When Myspace Was King, Employees Abused a Tool Called ‘Overlord’ to Spy on Users | Hacker News Reader

When Myspace Was King, Employees Abused a Tool Called ‘Overlord’ to Spy on Users

vice.com

181 pointsjmsflknr87 comments

This is all too common. I teach "Security 101" onboarding to new hires at my company and this is one of my slides:

- Google Engineer Stalked Teens, Spied on Chats: http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

- Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-al...

- Uber Employees Allegedly Use Data to Stalk Exes, Celebs: http://www.newser.com/story/235409/lawsuit-uber-employees-us...

- Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employ...

- Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees...

I suspect the vast majority of these abuse cases never make it to the public.

Maybe you should add the Case in the UK where some one bribed some BT call centre employee to look up address of the parents of some one in witness protection.

Parents where then killed by a hitman - bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.

> During the investigation of the Stirland murders, police found that corrupt BT workers had given out details of where the couple had moved. As a direct result, Gunn was able to track them down.

Of note, not witness protection:

> The couple declined to join a witness protection programme and instead decided to leave their Nottingham council estate.

> The pair, originally from Nottingham, were forced into hiding when Mrs Stirland's son, Michael O'Brien, murdered a man connected to a criminal gang in 2003. [the son was in jail: https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickba...]

https://www.theguardian.com/uk/2008/feb/22/ukcrime1

> bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.

At least two of the employees got a suspended sentence:

> Kelly and Pickering later admitted computer misuse and were given suspended jail sentences. Both were sacked by BT.

http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.s...

I can't find what happened to the first - the one who had direct contact with the gang.

Ah it might have been the main one - the reason I think the UK has such weak is is a large number of NUJ members would be in jail

these are all social media companies, but what about similar abuses or security holes as such for those of us who are thinking about putting our small business data online to cloud drives/storage lockers. I.e. the google suite drive, dropbox business, backblaze backups of the world?

The problem tends to be user interfaces built for one purpose and used for another, whether it's originally by law enforcement (due to search warrants) or by support.

With something like Google Drive or Dropbox, that's where I'd look.

You can say these things shouldn't exist, but then you have no support. How do you help grandpa when he has trouble with his account if you can't do anything?

The end-to-end encrypted, no-support you're-on-your-own future isn't well distributed yet, and as long as there are people who can barely use a computer without a lot of hand-holding, it probably never will be. Someone has to be helping the users. They must trust someone. Such trust can be abused.

This privacy issue is no fun, but it pales in comparison to the horrors perpetrated by the pharma industry and oil companies like this... https://www.washingtonpost.com/climate-environment/2019/06/2...

I use Cryptomator to protect my documents within my Dropbox.

https://support.google.com/a/answer/9230979?hl=en may be relevant (I work in cloud, but am not familiar with that tooling, other than knowing of it's existence). AWS might provide something similar, but I don't know what it is.

Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs.

Do you think that when Google serves your data up to the secret police that shows up in audit logs?

It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google?

Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.

Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?

Do you imagine this to be an impossibility? It would only take one.

I imagine that nobody has ever been deliberately given this power (why would it need to exist?), and that the auditing implementation is robust against most combinations of credentials that most engineers could put together. The number of people that could pull it off in theory is probably very small, the number that could do it in practice without leaving any trace is probably 0.

If they have legitimate access to the underlying infrastructure, they can just run cat on the physical files.

Even if you manage to end up as root in a shell on the host OS, the data you're interested in is going to be encrypted at rest, probably with keys that aren't on the same machine, and your access to the machine is going to have been logged somewhere. Access to the underlying infrastructure for the data persistence layer is also presumably granted to a tiny fraction of engineers. Only the relevant teams would need it, and even then not all of them.

I think the problem has more to do with human nature. I've read statistics that 1 in 25 people have strong sociopathic tendencies; the percentage could arguably be higher for high-ranking jobs in media companies.

