Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker Has Wiped a Spyware Company’s Servers

motherboard.vice.com

Post reply on HN
Print view View original

61–70 of 120 posts

Re: A Hacker Has Wiped a Spyware Company’s Servers

#61

Post by chrisweekly »

bshacklett wrote: post #45
kuschku wrote: post #37

Earlier quoted context omitted.

This is a common issue, and many apps do this mistake. Another common mistake is having /.git/ available on the domain itself, often with PHP sites or backend-less SPAs this is common, giving full access to the source, including those API keys. Even major sites do this – The Hill until recently had their git repo, including API tokens and access keys for everything, publicly available.

It should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.

Amen. https://12factor.net

Re: A Hacker Has Wiped a Spyware Company’s Servers

#62

Post by CodeWriter23 »

quadrangle wrote: post #49

This is a good case of vigilante justice, but vigilantism is problematic in general. We should probably be formally outlawing the sort of practices these companies have and also putting in place far stronger real privacy measures for all data-collecting companies. Until (if ever) the law catches up, vigilantism will be better than nothing.

We already have such laws in the US. Two-party consent wiretapping laws at the state level and the Computer Fraud and Abuse Act at the Federal Level.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#63

Post by nitrogen »

nodesocket wrote: post #4

How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?

As a regular Android user, I'll say that Android's permission model is simply awful.

There's no way (in stock) to return blank data, so apps will simply shut down or silently malfunction if you refuse permissions.

The grouping of permissions lumps "can portscan your network" and "run hidden in the background when your phone boots" under "Other", which you can't disable.

J2ME had a more refined security model back in 2006.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#64

Post by nitrogen »

CodeWriter23 wrote: post #62
quadrangle wrote: post #49

This is a good case of vigilante justice, but vigilantism is problematic in general. We should probably be formally outlawing the sort of practices these companies have and also putting in place far stronger real privacy measures for all data-collecting companies. Until (if ever) the law catches up, vigilantism will be better than nothing.

We already have such laws in the US. Two-party consent wiretapping laws at the state level and the Computer Fraud and Abuse Act at the Federal Level.

Many states only require single-party consent, but third-party spyware violates that, too.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#65

Post by click170 »

Nicksil wrote: post #46

It seems there's an attempt to quell customer discussion via locking such a thread on their forum[0]. A particularly upset customer's remarks[1]. [0] https://forums.flightsimlabs.com/index.php?/topic/16236-furt... [1] https://forums.flightsimlabs.com/index.php?/topic/16236-furt...

This is exactly why I don't bother with forums controlled by the company I wish to raise a grievance about. Just go air your complaint on Reddit or something they don't control, it's not worth your time complaining to their forums.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#66

Post by jlgaddis »

Nicksil wrote: post #46

It seems there's an attempt to quell customer discussion via locking such a thread on their forum[0]. A particularly upset customer's remarks[1]. [0] https://forums.flightsimlabs.com/index.php?/topic/16236-furt... [1] https://forums.flightsimlabs.com/index.php?/topic/16236-furt...

FYI, you posted your comment on the wrong thread.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#67

Post by mulmen »

greglindahl wrote: post #54
mulmen wrote: post #50

Earlier quoted context omitted.

Really? That's interesting, can you elaborate?

The US regulates "wear bars" on tires, which make it a lot more obvious when tires need to be replaced. I'm not saying that government regulation is needed, I'm just pointing out that the purpose of this tire feature is to make it more likely that people notice tire wear, and don't die from accidents involving bald tires.

Ah thank you for the clarification. I was thinking along the lines of a right to repair where maintenance tasks such as replacing filters are convenient. I would not attribute that to regulation as much as practicality in even mechanics working on the cars.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#68

Post by Nicksil »

jlgaddis wrote: post #66
Nicksil wrote: post #46

It seems there's an attempt to quell customer discussion via locking such a thread on their forum[0]. A particularly upset customer's remarks[1]. [0] https://forums.flightsimlabs.com/index.php?/topic/16236-furt... [1] https://forums.flightsimlabs.com/index.php?/topic/16236-furt...

FYI, you posted your comment on the wrong thread.

Oh man, you're absolutely right. Doesn't look like I can delete it, either.

Very sorry, everyone! I had one too many tabs open it seems.

Re: A Hacker Has Wiped a Spyware Company’s Servers

#69

Post by neuland »

figgis wrote: post #48
sowbug wrote: post #40

Earlier quoted context omitted.

It's all the more pathetic that they responded to the first hack by "obfuscating" the client-side secret, as if that could even theoretically stop any attacker with a budget of more than about an hour. Future service designers: if your client is talking directly to AWS, then your attacker will, too. Take the week to write a CRUD frontend server that enforces the policy you want.

Do you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to find it and my search results are... unhelpful at best.

Checklists are cool and all. But, you shouldn't need a checklist to know that you shouldn't ship API keys.
Post reply on HN