Believe it or not a lot of hacking is more like this than you think.
Social engineering is probably 95% of modern attack vectors. And that’s not even unexpected, some highly regarded computer scientists and security researchers concluded this more than a decade ago.
When the technical side reaches a certain level of security, the humans become the weakest link.
I work in security and I kinda doubt this. There are plenty of issues just like what is outlined here that would be much easier to exploit than social engineering. Social engineering costs a lot more than
GET /secrets.json.There is good reason to be concerned about both, but 95% sounds way off and makes it sound like companies should allocate significantly more time to defend against social engineering, when they should first try to ensure social engineering is the easiest way to exploit their system. I can tell you from about a decade of experience that it typically isn’t.
https://www.infosecinstitute.com/resources/security-awareness/human-error-responsible-data-breaches/
You’re right. It’s 74%.
https://www.cybersecuritydive.com/news/clorox-380-million-suit-cognizant-cyberattack/753837/
It’s way easier to convince someone that you are just a lost user who needs access than it is to try to probe an organization’s IT security from the outside.
This is only going to get worse with the ability to replicate other’s voices and images. People already consistently fall for text message and email social engineering. Now someone just needs to build a model off a CSO doing interviews for a few hours and then call their phone explaining there has been a breach. Sure, 80% of good tech professionals won’t fall for it, but the other 20% that just got hired out of their league and are fearing for their jobs will immediately do what they are told, especially if the breach is elaborate enough to convince them it’s an internal security thing.
Yes social engineering can be incredibly effective. I completely agree, but there is a bit of an obsession with it these days and imo it’s over indexed, because at the end of the day the type of social engineering detailed in that report typically just provides access.
In some cases, the target is important enough and has enough organizational power that accessing the network as them is sufficient, but that’s not often the case. What that means is that in those other cases social engineering (which in that report you cited is often just phishing) is providing, typically, internal network access. An attacker will have to move through the network and exploit software typically to continue their attack. There are many points in this chain that the weakness lies in software or configuration. If effort was placed on making those systems better it would likely see better results than hyper focusing on the social engineering, which is significantly more difficult to stop, especially with all of the things you mentioned on the horizon.
My point is then that even if it is a part of 74% of breaches, according to Verizon, it’s not necessarily sufficient and is often paired with software level exploits.
And I know this because my company does plenty of red teaming, and we use social engineering but at the end of the day the more interesting result comes from a software exploit or just abusing a weak configuration.
You are right and what some people miss is that social engineering being the vector to gain foothold doesn’t mean that it was sufficient to allow the breach. Almost always you need some other weakness (or a series of them). Except when the weaknesses are so had that you don’t need a foothold at all (like this case), or when the social engineering gives you everything (rare, but you might convince you someone to give you access to data etc.).
A whole separate conversation is deserved by how effective (or not) social engineering training is. Quite a few good papers about the topic came out in the last fee years.
This has been the case for 40+ years. Humans are almost always the weakest link.
we built this shit. thus we are always to blame.
Many years ago, I discovered that my then-employer’s “home built” e-commerce system had all user and admin passwords displayed in plaintext at home/admin/passwords.
When I brought this to the attention of leadership, they called the “developer” in and he said “oh, well, that’s IP locked, so no one on the web can access it!” When I pulled it up on my phone, he insisted my phone was on the work WiFi, despite it being clearly verifiable that was not the case. (The same work WiFi that had an open public connection, which is the one my phone would have been on, if it were on it…)
He did fix that, but many other issues remained. Eventually a new COO hired someone competent as his ‘backup’, replaced our website and finally suggested he pursue other employment opportunities before he could no longer voluntarily pursue them. (There was concern he might sabotage.)
I think that’s less about “hacking” and more about modern day devs being overworked by their hot-shit team lead and clueless PMs and creating “temporary” solutions that become permanent in the long run.
This bucket was probably something they set up early in the dev cycle so they could iterate components without needing to implement an auth system first and then got rushed into releasing before it could be fixed. That’s almost always how this stuff happens; whether it’s a core element or a rushed DR test.
modern day devs being overworked
And then there is meningspunktet.dk which had all the time in the world to do whatever they wanted, and even get their hosting paid for by a university. They still leaked everyones email, phone, full legal name and location on day one and only fixed it because I pointed it out.