There will always be people who want to make use of the power they hold for personal gain. I'd imagine this is especially true if they're unable to empathise / audit their own behavior due to their personality type.

No amount of process improvement can stop this type of exploitation as far as I can imagine. If the platform is built, we should probably accept that it either has—or will—be exploited .. or put measures in place to stop that kind of power existing in the first place.

Only 2/5 of these seem to fit the "social media" category. What they all seem to have in common relevant to this thread is excessive data harvesting from their consumers.

I would say use a service you trust, and encrypt all sensitive data anyway.

I know a student programmer at the university data center that got caught sniffing through the network logs of other students.

Student: bad, corporation/government: business as usual.

Myspace had alot of issues when it came to security. At one point I was discovering multiple exploits every week that gave me access to any account I wanted. Most were patched up in a few days, using some temp workaround that would end up creating a new hole to explore lol, it was the wild west for me. Now I never used it to pull sensitive data or any type of illegal activities such as fraud etc..BUT I may have had quite a few sites that suddenly had millions of active users browsing them. ;] Im sure if I hopped on some of my old machines, I could post some interesting code from those days...

> Myspace had alot of issues when it came to security.

Obligatory: "The MySpace Worm" https://samy.pl/myspace/

Back in Web 1.0 (1999 or so) I worked for what was then a large Social Network. There was no security. Any engineer could look at anything.

When the thing went belly-up (it was acquired and then ended) the servers were scrapped without even being wiped. Someone probably bought them at WeirdStuff.

I'm trying to think what was around back then that could be described as a social network. Geocities?

One fact about it: It was the only one that worked well on a WebTV.

It turns out we had a lot of people in prisons using it, because some prisons had gotten WebTVs not knowing that the inmates could use it.

The Management didn't care, as long as there were pageviews. (Which I was directed to inflate by our CFO.)

Blackplanet.com perhaps? If not the original social network, then certainly one of the first.

AIM, MSN, Tripod, and others could have been considered social networks in that era.

If you found this article or the idea interesting, be sure to check out one of the latest episodes [1] of Black Mirror.

[1] https://www.imdb.com/title/tt8758202/?ref_=ttep_ep2

Unfortunately I did not find that episode of Black Mirror interesting.

I found this entire season to be sophomoric. A lot of the previous episodes were dense in subject matter that's not too often explored; the subject matter in this season has all been going on for the past decade or two and you would have to have not been paying any attention to the news while maintaining absolutely no interest in transgender topics for this to be meaningful.

!!!!!! SPOILERS FOLLOW !!!!!!

Episode 1 - "a guy explores his gender in a video game and finds that he enjoys a gender different than the one he's playing in real life. His friend finds that he enjoys his friend in that gender despite not being gay."

Big deal? People have been doing this in real life without the aid of video games for decades now.

Episode 2 - "a guy gets addicted to social media and (potentially) kills his significant other because he was paying attention to his social media while driving. He coerces the CEO of said social media into talking to him, CEO pays him some lip service after "triangulating" who this guy is through minimal information. Guy dies. Life goes on."

I mean what's surprising here? Who hasn't looked up a blind date with Google to figure out whether or not they're a psycho? Laymen already have this information easily accessible to them. I've done a background check on myself, out of curiosity, and I found my address, phone number and email by just looking up the city I'm from and my name. Social media profiles are even easier to find.

Or was it the fact that the CEO paid convincing lip service to some guy and then doesn't follow through with it?

Or was it that life goes on after you die? Big whoop?

Episode 3 - I mean why bother, it was just another feel good episode on a topic black mirror already explored.

I think the problem is that people expect every episode to be San Juniper now. Does nobody remember the first episode of season 1? The show has come a long way.

I've only seen Episode 1 of season 5, and it explored the gender bender aspect of a fully-simulated virtual reality. Solid concept, but it probably could have been more relevant to pop-culture if they had incorporated catfishing as well, rather than a best friends love-triangle or whatever. Would have cinched it too if there was a Pina Colada song ending, which they set themselves up for.

season 1 ep 1 was the episode where the PM porks the pig. People remember it because it became shockingly relevant.

