Exposing unauthenticated /heapdump endpoints in production is a rookie mistake-especially for a service handling sensitive government comms. The presence of MD5 hashes and legacy tech like JSP just adds to the picture of poor security hygiene. This breach is a textbook case of why defense-in-depth and regular audits are non-negotiable.
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
61–70 of 209 posts
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#62> Because the data is sensitive and full of PII, DDoSecrets is only sharing it with journalists and researchers. Yeah I'm normally a big proponent of responsible disclosure, but in this case, I think the more painful, damaging leak is required. Firstly, autocrats, fascists & oligarchs don't care that much if you hack them. They will just keep using these tools (or another one just like it) ignoring the correct proced…
> The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions. This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have to get Americans to really feel the pain, and to do that I need to to them to wake them…
That quote does not say anything about citizens inflicting pain on others. That’s such a strange way to read it. It’s saying to vote shitty leaders out. I’m not sure what you think any other possible alternative there could be.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#63Great example to use whenever legislators want to ban or add backdoors to e2e encryption.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#64Earlier quoted context omitted.
Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it. I hope the message dump is juicy.
One problem that smart people tend to make is in thinking that being really smart in one area is generalizable to all others. Just because they're good at AppSec doesn't mean they're good at networking or operating a webserver.
I agree with this. It's surprising how often I encounter people with that belief, because I was disabused of it very early on in my career; this industry is chockablock with people who are brilliant in 1 area and deficient in others.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#65"clean on OPSEC"
- Pete Hegseth
That line simultaneously becomes funnier and more depressing.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#66Security standards need to start banning heap dumps.
[deleted]
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#67Earlier quoted context omitted.
There’s room for both sides of the razor. The heapdumpz could be there maliciously, but incompetently made globally accessible.
From the Wired article: "The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint," So the heapdumps being available is a Spring Boot feature so it does not appear to be malicious.
This feature must be explicitly enabled, it is not on by default nor by accident.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#68Yeah no thanks, not donating to gate keepers who want to maintain the status quo. I'll give my coin to wiki leaks and groups with balls.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#69> Because the data is sensitive and full of PII, DDoSecrets is only sharing it with journalists and researchers. Yeah I'm normally a big proponent of responsible disclosure, but in this case, I think the more painful, damaging leak is required. Firstly, autocrats, fascists & oligarchs don't care that much if you hack them. They will just keep using these tools (or another one just like it) ignoring the correct proced…
> The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions. This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have to get Americans to really feel the pain, and to do that I need to to them to wake them…
What if you're hurting people to prevent them from hurting people...
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#70Earlier quoted context omitted.
From the Wired article: "The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint," So the heapdumps being available is a Spring Boot feature so it does not appear to be malicious.
This feature must be explicitly enabled, it is not on by default nor by accident.
huh, I sure seem to be needing to debug this a lot, I guess I'll just leave it turned on all the time that way I can say a few seconds next time. Larry Wall says one of the virtues of being a great developer is laziness!