Wherever the truth lies, which in my mind is much closer to Frind's side, an SQL injection attack, in 2011, on an actively developed site, using modern day technology, is pathetic.
I've tried to come up with analogies that explain how people can write systems without actually knowing how to program. Something like, just because I know how to make nachos or pancakes doesn't mean I'm a cook. This is the type of stuff I'm talking about though. You can know about if statements, variables and even fancy classes...you can put it all together and build a system and be hugely popular, but it doesn't mean you are any good at programming.
Pof has to store passwords in plaintext, sine they include it intentionally in a weekly email reminding you to login.. Yes. I know.
At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers. No polish, a bizarre ui, and just general weirdness. This is the kind of shodiness I'd expect.
The system quellhorst describes does not require the user to know the password, or even their own username. They click the link in the email and they are automatically logged in; it's an alternate authentication scheme. If they have lost their password that's a separate issue that should be handled separately but similarly by emailing them a link, again with an 'embedded hash', that allows them to reset their password.
The assumption of course is that they and only they can access the email address specified in their account profile. If that's not the case then this all becomes a bit more problematic.
And it can be significantly better. In a past situation I stored sensitive information using public/private keys. Even if you got complete access to the webservers and database, you still could not decrypt that information. It would only be useful if you had access to the private key, which was much more securely controlled.
They (people who don't actully know how to program) can build a large system on a shoestring budget exactly because they don't know how to build it properly, or how hard it is to. No distractions over those pesky little matters like ACID properties, security, accessibility, etc. etc..
Because those are a major part of what slows programs developed by professional developers.
No distractions, no slowdown, until a security consultant mails you a proposition you can't easily refuse. The hackers Mr Chris Russo alleges were exploiting the hole did it quietly (if at all), for obvious reasons. Nobody knew, nobody cared until now. Several years of good business, right? And free publicity now, isn't it?
To call these people Duct tape programmers because of one SQL injection weakness is somewhat unfair. Writing code isn't hard. Writing code that works is harder. Writing code that's bug free is very hard. Writing code that is not only functionally bug free but non-functionally bug free (including security as a non-functional requirement) is ridiculously and ludicrously hard.
It's only because some frameworks do 90% of the heavy lifting (and parameterised queries for the 5 extra percent that's not covered) that we don't see SQL injection as much as we used to.
This week it was PoF. Previously it's been Twitter, Facebook, even HN. Are the people behind these Duct tape programmers?
I'm going to touch on how hard security can be in my talk at http://www.meetup.com/HNLondon/ - if there are any London-based HN readers that are going, I look forward to seeing you all there.
I find it interesting that my original comment started at -3 and is now +7..and that the "so blame the victim" went to +3 and is now at -1. Not sure why I find it interesting, but dang it'd be nice to see who up/down votes.
Nothing like hearing reports of security issues to make one remember the adage "There but for the grace of God go I." Humility may be in order: substantially none of us are capable of delivering a system without at least one game-over bug in it.
Incidentally, their notification emails routinely contain your password in cleartext as a "reminder". I signed up for an account several years ago but was put off by the incredibly ugly design. Here's an excerpt from an old email from them (note, redacted by me!) This one is from a few months ago:
Thank you for signing up on 10/12/REDACTED 4:08:52 PM.
Remember your password is REDACTED.
The most recent one from had an empty string as my password, as in "Remember your password is ."
That is standard behavior for many web sites whose purpose includes no important personal information. vBulletin and some other forum engines do that by default. These site owners figure, probably rightfully so, that the support burden for a forgotten password exceeds the expected value of some black hat actually intercepting the plaintext email (low) times the meaningful impact of any ensuing activity (also low). The chief risk is in compromising a password that this user also uses for applications of high security impact, but it is not the responsibility of this particular site owner to protect a user from generally dumb behavior.
More generally: security best practice is not always about enforcing as tightly as you possibly can. Security has real costs and it's a cost-benefit tradeoff against many other factors.
That may be their assumption (clearly is, given the evidence), but I think it's a pretty poor one and it's certainly off-putting as a potential user.
