Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T says criminals stole phone records of 'nearly all' customers in data breach

techcrunch.com

Post reply on HN
Print view View original

381–390 of 874 posts

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#381

Post by bloopernova »

nequo wrote: post #321

@dang Could I ask why this topic gets systematically penalized in the HN ranking? There have been 15 submissions so far, I assume partly because previous submissions are not shown on the main page so HN users keep re-submitting it. This topic is both newsworthy and high interest. (I was going to link to the 14 other submissions but the list is too long and it'd just come across as obnoxious.)

The threads have probably tripped the flamewar detector. Certain amount of comments plus some other metrics will hide the thread from the front page.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#382

Post by biggc »

Animats wrote: post #377

"still-unfolding data breach involving more than 160 customers of the cloud data provider Snowflake.' So what is Snowflake normally doing with all that AT&T data? Redistributing it to "marketing partners"? Apparently. Snowflake's mission statement, from their web site: "Our mission is to break down data silos, overcome complexity and enable secure data collaboration between publishers, advertisers and the essential t…

ATT could be using Snowflake for internal analytics

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#383

Post by jvanderbot »

jodrellblank wrote: post #353
gz5 wrote: post #319

The root cause (1) is the data store should not have been available on the underlay network. Anything connected to an underlay network is a ticking time bomb. Any servers or admins which need to talk to the data store should instead use a private overlay (2) network. Any users (likely just remote admins) should do the same. (1) Same root cause as 99% of breaches and yet it is too often swept under the rug while we fo…

It seems from the article that AT&T uploaded data to a cloud service, protected by username and password, and someone obtained credentials or breached the cloud service. What does that have to do with 'underlay networks' and wow is that "the root cause of 99% of breaches"?

I doubt they "breeched the cloud service" provider. They almost certainly exploited no 2fa controls on the clients access via the clients network, which is what GP was saying. If you're on a businesses network it's too easy to get at their cloud storage or dbs because they should be on a secure overlay network.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#384

Post by nunez »

mass_and_energy wrote: post #306
CuriouslyC wrote: post #273

Big breaches like this are gonna be wild with advanced GenAI. Combing through the shit for the diamonds provided some degree of limitation on the impact of big breaches in the past but all those calls are going to be accurately transcribed and mined by AI and the attackers are going to have a buffet of products and targets laid at their feet.

It's just metadata, no transcription of calls can take place. In the future, please read the article before engaging in the discussion of its content.

Metadata can be identifying enough. For example, given someone has this data and some local LLaMa variant on their machine, they could theoretically run a query like: "Give me all of the people that $NAME have called to, sorted by the number of times they called each other"

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#385

Post by hulitu »

rockskon wrote: post #324
spencerflem wrote: post #280

Earlier quoted context omitted.

It does explain it though. By coincidence they also get billions of dollars in federal subsidies

So do other ISPs. Yet AT&T is by far the worst of all of them with regards to customer privacy. Did you know that AT&T has a commercial product where they sell Metadata of websites visited (unclear if it's only Netflow or if it includes DNS lookups too) to law enforcement and private investigators? AT&T is a blight on the privacy of U.S. citizens.

> Did you know that AT&T has a commercial product where they sell Metadata of websites visited (unclear if it's only Netflow or if it includes DNS lookups too) to law enforcement

Do you think that only AT&T does it ? Welcome to democracy, my friend. /s

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#386

Post by lokar »

Animats wrote: post #377

"still-unfolding data breach involving more than 160 customers of the cloud data provider Snowflake.' So what is Snowflake normally doing with all that AT&T data? Redistributing it to "marketing partners"? Apparently. Snowflake's mission statement, from their web site: "Our mission is to break down data silos, overcome complexity and enable secure data collaboration between publishers, advertisers and the essential t…

It’s a cloud database, mostly olap. The ATT account was secured with a bad password and no mfa.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#387

Post by biggc »

gz5 wrote: post #319

The root cause (1) is the data store should not have been available on the underlay network. Anything connected to an underlay network is a ticking time bomb. Any servers or admins which need to talk to the data store should instead use a private overlay (2) network. Any users (likely just remote admins) should do the same. (1) Same root cause as 99% of breaches and yet it is too often swept under the rug while we fo…

What? Has anyone published an RCA that confirms this? Is this how the data was ex filtrated from Snowflake? Or did ATT’s Snowflake credentials leak?

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#388

Post by gz5 »

Aloisius wrote: post #375
gz5 wrote: post #370

Earlier quoted context omitted.

An attacker who gets username/pw still can't get on the overlay network (the overlay requires credentials which can't easily be stolen or compromised, e.g. a private key signed X.509 certificate). Yes, because 99% of attacks use the underlay network to access the target and exfiltrate the data. Said the other way, an attacker didn't physically walk into a Snowflake data center, console into the right server, and walk…

That sounds more like the lack of certificate-based authentication (or some other stronger authentication method) was the problem, not the lack of a private overlay network. After all, plenty of private overlay networks use simple username/password auth or no auth at all.

Agree, good point, the overlay needs to do strong identity, authN, authZ.

The critical part the overlay adds to traditional auth is making the server unreachable from the underlay networks, reducing attack surface by billions. Meaning:

+ Let's say the server did have good auth, but there was a bug, misconfig, zero day, etc. (one of the myriads of proximate causes).

+ Since the server is available on the underlay network, that vulnerability can be exploited by anyone on the underlay (billions Internet nodes).

+ In contrast, making the server only available on the overlay, reduces the attack surface from billions of Internet nodes to the nodes which can ID, authN and authZ (for that particular server) on the overlay.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#390

Post by lokar »

itscrush wrote: post #378
riffic wrote: post #314

did they just enumerate an open web endpoint for it or something?

API based credentials are just username + password in this context, nothing else seems to be restricting access to data. So if your Snowflake tenant isn't enforcing IP restriction to limit source auth attempts, those creds can be used to pull the data from any source IP. Even then, you'll still have an HTTP 403 response layer filtering those auth attempts based on IP... where we can assume these failed to implement i…

You can use oath or rsa keypair for service account auth
Post reply on HN