Not all heroes wear capes.
A Hacker Has Wiped a Spyware Company’s Servers
71–80 of 120 posts
Re: A Hacker Has Wiped a Spyware Company’s Servers
#72Earlier quoted context omitted.
It's all the more pathetic that they responded to the first hack by "obfuscating" the client-side secret, as if that could even theoretically stop any attacker with a budget of more than about an hour. Future service designers: if your client is talking directly to AWS, then your attacker will, too. Take the week to write a CRUD frontend server that enforces the policy you want.
Do you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to find it and my search results are... unhelpful at best.
Check out OWASP cheatsheets and guides:
Re: A Hacker Has Wiped a Spyware Company’s Servers
#73It seems there's an attempt to quell customer discussion via locking such a thread on their forum[0]. A particularly upset customer's remarks[1]. [0] https://forums.flightsimlabs.com/index.php?/topic/16236-furt... [1] https://forums.flightsimlabs.com/index.php?/topic/16236-furt...
What's the connection between Flight Sim Labs and Retina-X?
Re: A Hacker Has Wiped a Spyware Company’s Servers
#74They stored the master key to their entire data store in a publicly distributed app? > ...we have been taking steps to enhance our data security measures. Sharing details of security measures could only serve to potentially compromise those efforts. Maybe they used ROT13 on the API key twice this time!
I can publish my public key all day long for encryption into a back-end ... and later I can only read it with my private key. So they may not have used ROT13 but it certainly looks like they used something symmetrical.
Re: A Hacker Has Wiped a Spyware Company’s Servers
#75Earlier quoted context omitted.
This is a common issue, and many apps do this mistake. Another common mistake is having /.git/ available on the domain itself, often with PHP sites or backend-less SPAs this is common, giving full access to the source, including those API keys. Even major sites do this – The Hill until recently had their git repo, including API tokens and access keys for everything, publicly available.
It should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.
Agreed ... use a pre-commit hook to scan your repository for high-entropy strings before they are forever enshrined in your history (https://github.com/dxa4481/truffleHog).
Re: A Hacker Has Wiped a Spyware Company’s Servers
#76How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?
As a regular Android user, I'll say that Android's permission model is simply awful. There's no way (in stock) to return blank data, so apps will simply shut down or silently malfunction if you refuse permissions. The grouping of permissions lumps "can portscan your network" and "run hidden in the background when your phone boots" under "Other", which you can't disable. J2ME had a more refined security model back in…
There are so many applications I'd love to install but ... why do they insist on asking for permissions that they simply don't need for their stated functionality. Of course you want your SSH terminal to have ties to the social networks.
Re: A Hacker Has Wiped a Spyware Company’s Servers
#77This is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now. If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.
> If you are in the business of collecting data without users' explicit permission, or a warrant from a court, you shouldn't be in business.
Fixed that for you
Re: A Hacker Has Wiped a Spyware Company’s Servers
#78How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?
Isn't Google supposed to be reviewing the apps? The real question is: who gets to say in what someone's phone is going to be doing: the programmer, the manufacturer or the phone's owner. Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Germany takes another approach: no one gets to do surveillance outside strict limits, privacy is highly regarded…
>Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all.
Isn’t setting the defaults behaviour ‘Having a say’, and who else but the manufacturer gets to do that? Sorry but this suggestion doesn’t make it past even 2 seconds of considered thought.
Another few seconds - who gets to decide what privacy controls the phone even has, if not the manufacturer? Does this not count as having a say?
I can see why some manufacturers would agree with you though, many of them give the impression they don’t want to have any responsibility in this area whatsoever.
Re: A Hacker Has Wiped a Spyware Company’s Servers
#79How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?
As a regular Android user, I'll say that Android's permission model is simply awful. There's no way (in stock) to return blank data, so apps will simply shut down or silently malfunction if you refuse permissions. The grouping of permissions lumps "can portscan your network" and "run hidden in the background when your phone boots" under "Other", which you can't disable. J2ME had a more refined security model back in…
I agree, but many of the apps I've "crippled" using the following app still work as well as I need them to work:
https://play.google.com/store/apps/details?id=com.gmail.heag...
Re: A Hacker Has Wiped a Spyware Company’s Servers
#80Earlier quoted context omitted.
The US regulates "wear bars" on tires, which make it a lot more obvious when tires need to be replaced. I'm not saying that government regulation is needed, I'm just pointing out that the purpose of this tire feature is to make it more likely that people notice tire wear, and don't die from accidents involving bald tires.
Ah thank you for the clarification. I was thinking along the lines of a right to repair where maintenance tasks such as replacing filters are convenient. I would not attribute that to regulation as much as practicality in even mechanics working on the cars.
Weren't there some BMWs that required a mechanic with a special tool just to refill the DEF tank?