Hacker News Reader

Comment by _nickwhite | Hacker News Reader

From the article:

"Security is Clearview's top priority," he said in a statement provided to The Daily Beast. "Unfortunately, data breaches are part of life in the 21st century. Our servers were never accessed. We patched the flaw, and continue to work to strengthen our security."

Servers never accessed? Then how was the client list stolen? Was a paper copy stolen from a filing cabinet? I find this posture somewhat arrogant and dismissive. Also, the article is light on technical details- does anyone have info on what flaw was exploited and patched?

View on HN

Could the "intruder" have been Joe from sales who came back the night he was laid off using his secondary keycard, which IT hadn't quite gotten around to deactivating yet, and grabbed his old rolodex?

And how was Joe "patched"

With extreme prejudice.

The only way to patch.

They probably updated his face.

I've been at several places where this happened.

I was at a large web dev company where an employee put in his two week notice, then was able to access several of the companies servers and exfiltrate nearly every app or web site they had built in the last two years.

Rumor had it he was using the code to start a dev company on his own and this was the "seed" code that would help him get up and running much faster. AFAIK nothing ever happened to him legally.

I worked for a hedge fund where a quant dev emailed to his gmail a copy of the source for the quant models. He was sued in federal court 4 hours before he was terminated. Criminal charges came around 2-3 months later, IIRC. Once he realized he was fucked, he tried dumping his hard drives in a river. Yes, police diving squad was involved.

Dumbass didn't realize that all SSL traffic was being MITM'd. I never sent any sensitive over personal email from work, being well aware of the practices (also helps to have friends in compliance).

It's always the dumb ones that get caught?

Doesn't the browser display a warning in the case of SSL MITM?

Not if the browser has been specifically given the cert. It is typical on corporate networks send all HTTP traffic to a router that acts on behalf of the outside world. If your browser (and browsers these days relying on OS installed certs) has a cert validating the router, it will be legitimate: you have a valid cert for the router you're talking to.

The trick is to use a piece of software that doesn't use your system's certs but has it's own built in, like run Linux in a VM and use that browser. That way, you'll see the MitM attack.

Hopefully it's a whistleblower. Shaming specific police departments and causing a local political issue is a good way to prevent its adoption.

I agree -- the language is just so vague, but getting the client list and not accessing the server seems to be either obfuscation or a cloud service was also hacked.

I wonder if the key word is "our" servers. I wonder if they had a weak password on some associated account (accounting software or something).

Reply on news.ycombinator.com