IMO seasons 1 and 2 were the best. Seasons 1 and 2 gave us things like the Waldo incident, which seemed to predict the rising tide of populism and data driven politics. They gave us white bear which is a brilliantly deep critique on crime and punishment in technologically advanced societies.

The worst episodes can all be summed up as "the bees". The bees episode didn't have any deep or interesting point about micro-drones. It was just bad guy does terror thing and good guy hunts him (with some fletching about social media thrown on top). Same thing with Crocodile. The idea of a memory reading device and the issues of surveillance and privacy are interesting, but that episode completely skirted giving us anything to ponder in favor of a plain old cops and killers story that may as well be a CSI rerun.

black mirror has two problems.

1. Netflix. 2. Charlie needs a technologist.

Before the Netflix acquisition the ending was usually dark or uncomfortable. Each episode was like we had wished for some technology on a monkey's paw and got it. After Netflix came along it seemed like a rule that half the episodes had to end at least bitter sweet. I think they might be executive meddling with the formula. Perhaps Charlie could do a "screw you" episode about how a data driven TV production company leads to a world of incredibly bland art.

Charlie Brooker is a journalist / comedian. After visiting the well of "social media kind of sucks" 3 or 4 times, he's clearly running out of ideas. He needs to work with someone more up to date on the trends.

Thoroughly agree, though don't forget White Christmas - the special was great too!

Netflix brought larger budgets, no impact any more and 15 minutes extra to explain points over, and over, and over. Like Nosedive. The extra 15 minutes was entirely devoted to "have interaction, rate it". Two or three explanations of this difficult concept would have been plenty. San Junipero was more Disney than Black Mirror.

Even the better Netflix episodes feel like they are pulling their punches.

I don't know why you were downvoted. It's perfectly possible to find a concept interesting but some show's execution upon it uninteresting.

Sometimes it can help to give an explanation instead of just making an opinionated statement. Saying you found it uninteresting doesn't really contribute much to a conversation.

Good point, although there was value enough in the comment. That is, one can extrapolate that just because the episode was related to the topic, that doesn't make it intrinsically interesting in and of itself — as might be implied by the original comment and link.

What's the name of the Facebook equivalent?

It was called ‘super’ and it was most famously abused by an intern that blabbed to the press about using it. They then added more restrictions and auditing to ‘super’ which was supposed to be mostly for investigations and user operations teams to help users with their own account issues. Also at that time Zuck’s own account was always super so...

Auditing sure, but almost any Facebook software engineer has permission to still take super user actions. The ability to abuse is still there, it's just a question if they actively audit well enough to catch the abuse.

From an anonymous source, I found out it's automatic termination if you're using super mode unauthorized. Would love to get one more anonymous or non-anon source to verify.

I know of someone who had to go in front of an internal audit committee of some sort due to unauthorized access. He did it during a demo, not really thinking it through. They were convinced it was unintentional, and he got to keep his job in the end. He was telling me it was definitely considered a termination-worthy thing, and was legit worried about losing his job.

Spent time at FB, can confirm that you have to go through a few modals, your manager is notified via email, and the penalties are quite harsh. This was back in 2014

Really? Any intern could just request access and get it, and maybe get caught abusing the access?

Not sure if you can share more, but this seems way to easy and auditing is, well, to late.

When I was at FB you had to go through two confirmation modals and at least from my team (biz intelligence on ads side) it said an email would be sent to my manager if I proceeded.

I never worked in a role that required me to go further, but the penalty of losing my job deterred me just fine.

At a real company you have to write up something saying what you are planning on doing before taking any action, eg change control. I don't think that type of thing fits into the "move fast and break things" culture though.

"but almost any Facebook software engineer has permission to still take super user actions"

If this is true, I find it shocking in light of all of the recent allegations especially.

