Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify employees accessed customer databases without authorization

news.ycombinator.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: Shopify employees accessed customer databases without authorization

#31

Post by icedchai »

thinkingkong wrote: post #10
tantalor wrote: post #5

Earlier quoted context omitted.

Um what? The problem was the lack of internal authorization to do so. Do you not see how that's a huge liability? It's basically an "inside job". If one employee can do it, then anybody with similar credentials can. The "oh shit" scenario is when the stolen data is used against to commit crimes against customers, e.g., identity theft, stalking, you name it.

Again, youre assuming internal controls exist implicitly. They dont. Theyre a risk exercise not a requirement.

Most small SaaS companies, the sort I have worked for, have literally zero controls for this sort of thing. I would expect more of a 100+ billion dollar company like Shopify, but frankly I am not surprised.

Re: Shopify employees accessed customer databases without authorization

#32

Post by jpalomaki »

jasfi wrote: post #12

How do you protect against this sort of thing as a SaaS developer?

Prevent direct database access or at least allow it only from jump servers which don’t allow file transfers.

For troubleshooting purposes create debugging tools. Log and check their usage. When things mature, you can even require multiple admins to work together for certain actions.

Minimize human access to production envs. Automate deployments. When access is needed, use jump servers and block file transfers (or force them to go through channel that is audited).

Do review logs and alerts on regular basis. Put effort to minimize false alerts and excessive logging. Quite when reviewing logs you just notice things that “don’t look right”.

Nothing is 100% secure, but also people with bad intensions don’t always have unlimited skills/energy/time.

Re: Shopify employees accessed customer databases without authorization

#33

Post by mytailorisrich »

jasfi wrote: post #12

How do you protect against this sort of thing as a SaaS developer?

Employees should have access to customers' data on a need to know basis. Most employees do not need access so should not have access.

Then, there should be an audit trail of all accesses and this should be known to employees. First that dissuades employees from acting improperly, second that allows the company to verify that they indeed do not act improperly and to track down culprits if something happens.

Re: Shopify employees accessed customer databases without authorization

#34

Post by twunde »

motohagiography wrote: post #9

We have recourse against platform employees who snoop user data for personal reasons, and even share it with their friends or political organizations? Literally thought that was a perk of their jobs. Someone should tell reddit/google/facebook/amazon as that will blow things up pretty badly. Wait until they are subject to normal privacy regulations that require the companies to list the names of people who have access…

From what I've heard from ex-FB employees, they are told repeatedly during onboarding that snooping for personal reasons is a first-offensive firable offense, to the point that engineers often won't try to look up information even when debugging prod issues.

Re: Shopify employees accessed customer databases without authorization

#35

Post by twunde »

wyxuan wrote: post #14

The only icing in the cake is that at least Shopify has been both transparent and quick - it's only taken a couple months and they've managed to get bottom of the case. Couple months might seem long but from what I've seen it takes about a year of lag time from the start of the breach to when the company finds out/acknowledges. In any case I'm wondering - how did Shopify discover this intrusion? Do they check logs re…

This is a common requirement for security-conscious organizations, especially those with HIPAA or PCI requirements. For shopify, this likely was originally created as a customer requirement, so that clients could monitor their staff. The typical setup is to generate internal user logs and feed it into a SIEM of some type, potentially with custom rules to do some checking. Alternatively, this may very well have been caught by a type of DLP (data loss protection) or network monitoring product

Re: Shopify employees accessed customer databases without authorization

#36

Post by twunde »

madaxe_again wrote: post #19
thinkingkong wrote: post #10

Earlier quoted context omitted.

Again, youre assuming internal controls exist implicitly. They dont. Theyre a risk exercise not a requirement.

They have very loose controls at shopify - no ISMS, no standard key controls - bluntly, it’s a miracle they haven’t had much worse happen yet. They’re not even ISO27001 compliant or certified.

This may have been true in the past, however per https://www.shopify.com/security they are SOC2-certified (SOC2 is significantly more common in North America), they are certainly PCI Level 1, and have GDPR/CCPA compliance requirements. You can also see their 2019 Transparency Report: https://www.shopify.com/security/transparency-report/report-.... It is still possible that their SOC2 and PCI reports could have a number of exceptions, but I would be surprised at this point in their maturity cycle.

Re: Shopify employees accessed customer databases without authorization

#37

Post by Dracophoenix »

dgudkov wrote: post #22

It seems like employees are becoming the weakest link in cloud security. If Google will be breached one day, most probably it will happen not because of a technical vulnerability, but due to employee sabotage. I'm pretty sure that at exactly this moment somewhere someone criminal is already analyzing organization structures, employee profiles, internal security policies and tools of the cloud giants.

That already happened a decade ago: https://www.wired.com/2010/09/google-spy/

Re: Shopify employees accessed customer databases without authorization

#38

Post by dgudkov »

sep_field wrote: post #27
dgudkov wrote: post #22

It seems like employees are becoming the weakest link in cloud security. If Google will be breached one day, most probably it will happen not because of a technical vulnerability, but due to employee sabotage. I'm pretty sure that at exactly this moment somewhere someone criminal is already analyzing organization structures, employee profiles, internal security policies and tools of the cloud giants.

Speaking as an ex-Facebook engineer it would be incredibly easy to get nefarious people employed there in an engineering role. Once inside, they have access to -all- user data; there is no actual access control (there are some basic access checks built into the Facebook application to keep you from accessing "private" data fields by accident, but all you have to do is edit that code and remove the access check and re…

Then it wouldn't be unreasonable to assume that such nefarious people have already infiltrated Facebook and other tech giants. And they are not amateurs. Given the extraordinary value of access to the information possessed by the big tech corporations, we can expect a level of sophistication that would be on par with Cold War-era espionage.

Re: Shopify employees accessed customer databases without authorization

#39

Post by tantalor »

zenexer wrote: post #29
tantalor wrote: post #28

Earlier quoted context omitted.

That wouldn't be "without authorization" then.

Yes it would. If you fail to put up a fence around your yard, that doesn’t mean I’m authorized to walk in and steal your garden gnomes. Sure, it would be ideal if authorization were enforced with technical barriers, but just because a computer system thinks someone is authorized to access data doesn’t mean they have the legal authority to do so. Let’s say I own a company like Shopify. I have an agreement with my cust…

Thanks for the thoughtful comment. You make several excellent points which I really appreciate!

> It’s unreasonable to bar all employees from accessing sensitive data at a technical level

This is the heart of the confusion. Sensitive data must be locked down (e.g., encrypted) and access tightly controlled so only employees with a legitimate purpose have read access. Since this is a "technical" solution to the problem, I would label the original data breach a "technical" vulnerability.

On the hand, the "developers conspire to push malicious or faulty changes to production" scenario is not a technical vulnerability; it falls into the category of deceit/fraud à la social engineering. Of course there are technical means you could try to foil exfiltration, but generally this sort of attack is prevented by non-technical means e.g. code review.

Post reply on HN