A dating site contains, practically by definition, a fair bit of personal information. It's not online banking, but there's a lot of ugly stuff that an attacker could do if they could break into a large number of user accounts, and particularly if they could de-anonymize those accounts.
POF was pretty clearly sacrificing security -- which in this context means the potential privacy of their users -- in order to get more engagement and build userbase. Bluntly: they were taking risks with their users' data in order to build their business.
That's not terribly cool in my book, even though I can see why they might have made the decision. The fact that it's understandable doesn't mean that it's right.
They do have personal information, your password for that site and your email address. Lots of people reuse passwords, and that might be their email password. Once you have email & password, you have access to 90% of their online identities.
The victims are the users who mostly lack the technical fortitude to realize the perils of using a single user identifier/password combination across many different sites. The amount of identity theft that could occur by dint of PlentyOfFish's absolute carelessness renders them just as complicit in wrongdoing as the attackers who shed light on the problem. To call POF a 'victim' is absolutely wrong.
They're not the victim - they're guiltier than anyone who grabs their customer data.
When you provide an online service that gathers consumer information - particularly sensitive consumer information (such as that which you might find on, say, a dating site), it's your responsibility to secure it. If you get hacked, it's your fuck-up, your responsibility, your culpability.
And no, that's not my opinion, it's objective fact - read, for instance, about PCI DSS, and the associated very steep penalties for information leakage.
Frankly, Marcus does not sound like he is very computer Saavy. He sounds like one of these people who knows how to write some PHP scripts, but does not really understand the details of what goes on behind it - so assumes that what this guy is doing is some terribly complicated hack.
I think the argentine guy probably searched the website for vulnerabilities as a way to get business. He found one and contacted Marcus. Marcus then freaked out and panicked, leading to this.
Saying 'ASP.NET is VB' is sort of like saying "General Motors is a Buick Skylark." It just doesn't make any sense. ASP.NET is a framework for developing web applications. You can use any number of supported languages - C#, VB.NET, J#, Ruby, Python, F#, etc. I can only assume that he conflated the late 90s scripting combo of ASP/VBscript with ASP.NET.
It's obviously possible to write terrible code in any language, with the aid of any framework. It sounds like POF did just that.
Rails is just Ruby. It's not the most complicated language to learn, and you don't need to know much about computers to START developing in ruby or Rails.
See? This has nothing to do with platforms, and everything to do with realizing your strengths and weaknesses, and improving your platform when hundreds, thousands, or even millions of users trust you with their data. You can't just chalk this up to POF being on a platform you think is somehow inferior to your platform of choice.
Not only does POF store it in plaintext but they email it to you every few days when they send you their "new matches" email. So basically they're sending probably about 1/4 of their member base's passwords in the clear over the internet every day through those emails.
In some ways it's no wonder POF was able to bootstrap and run this amazingly large system all written by one guy with limited hardware. Dunno what their stats (or headcount) are now, but years ago POF was heralded as some genius site because it was all put together by one guy and running on a few load balanced servers.
I'm not saying it takes multiple people to make something secure, but if one person either doesn't have the experience or knowledge to make something secure, and there's only that one person, there's no one else to even determine there's a problem.
I know how and why you should store hashed passwords, but surely you'd have to store credit card numbers in plain text? If you store a hashed credit card number, you'll be unable to charge it again? How do you use a hashed credit card number?
Ideally, you don't store credit card numbers at all. If you need to do recurring billing, there are platforms that will do it for you, otherwise, process the transaction and remove the number from your system. Storing this kind of info securely and in PCI compliance is not trivial, and takes engineering resources that are better used on something that will distinguish your product from competition.
I'm not surprised PlentyOfFish was hacked in the least. I signed up at one point and the password entry form wasn't even obscured. That was my first red flag. So I made sure to use a throwaway password.
But it got worse. Every few days, POF started sending me newsletters with my password in plaintext! "in case you forgot, your password is:...." in addition to whatever else the newetter said. So I knew they were storing passwords in plaintext.
Couple those things with the complete unusability of the site…well I deleted my account (which is unsurprisingly difficult to do as well).
Yeah its sounds like Frind in his panic over the active exploitation of the vulnerabilities by other hackers felt like Russo was trying to blackmail him because of his lack of command of the English language.