What reasons do companies like facebook have to actually make these tools safe? As long as it has the veneer of only being used for the right things, they don't really have an incentive.

No-one is going to check up on Zuck. So as long as he doesn't leak it himself, no-one is really going to know if he checks your nudes. I don't even really blame him. It's just human nature to be curious.

It’s important because locks ultimately keep good people honest.

A system where access control policy is capricious is a system that is fundamentally broken. I have been in jobs where I had the authority to hire and fire people, and make significant decisions that impact important things and spend lots of money. But guess what? I don’t have access to employee applications with PII. I don’t have access to the accounts for the business. Don’t know about employee healthcare or retirement.

If I tried to use my position to get access to that data, I would expect that issue to be escalated, even if I were the CEO. A data driven company with casual disrespect of basic principles is a problem waiting to happen.

I'm not disagreeing that it's important. I'm asking, in a corporate environment driven by capitalism and the ultimate pursuit of generating revenue/shareholder value. Why would a company care?

I know that I've seen situations where departments critical to this access control policy system were chronically understaffed, because they are cost centers. They don't generate value. In the same way I've heard security and access control dissuaded from software development, because "we just need to get this out".

What all of these situations end up with is "performative" access control. You have to act as though you need the data, but beyond that it's a free for all. This lets the company pretend like it's fulfilling it's obligations, while saving money.

Easy. Risk.

Where does the magical privilege end? Who is responsible when the all-seeing CEO is compromised personally and data or cash is exfiltrated?

A common fraud committed against public institutions like school districts or small businesses is compromise of a business manager’s account, which allows an attacker to empty the checking account.

In a public company, that sort of fraud for finance is mostly controlled by regulatory compliance. But as we know, information or data has value. Value as a commodity, value as a competitive advantage, etc.

This.

That

The other

Abuse scandals erode user trust in the product which is bad because growth over everything seems to be the name of the game. Worse for publicly traded companies as it could impact dollars. Not so much anymore as the news cycles are so short that the impact on the stock only lasts a couple days before bots buy up the dip.

“Perception is reality” was an internal slogan at the time. So if users (at the time) believed it was evil maybe they leave or maybe a possible new users chooses not to sign up.

The other thing too is employees abusing such a tool with other employees. When you use super you assume the user id of the user of your choice. That’s pretty dangerous and there are way better ways of helping a user fix an account issue than signing in as them. If employees can’t trust each other not to snoop then how can users trust the company not to snoop? It had to be addressed internally at the time of the intern that was creeping on someone and that’s when things started getting locked down and more auditing applied. But I think it boils down to PR. If you run a company online trust is everything. I’m sure this crowd understands that nothing online is secure but Facebook was built for the masses and they need to have that blind trust that they’re personal lives are private.

> “Perception is reality” was an internal slogan at the time.

I don't think this line really conveys the weight of the slogan. That slogan is applicable in so many fields and pretty much all the time. Even just in small social circles, not just politics, whether corporate or government.

> No-one is going to check up on Zuck.

Except an engineer with a grudge, or a moral objection. Or an investigative reporter. Or a hacker.

Phish Zuck successfully and you have the keys to the castle.

Not sure about FB, but Uber's was called God View - https://www.theguardian.com/technology/2016/dec/13/uber-empl...

Facebook

Google scares me much more, for me, my data on Facebook is nothing compared to the amount of my personal data on Gmail and Docs. Having worked at Google, a regular cog in the wheel engineer getting access to sensitive user data is carefully monitored and logged for appropriate usage, but I also strongly suspect that if a powerful player like Schmidt/Brin wanted to get the dirt on private user data they would have no problem, because there is a strong culture of secrecy that labels any sort of whisteblowing as "leaking", considered the most cardinal of sins by most Googlers.

Was this meant to be a reply to another comment? How does this answer the question your parent comment asked?

