Slashdot Mirror
Memo Details Gawker Security Strategy
Trailrunner7 writes "After a hack of systems belonging to online publishing giant Gawker Media that yielded more than one million passwords, the online media company's chief technology officer has announced new defense strategies aimed at placating their users and preventing further humiliating data breaches. Thomas Plunkett issued a company-wide memo on Friday that lays out the new security measures and suggests the company overlooked security concerns in the rush to develop new features."
I read it, but nowhere it mentions not being douchebags. Not gonna work.
I've been dying to know whether the no-name CTO of some joke of a blog franchise has had any thoughts since his incompetence was made public.
I, for one, will be eagerly perusing his recommendations to see if there's anything I've missed.
gaah, s/Media/Security/
To put a witty saying into 120 characters, jst rmv ll th vwls.
Norton 2011.
We can all sleep soundly now.
Yup. Since we'll be unable to use our computers ...
Quartz Extreme and Core Image. Are there any other real reasons to spend all that money on generic hardware?
Their whole strategy so far has been to blame the users: "Its not Gawkers fault your passwords are so weak."
...no one has heard of!
Seriously, was Gawker on anyone /.ers' radar before this news broke? Or am I the only one who never leaves the cave?
You don't say!
Our development efforts have been focused on new product while committing relatively little time to reviewing past work.
Software engineers, stop me if you've heard this one: "Don't worry about bugs or security holes! Just keep shoveling features in and ship! Audits? Code reviews?? Don't have time--gotta ship ship ship!"
In recent weeks, intruders were able to gain access to our web servers by exploiting a vulnerability in our source code, allowing them to gain access to user data and passwords.
They are still blaming bugs in code. Pretending to be mistakes made by low level programming flunkies. The problem was using an unsalted hash that allowed them to do a simple dictionary attack. Further even the top guys were using very simple passwords. Used the same password for multiple accounts. Continued to leave other accounts and usernames unlocked even after knowing one account using that password has been compromised.
No. The real problem was that the managers and the top dogs drawing top salaries were clueless idiots. Pretending that it was some kind of stupid bug left in code by some low level programmer shows how disconnected these bozos are from reality.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"The tech team should have been better prepared, committed more time to perform thorough audits, and grown our team’s technical expertise to meet our specific business needs."
We have the exact same problem with an internet-connected application where I work - plaintext passwords. All of the developers have pointed out that it's a problem to business, but they think it's a feature because it allows them to read passwords back to customers who've lost them, or send them a welcome e-mail with their password. No matter how much we whinge and bitch that it's wrong and you can send users new passwords with hashed or encrypted password systems they won't budge and refuse to spend dev time or money fixing it.
"Business Needs" means adding more features, not fixing broken implementations.
Is part of the strategy to force users to change their password every month so they can write it down or reuse it and make it just secure enough to pass validation? This kind of crap is happening at work and forces me to use crappy passwords! Thanks security consultants!
I'm a wanker.... and loving it!
Norton 2011.
We can all sleep soundly now.
Yup. Since we'll be unable to use our computers ...
Nor the malware... scorched earth strategy... effective protection by starving the medium of any "nutrients" (CPU cycles, IO and RAM). A better scheme... combine it with "fruit poisoning" (e.g. BSOD at any attempt to start any process). Hang on, that's Microsoft's job though.
Questions raise, answers kill. Raise questions to stay alive.
Oddly enough, I don't want comments to be tied to either my Google or Facebook account. And I really don't think I'm in the minority.
Taxation is legalized theft, no more, no less.
secure data within their network. Every solution he proposed uses and outside resource. Move away from storing all data? Use outside authentication? One time accounts? (this one really got me)
Are they that bad at the basics of security? Someone please tell me this is not the norm.
from the memo:
Disposable accounts are similar to the service a pre-paid phone offers to drug dealers (a disposable, untraceable communication device).
I wonder how did he come across this service? I mean, even if you think doing drugs is ok it's a questionable example to use in a corporate memo.
I never heard of Gawker, but I received email from them telling me that my account was compromised. I just went to their site, entered my email and asked for a password reset. I got a reply with a username I don't recognize. When I logged in with the id and password, I got an error message that said I had never "verified" my account.
I'd say they have some serious problems that go beyond the password hack.
The premise of the site seems pretty sketchy.
They really screwed the pooch. I'll never go to their sites again, this is basic info-sec that should have been simple and unobtrusive. They failed.
gigantino.tv - Heavy but weighs nothing.
It turns out that Gawker has a "Chief Technology Officer". However, if you read this article from Forbes, it makes you wonder what this guy actually did, other than show up and collect a paycheck.
poor encryption==stored in the clear
Wealth is the gift that keeps on giving.
Here is a copy of the memo that was sent out highlighting the new security protocols:
To: All Employees
New Security Protocols
1) Do not write down your passwords on post-it notes and then attach them to your monitor.
Thank you for your cooperation.
I may be wrong, but it appears that when you try to delete your account, they don't actually get rid of the information, they just make it inaccessible to you. I guess they'd prefer not to offend all the advertisers they whored your personal information out to.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Actually, they weren't stored encrypted either - a hash to the password was stored.
The problem with using the hash method and length used (the old default for Unix, Unix-like systems and Apache) is that it's vulnerable against rainbow tables -- someone with LOTS of disk space and 4096 rainbow table databases (one for each possible salt) could quickly find a usable password for every hash.
But against dictionary attacks, permutations of known data, and brute force, it doesn't matter how strong the hash is. And that's what the crackers used.
That wouldn't have helped here, my understanding is that the password were hashed but not salted. So once the hackers had downloaded the hashed password all they had to do was compare the resulting hash strings with a database with precompiled password hashes (Lookup Rainbow Tables).
For example, using MD5 hashing. password always comes out as 5f4dcc3b5aa765d61d8327deb882cf99 so if you ever see that string in a password file, you know the user password = password.
The way around this is to salt the hash with a second string, known only by the website authentication function so that the password has become MD5(salt value + password) rather than just MD5(password). This creates unique strings which are much longer than can feasibly attacked by a Rainbow Table.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.