Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was a senior VP of tech at Starwood: here’s my take on the guest data breach

phocuswire.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#51

Post by lowercased »

will4274 wrote: post #25
lowercased wrote: post #14

Earlier quoted context omitted.

> It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys. I worked some place where lots data was encrypted with a key. The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key,…

> The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key, and another 5 had come and gone (and had had access to the same key) in the previous 6 months. What's so wrong with any of this? Software requires operators and developers. If you can't trust…

What was being encrypted was a sequential DB ID that identified your user ID in the system. Decrypting the data (with the key that multiple people had access to and there was no way of telling who'd taken it) would allow you to change your ID and re-encrypt and become someone else. (also, AFAICT, the same key was used for some internal data encryption too - same key used in multiple areas across different teams)

This was initially just a marketing site, but I was being told to use the same system for authentication around a financial service, and I objected. I suggested the ID be random, then mapped to something else. I had multiple 'senior' developers try to explain why "random isn't really random" and had a lot of timing attacks associated with it. I kept pushing back that timing attacks weren't as big a problem as "someone having the key can impersonate anyone, and we can't prove that people haven't taken the key out of the company". I "only" had 9 years experience at this point, but was the 'new guy' in the company, having only been there a few months, and apparently hadn't "paid my dues" in their ecosystem for long enough to be taken seriously.

It took weeks of me objecting before we had a big meeting, and their architecture was mapped out on a board, and defended. I then asked "how can you prove the key hasn't left the building with previous people?" Then my manager sort of "got it" and realized this was all kinda ... not something we should rely on for guarding financial info. Maddening that it took weeks of "deliberation" on this issue when it was patently insecure. I've not ever whiteboarded it out to anyone with more than a few years of experience who didn't stop me partway through to tell me that it was insecure.

Dejected through all of this, I asked to be put on another project, but I was seen as a troublemaker at that point, then left.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#52

Post by nazca »

rdl wrote: post #27
nazca wrote: post #17

Worth pointing out that at the time of this guy's tenure, and for many years afterwards, the way you authenticated yourself while booking a rewards reservation with SPG via the phone was to verbally tell the agent your online password. Like, WTF.

The SPG password for phone has been a different password from the web login password for as long as I can remember (2014?)

Yes, I remember them being the same from 2005-ish through to about 2011-2012 ish. This guy was at SPG until 2006.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#53

Post by closeparen »

will4274 wrote: post #25
lowercased wrote: post #14

Earlier quoted context omitted.

> It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys. I worked some place where lots data was encrypted with a key. The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key,…

> The key hadn't changed in months - at least 6 months by the time I found it. I was told this same key would be used to encrypt web session data in a cookie. There were more than a dozen people who I knew had access to the key, and another 5 had come and gone (and had had access to the same key) in the previous 6 months. What's so wrong with any of this? Software requires operators and developers. If you can't trust…

There are mature and well known techniques for mitigating insider threats. Key rotation capability is table stakes. Keys that are too expensive to rotate need to be in HSMs, and probably protected by operator quorum. There may be some short-lived, limited purpose keys that are more vulnerable, but the whole company’s master keys to everything should absolutely not be held by any one person.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#54

Post by tyingq »

abhorrence wrote: post #2

This article seems full of points that a lay person might nod along with, yet don't hold up to scrutiny. > The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. It does not mean that. It means that we don't know of any exploited vulnerabilities before that point. > If the detection tool was used prior to this September, why…

"the article strikes me as an article written by someone who has a beef with Marriott"

Another comment here references a post he made in 2016: https://www.linkedin.com/pulse/marriottstarwood-back-future-...

Seems to be more of the same.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#55

Post by neil_s »

This is a surprisingly poor understanding of tech. Do hotels hand out titles like investment banks (there were hundreds of VPs at JP Morgan), or was this author actually in a position of responsibility? Is it common for non-tech companies to have such people in high up places?

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#56

Post by laurentl »

heartbreak wrote: post #9
abhorrence wrote: post #2

This article seems full of points that a lay person might nod along with, yet don't hold up to scrutiny. > The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. It does not mean that. It means that we don't know of any exploited vulnerabilities before that point. > If the detection tool was used prior to this September, why…

> Ultimately the article strikes me as an article written by someone who has a beef with Marriott, and he ends noting that it's possible that the breach occurred not due to issues with design, but due to the layoffs of Starwood's technical staff. I agree with your first several points, but a lay-off beef is unlikely since the author hasn’t worked for Starwood in over a decade.

More like someone with "CTO of Starwood" on his resume at a time when "Starwood IT hacked" is the main headline.

I tend to agree with his conclusion: without further information, it's useless to speculate about how it happened. But his effort to spin an alternative narrative is, at best, self-serving.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#57

Post by busterarm »

There's a lot of sour-grapes among Starwood employees in the lead-up to and after the merger. A lot of dedicated middle management folks got forced out and a lot of managers in well-performing hotels were forced to move. None of the grunt employees seemed happy with it on either side.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#58

Post by laurentl »

neil_s wrote: post #55

This is a surprisingly poor understanding of tech. Do hotels hand out titles like investment banks (there were hundreds of VPs at JP Morgan), or was this author actually in a position of responsibility? Is it common for non-tech companies to have such people in high up places?

2 factors I think:

* the CTO title is the new project manager. It seems as soon as someone is in a position to choose whether to use Postgre or MySql they break out the CTO moniker. You can now be the CTO of just about any organizational unit, no matter how small.

* CTO != CISO (quite the contrary usually). Being tech-savy doesn't mean you grok security, especially its operational, wetware/social aspects. Obligatory xkcd: https://www.xkcd.com/538/

I would tend to go with the second explanation in this case. When I read the quote "It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys", I thought it pointed to a lack of imagination (and probably a bit of Dunning-Kruger syndrome) rather than security expertise.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#59

Post by barrow-rider »

hn_throwaway_99 wrote: post #37
abhorrence wrote: post #2

This article seems full of points that a lay person might nod along with, yet don't hold up to scrutiny. > The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. It does not mean that. It means that we don't know of any exploited vulnerabilities before that point. > If the detection tool was used prior to this September, why…

Honestly, after seeing this article upvoted so high and then reading it, I was relieved to see these comments. At it's root, security for always-on networked systems is extremely difficult, even at tech-first companies with an ingrained "security culture", nevermind a hospitality company like Starwood where "IT" is another department. And this guy comes forth with clueless statement after clueless statement about "Th…

> This whole article is incredibly self serving.

Mmmmhmmmm. It's executive CYA, and a public article for a public clusterfuck.

5 years ago is when this stuff probably started going sideways and those failures manifest later as massive outages, breaches, etc. Could be that the author IS WHY a lot of these issues cropped up later, so take proactive steps to blame others.

Gotta keep that executive cachet high so that you can slide into a CTO role elsewhere.

Re: I was a senior VP of tech at Starwood: here’s my take on the guest data breach

#60

Post by licebmi__at__ »

> Still, most commonly, breaches occur when someone obtains an administrative password via deceitful means (e.g., phishing attacks), enabling them to log into the system and install Trojan software to extract data or to manipulate the system.

> This is the method the Russians used to hack into the Democratic National Committee emails, for example.

AFAIK, phishing was the main attack for Podesta's emails, but I'm not aware that this was used on the DNC hack. I think the author is mixing scenarios.

Post reply on HN