Hacker News Reader

Comment by ZoF | Hacker News Reader

>Every sufficiently popular product does.

I'm not a Slack shill, have never used the product, don't know anyone who works for the company.

But.

Has Facebook ever been hacked to this degree? Has Google ever been hacked to this degree? Has any sufficiently popular social-media/enterprise-knowledge-sharing app been hacked to this degree?

What makes you so completely certain that they will be hacked and that a 'treasure trove' will be available to the supposed hackers?

Seems like unwarranted FUD tbh.

View on HN

> Has Facebook ever been hacked to this degree?

Yes, security researchers have reached FB servers in the past few months.

> Has Google ever been hacked to this degree?

Yes, by Mainland Chinese agents a few years ago.

I know of similarly large networks that are currently owned.

And almost everybody has an IPMI problem, whether they realize it or not yet.

(Silicon Valley engineer here.)

IPMI meaning the protocol for server management [1]? I'm curious on this one.

[1] https://en.wikipedia.org/wiki/Intelligent_Platform_Managemen...

IPMI cards are always-on, and run outside the rest of the server. They receive power even if the server is shut down. These are used for out-of-band management, power on/off, etc. Imagine if someone were to have control of the firmware running on your IPMI cards... they would have physical access to your server (essentially) from a remote location. You often don't control what's running on the IPMI cards or if they call home, etc. What if HP or Dell had sleeper software in your IPMI cards, and when it wakes up, opens a direct connection to your server?

Take for instance Intel's addons to IPMI "Automatic Management Technology".

Let's say you have a server, reachable on a certain network address on a LAN.

I can turn on AMT, I can set up server management answerable at the SAME address. network traffic to and from the machine and network is undisturbed.

I can install bios updates, configure aspects of the machine, all kinds of things, just with AMT. I have read in some cases you can configure the machine this way even if its powered off.

> Has Facebook ever been hacked to this degree?

Instagram could have been: http://exfiltrated.com/research-Instagram-RCE.php.

So your answer is 'nope, but here's a product they bought that could have been hacked'?

Pretty much. At a certain level, companies are the things they buy.

And we don't know how linked instagram and FB are. Is the instagram app signed by facebook? etc.

Did you miss the Snowden leaks? Yes, Google and Facebook have been hacked.

No. I did not miss them.

How does that affect your everyday company, with orders of magnitude less competence/intelligence per capita....?

My question is this; what company that uses Slack has good enough opsec that Slack is the vuln to be exploited.

Please name one company where Slack could even potentially be the easiest point of entry.

The issue with centralization is that you don't have to name one company where Slack is the weak point in the chain: a good exploit might get you access to data from 1000 companies. Then Slack could be a better target even if it's 999 times more secure than the weakest link at each individual company (assuming the attacker doesn't have a very specific, one-track target).

Yeah this is a great point, I agree.

I see your point, but that is detracting from the main point and larger dilemma which is that Slack has all this centralized data.

Easiest point of entry? No. Single point of entry? Yes.

Reply on news.ycombinator.com