-party apps (or forks) that connect to their service. If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal. If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.

That doesn't seem to be a problem for protocols and having a single implementation can lead to bugs that defy spec yet cause no issues obviously.

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#146

Post by kevincox »

sneak wrote: post #56
brookst wrote: post #17

Earlier quoted context omitted.

Sure, but they were not required to be done incompetently and insecurely.

The fundamental concept of plaintext archiving (escrow) of messages from e2ee messaging apps is insecure by most definitions. They could have used user-custody public key cryptography, where the end devices have the pubkey of the customer, and archive only re-encrypted messages to TM that they can’t read. That is not, of course, what they did. They just archive them in plaintext.

I don't think it is. I can archive my own messages and E2E security on the messaging layer means I don't have to trust the operator of the messaging service to not read my messages because they can't. The choice of how I archive the messages is completely orthogonal to the choice of messaging platform security. I could choose to use an E2EE approach if I want but in that case it probably wasn't even desired as the point was to have these be archived for audit purposes. (Of course they are more secure options such as archiving to an audit key, but this is still orthogonal to the concern of the messaging protocol)

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#147

Post by czl »

oceanplexian wrote: post #43
barbazoo wrote: post #3

Earlier quoted context omitted.

Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it. I hope the message dump is juicy.

One problem that smart people tend to make is in thinking that being really smart in one area is generalizable to all others. Just because they're good at AppSec doesn't mean they're good at networking or operating a webserver.

Aka "halo effect"

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#148

Post by arresin »

coolcase wrote: post #127
sillystu04 wrote: post #116

Earlier quoted context omitted.

In fairness, FTX had a profitable bankruptcy [1]. So it's still better to be scammed by Jane Street alumni than to be scammed by the usual alumni of Goldman Sachs, JP Morgan etc [1] https://www.bloomberg.com/news/articles/2024-05-15/ftx-bankr...

How is that fair? It was luck from the AI investment. Pure luck.

It wasn’t the only smart investment

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#149

Post by ctxc »

calvinmorrison wrote: post #145
miki123211 wrote: post #125

Earlier quoted context omitted.

This is why Signal is so opposed to third-party apps (or forks) that connect to their service. If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal. If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.

That doesn't seem to be a problem for protocols and having a single implementation can lead to bugs that defy spec yet cause no issues obviously.

But you're not branding or selling implementations

Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

#150

Post by Traubenfuchs »

willmarquis wrote: post #61

Exposing unauthenticated /heapdump endpoints in production is a rookie mistake-especially for a service handling sensitive government comms. The presence of MD5 hashes and legacy tech like JSP just adds to the picture of poor security hygiene. This breach is a textbook case of why defense-in-depth and regular audits are non-negotiable.

Don't hate on JSP.

Java Server Pages is now Jakarta Server Pages, part of Java EE (Jakarta EE) and it's latest version 11 was released just a year ago. Spring Framework 7 will be released by the end of 2025 and be based on it. Tomcat 11 is already based on it as well.

And all of this is based on the thriving Java ecosystem.

Version 12 is under development.

If they kept their stuff updated, nothing about this is legacy. It just declined in popularity.

You can build insecure trash and expose unprotected endpoints with next.js, or whatever is currently considered state of the art, as well.

Post reply on HN