This might help you:

https://en.wikipedia.org/wiki/Rhetorical_question

If Facebook has such a tool, it's certainly not public knowledge. The parent comment was clearly meant to make a point that Facebook could have such a tool, even if it's not public knowledge. I was expanding on that point that Google could as well. Hope that helps.

It definitely scares me that someone like Schmidt would have access to that personal data. Brin, Page - meh but I would still rather them not.

I agree that Schmidt is a good example of someone who's already demonstrated willingness to use his power to bully those he perceives as political opponents, but the principle that access to such an incredibly dangerous power exists, and that existing regulation can barely if at all limit it, is really the problem. Forget any specific individual and ask yourself if we can trust every high level Alphabet exec who could pull some strings and make sure it doesn't get "leaked" that those strings were pulled in decades to come.

I worked at a small company that had a kinda internal business social network tool where the devs and customer service people could do this. We called it superadmin. Eventually we anonymized the actual posts and employee names but for a while we could literally see everything. Technically afterward we still could if we had prod db rights and just connected straight to that.

Not surprising.

This is the number one reason why we should be wary of producing these platforms.

Security and privacy can only be looked after—in the way most people want—if the potential for human interest is _completely_ removed.

Those young employees had so much power that they acted like they were the "Kings of MySpace". It's no surprise shenanigans ensued. It reminds me of some other youngsters back then who called themselves "The Kings of MySpace":

https://www.youtube.com/watch?v=2N1lIl3pGac

Literally every company has a tool like this. It’s more a question on what is a company doing to define and enforce justifiable usage among employees.

At a well known “unicorn” I worked at a few years ago someone was reportedly fired for looking up celebrity accounts.

I’ve heard rumors from friends and family that people get fired at hospitals for looking up celebrities all the time.

Facebook, Myspace, Snapchat... is it that hard to, you know, not do asshole things when you sign on in a position of responsibility working for these companies?

I think the potential for abuse would be extremely tempting for anybody and also make those positions very attractive to the wrong kind of person. In a more honest world, these companies would be bending over backwards to prove that they can be trusted, instead we're asked to trust them largely on faith alone.

Everyone thinks they’re justified doing evil. That’s just humanity.

I don’t trust myself with access, nobody should. I have to get my software signed by a different department to deploy it.

(Yeah, sure, I do have disaster recovery access but unless the org is collapsing, it gets rotated out of service and audited.)

As much as we would love that to happen in a fair and just world, human beings are flawed creatures and majority would abuse their position of power when given so. Time and time again, this has been proved to be true.

“Let them view users’ passwords”... sigh

Isn't this expected to happen? Especially back then... It might not fly in this day and age I guess.

It is perfectly normal and easier and prevalent in this day and age

https://www.fullstory.com/

One javascript import statement and you are recording your users entire session activity

There are whole startups offering this service to other startups

We're not talking about the 1300's. If it's unethical now, it was unethical then.

When used benevolently this is an important tool for seed stage startups to gauge product market fit. I used to silently join user interactions in real time and observe them. really helped improve the product quickly

This does not sound ethical at all and seems to reinforce the point that we should default to being suspicious of any company that holds our data.

Ethical: no

Useful: yes

Illegal: anywhere in the free world.

Did you tell the users that you're observing them?

“It’s OK when I do it”?

Never mentioned in the article, but I'd wager that "overlord" is a reference to the StarCraft unit.

I am a big fan of StarCraft, but I am sure that Overlord was just used for it's dictionary definition in this case.

I suppose it would depend on the program's primary purpose. If it was the equivalent of "God mode" and the spying power was just one of many abilities, then yes, the dictionary definition of "overlord" would make sense.

If the explicit purpose was spying on users, however, the StarCraft unit reference seemed more apt because the Overlord unit is often used in early game to do recon, often before the other player has had a chance to build anti-air defenses, such that the Zerg player can "spy" on the other bases without their being able to do anything about it.

Reply on news.ycombinator.com