He was probably trying to communicate that he was looking for a consulting position after finding the exploit trying to be helpful
I wonder where the discussion of "murderer" or "Russian mafia" first came up, seems totally unrelated to the incidence and random for anybody to bring it up first. Could be some kind of pronunciation miscommunication like "member" -> "murderer"
Am I reading this right? Are both sides of this story intimating that the security guys found a vulnerability in the site, published it, and then pitched them a consulting gig? Go live with something or not, pitch a gig or not, but I'm not sure you can have it both ways without looking skeezy.
hmmm this really looks like a complicated matter to judge with the available information. Really there are several plausible scenarios where POF or Chris could be at fault. The information available to the public is not enough to make an informed judgement. Everything else is pure speculation or pure DH0 (as per Paul Graham's disagreement hierarchy).
For what we see now, it is clear that POF people were scared shitless from the report (obviously) and tried to limit the damage and gain time by manipulating Chris whom they thought has downloaded all their users data and is extorting them against the disclosure of this data. I think anyone in their shoes would think the same (at least primarily).
Now wether Chris really intended to extort them or not is another matter we cant judge from what we are seeing. He does seem like a nice guys from his emails, and kind of excited about the "opportunity" but really that is not enough. Nice people sound nice... so do most criminals.
One more thing that is unclear ! Was POF actually hacked (in the sense that data was leaked) or was it just that a vulnerability got exposed? I think this will tell us a lot as well about the real motivation of the "hacker".
> By the nightfall of Sunday 30, Mr. Markus Frind sent me an email accussing us to steal his whole user database without a single proof, based on supposed information that "20 employees of him told him.
This fellow is either a fool or a terrible liar. If he didn't take the data then he would have said "I didn't steal the data". He instead accuses Markus of a lack of proof.
I agree with you. Defamation / libel laws are far more strict in Canada than in the US. This is clearly going to interfere with Chris Russo's ability to earn a living as a security researcher. I have a feeling he is going to get paid to go away at some point.
So then you look at whose word seems more reliable. It would be very weird if all of Markus' employees plus one of his competitors made this crap up. It would be much less so if Russo were trying to avoid the repercussions of his actions.
1. The site makes $10 million/year.
2. He has three employees, all customer service. He does everything else.
3. He pays himself $5 million/year.
This quote is particularly telling: "At other sites, when one thing goes slightly wrong, the reaction is to buy more servers or hire a Ph.D.," he says. "It's almost unbelievable -- it's like people are trying to justify their jobs by spending money. This isn't rocket science."
I don't read anything about an extortion attempt (in this account), what am I missing?
I guess it is normal for a security firm to hope to gain some business by exposing security flaws (hey, we found a hole in your site, hire us to fix it). As this incident shows, it is not an easy business to be in...
I didn't read anything about him posting the stolen data. I think he specifically wrote that he didn't even steal any data.
I don't know whose account is true, but I don't think it is reasonable to threaten somebody who approaches you with information about a security hole, just in case that somebody has evil intentions. In general it seems reasonable in human interactions to not issue death threats upon the first encounter.
Hi, nice to meet you. Btw, try anything funny on me, and I'll set the Russian mob on you.
How to explain? Yes, strictly logically speaking it is "OK" (no funny actions, no Russion mob). But psychologically I don't think it would be a good approach to human interaction. It establishes an atmosphere of distrust right from the start. You approach somebody and say "you might be a criminal".
Or imagine you meet somebody on a party and he says "Hi, my name is soandso. By the way, I carry a gun". How would that make you feel?
No idea, really. It sounds as if Russo denies having any data, in which case I struggle coming up with a good reason for POF to issue the warning. But ultimately, I really only know what is written in the two articles. I guess time will tell.
Unfortunately on the web it is hard to establish the chronological order of things.
I.e. that data could have already been available to you if you paid the right price since 2 months ago.
Correlation is not causation, and we of all people should realize that.
I'm not defending Chris, it's just that Mark sounded like a jerk in that blog post and gave a more complicated explanation of the events than Chris; which means there's a good chance Mark got really defensive and blamed the person trying to help.