Thanks for the writeup - I can’t believe they claimed anything about keeping data safe while building the website so poorly…
Shodan lists 100’000s of publicly accessible security cameras.
If I was a hacker, I would just get a job as a night cleaning person at corporate office buildings. And then just help myself to the fucking post-it notes with usernames and passwords on them.
Security by obscurity.
this man ssh’d in on a five-digit port
AI just enables the shit programmers to create a greater volume of shit
My favorite one I’ve seen so far was “AI can take a junior programmer and make them a 10x junior programmer.”
This reminds me of how I showed a friend and her company how to get databases from BLS and it’s basically all just text files with urls. “What API did you call? How did you scrape the data?”
Nah man, it’s just… there. As government data should be. They called it a hack.
ah yes, the forbidden curl hack
Hack has at least two definitions in a computing context.
- A nifty trick or shortcut that is useful. “Check out this hack to increase your productivity.”
- Accessing something you shouldn’t. “They hacked into the database.”
A lot of times they sort of get used in conjunction to describe interesting ways to gain access to secure systems, but using it to describe accessing insecure things you shouldn’t is still a valid usage of the phrase.
That said I definitely wanna see the company face charges for this, this is insane.
Yeah, if I leave my house door wide open for a few weeks and I get robbed, it’s still burglary.
Terrible analogy. A webserver is not at all like a door. It doesn’t block or allow traffic to and from your file system.
A web server is more like a receptionist. It handles requests. “Can I have your basic catalog?” “Certainly, here you go.”
“Can I get this item from your basic catalog?” “Certainly.”
“I don’t see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?” “Absolutely.”
“Can I borrow your stapler?” Sure. “How about a pad of paper?” “Of Course”. “Can I just have the contents of your supply closet?” “Here you go.” “How about your accounting files, can I get those?” “No problem!” “How about your entire customer list?” “Consider it done!”
When you hire a receptionist and specifically tell them to give customers anything they request, that’s entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.
This wasn’t burglary. This was putting up signs that say “come in” and labeling everything in your house with “free” stickers.
In a legal context there’s also the concept of a “reasonable expectation of privacy”. The computer abuse and fraud act defines hacking as accessing data or systems you are not authorized to access.
A better analogy is putting your journal in a public library and getting mad when somone reads it.
I’m not saying what these ass holes did was right, I’m saying that the company weakened their legal position by not protecting the data.
Terrible analogy. You have permission to read books in a library.
Forgetting to lock your door isn’t granting permission to people enter your house, and it doesn’t grant people permission to take your valuables. It may be neglectful to leave your door unlocked, but it doesn’t imply granting permission to enter your house.
Same goes with computer security. Leaving your computer insecure may be neglectful, but it does not imply someone has permission to take your data.
Then how do I know what I am not allowed to access?
In this specific case there was no (formal) indication that the data was out of bounds.
I can’t put 10 pdf files in a web dir and claim 5 are public and 5 are private, then charge you with a crime for viewing them.
You can’t have “unauthorized access” when there’s no authorization at all
If I’m clicking around on a website and find a gallery of images, that’s something I’m supposed to have access to. If I start typing in URLs that aren’t linked anywhere on the site, then I’m accessing stuff the site hasn’t explicitly indicated I have access to. If I’m doing this with the intent of getting data and distributing to others, then yeah that would be illegal.
The law allows for someone to exercise judgement. The people who do this are not so coincidentally called Judges. If the 4chan guys had have been white hat and reported the issue to the site owners, then they’d be fine. But it’s obvious to anyone their intent was to get private information, they poked around to find some private information, and then distributed that private information to others causing a privacy violation. Yes, it was easier to do than it should have been, but it’s obvious they had malicious intent and it’s obvious they were accessing information they weren’t supposed to access.
A crime being really easy to commit doesn’t make it no longer a crime. Many times I’ve seen things that I could easily steal, but I don’t steal things when I have an opportunity to do so because a) stealing is wrong and b) saying “they just left this thing out there in a place anyone could steal it” would not be any kind of legal defense. Simply because you’re presented an opportunity to do a crime doesn’t mean it’s acceptable to do a crime, both legally and morally speaking.
I start typing in URLs that aren’t linked anywhere on the site, then I’m accessing stuff the site hasn’t explicitly indicated I have access to.
Doesn’t work like that. With the policy you describe, anyone who ever sees a “404” error is a criminal.
I don’t have to publish everything I am willing to offer. You are free to ask for something I may or may not have. I get to decide how to respond to your request.
To use your analogy, I can walk up to your door and request a glass of water. You’ve never explicitly offered a glass of water to anyone; I’m still allowed to ask. If you dont want me to have your water, you can say “No” or you can ignore me.
When you go ahead and give me a glass of water, you don’t get to claim I stole it from you. It is not theft to ask.
You have to make some sort of effort to have your web server limit my access, and I have to make some sort of effort to convince your webserver to bypass those restrictions before you can claim I am exceeding my authorization.
A better analogy is putting your journal in a public library and getting mad when someone reads it.
Good analogy indeed. I’d go one step further and add: it’s like promising others you’ll keep their diary safe, then putting it in a public library, to then get mad when someone reads it.
Yeah the internet by design is a public space, and we must be responsible and treat it as such when handling sensative data.
Again, it was very wrong for people to take that data and especially to post like that.
The company also has to do their part and produce at least some kind of barrier to the data.
Even using UUIDs and making sure the data wasn’t query-able would have been something.
The web is a public space by design. The internet? I don’t think you can make that case well. Https and all that. Private infra abounds.
The data was on the public web in this case
Thank you! I feel like I’m taking crazy pills reading people’s reactions to this. And if it was a business instead of your house and it was customer data you weren’t protecting you should still be in trouble too. It’s like people think only one side can be in the wrong in this or that because the data wasn’t secured and in the public that gives them free reign to post it everywhere. I wonder how those people would feel if their addresses were leaked. Afterall, if you’re a homeowner your name is attached to the property and is publicly accessible.
No, this was a data leak. The word “hack” has legal implications and shifts the blame away from the company and onto the individual who discovered the leak.
It can be both. The company can be at fault for not keeping something secure while the people who steal the data are at fault for stealing data. Data leaks and hacks are not mutually exclusive.
I don’t disagree with your main point, but I’m not sure it’s really even “stealing”, as that means to take without permission. In this case, the storage permissions were configured so that the files were publicly available to everyone, so everyone had permission to access them.
Semantics though. It’s still unethical to access that data, even if it’s not technically stealing.
Based on this comment alone, I am 100% sure that you are not a lawyer.
deleted by creator
😂
Peak Vibe Coding results.
while True:
Jesus Christ
You know that’s not the Tea code, but the downloader, right?
Other reports state the Tea backend was Vibe Coded: https://www.ainvest.com/news/tea-app-data-breach-exposes-72-000-users-ai-generated-code-security-lapse-2507/
Sure, it might be, I’m not saying it isn’t. All I’m saying is: the screenshot shows the code someone wrote to download the images. It’s not part of the Tea codebase.
They’re also not using requests very efficiently, so who knows.
There’s nothing wrong with manually breaking a loop.
There’s nothing wrong with eating a banana with a knife and fork, either.
Except living with the shame.
Well these people probably don’t wash their hands so knife fork is the most sanitary way.
Most monkey-esque insult
I remember when a senior developer where i worked was tired of connecting to the servers to check its configuration, so they added a public facing rest endpoint that just dumped the entire active config, including credentials and secrets
That was a smaller slip-up than exposing a database like that (he just forgot that the config contained secrets) but still funny that it happened
That’s not a “senior developer.” That’s a developer that has just been around for too long.
Secrets shouldn’t be in configurations, and developers shouldn’t be mucking around in production, nor with production data.
That’s just a senile developer
Yeah the whole config thing in that project was an eldritch horror of a legacy, too ingrained in both the services and tooling to be modified without massive rewrites
I would have put IP address access restrictions on that at the very least. I may have even done something like that more than once for various tools in the past.
That way it acts completely open to people (or other servers) in the right places and denies all knowledge to anything else.
These people should serve jail time. I’m not kidding.
I’m no lawyer, but this seems like at least grounds for a class action lawsuit, I would think. Like, it seems like privacy and security is implied (however ironic for an app like this) when requiring users to upload their PII.
Also, I assume their privacy policy didn’t mention that they were just gonna publish their users’ PII.
I always get irrationally angry when i see python code using os.path instead of pathlib. What is this, the nineties?
Make a PR
Be the change you want to see in the world.
And what’s with the string addition? Never heard of f-strings or even .format()?
What big advantages does pathlib provide? os.path works just fine
- Everything is in one library which offers consistency for all operations.
- You can use forward slashes on Windows paths, which makes for much better readability.
- You can access all the parts of a pathlib object with attributes like .stem, .suffix or .parent.
- You can easily find the differences between paths with .relative_to()
- You can easily build up complex paths with the / operator (no string additions).
Just off the top of my head.
if you don’t need those, why burden the program with another dependency?
It’s in the standard library, just like os or shutil.
deleted by creator
You could say they “spilled the tea”.
At this point I think the women using it got psyopped
What was the BASE_URL here? I’m guessing that’s like a profile page or something?
So then you still first have to get a URL to each profile? Or is this like a feed URL?
It’s a public firebase bucket
Oh Jesus
🤦♂️
That should be criminally negligent.
Possibly from the decompiled APK. 404media reported that they found the same URL as the posted one in the APK (archive link).
Disabling index and making the names UUID would make the directory inviolable even if the address was publicly available.
Security through obscurity never works.
It’s not security through obscurity in this case. The filenames can’t be obtained or guessed through brute force. At least not with current technology or processing power…
Security through obscurity is when you hide implementation details.
Saying that my suggestion is security through obscurity is the same as telling that ASLR is security through obscurity…
Until the psuedo random UUID generator can be reverse engineered. Makes me think of this video: https://youtu.be/o5IySpAkThg
Anyway, I think we’re on the same wavelength and both agree that the implementation as is isn’t production-ready to say the least ;)
Sounds like a good case for brute forcing the filenames. Just do the proper thing and don’t leave your cloud storage publicly accessible.
While proper security is better, you’re not gonna brute force UUIDs.
As long as you’re not rate limited, you absolutely could.
A UUID v4 has 122 bits of randomness. Do you know how long that would take to brute-force, especially with network limitations?
It taking a long time doesn’t make it an impossibility. The fact that it has a limit of 122 bits, in and of itself, makes the possibility of a bruteforce a mathematical guarantee.
For all practical purposes, it’s impossible.
It’s not, though. And thinking that it is impossible is why DES, for example, was “translatable” by the NSA for decades. Never assume something is impossible just because it’s difficult.
You cannot!
I cannot. But the bruteforce is a mathematical guarantee.
And has nothing to do with my proposition.
Can’t be done.
Bet you could reuse/keep UUIDs for someone/stuff that gets updated and get that new data even if you “shouldn’t”.
It could work in theory but in practice there are always a billion things that go wrong IMO.
Even the best models fine tuned for coding still have training that was based on both good and bad examples of programming from humans. And since it’s not AGI but using probability to generate the code, you’re going to get crap programming logic dependent on how often such things were used and suggested by humans to other humans. Googling for an answer on how to code something pulls up all sorts of answers from many sources, but reading through them, many are terrible. An LLM doesn’t know that, it just knows that humans liked some answers better than others, so GIGO.
Gorilla In Gorilla Out?
Giraffe In Giraffe Out
Gorilla In Giraffe Out
That would be the real trick.
Fantastic for building BaaS apps
Bullshit as a Service?
Bananas as a Service :)
bananas in pyjamas
Sounds like a good time
Almost definitely both were involved.
dev came from marketing. pictures wouldn’t show up with all that security enabled.
