Hacker News Reader

Comment by rebuilder | Hacker News Reader

From a reply the poster made in that thread:

"So, we have backups on an encrypted drive, which we can't access (authentication is done via our custom ERP software, which is down as well - in hindsight, a very bad idea). And the backups don't work. We can rebuild the DNS servers from scratch, and the records are probably still safely stored somewhere inone of the 3 different databases our ERP software uses, but we don't have an authentication key or the scripts used to pull the DNS domain / record information from the ERP system anymore. The API's are undocumented, and there's only one key that can access those records."

Elsewhere, they say that two years ago, they found they were unable to restore from backups...

View on HN

> Elsewhere, they say that two years ago, they found they were unable to restore from backups...

So their business actually failed a couple years ago, and they have only noticed this month.

They noticed 2 years ago, and the ship sank below the water line this month.

They were already dead 2 years ago, the body just didn't realize it and kept moving until last Friday...

That isn't the failure of the business; backup failure is a screwup of the IT, which I think is not that uncommon.

But the fact that after this event the management did not get it fixed (and requested that IT demo it, three times, with no failures) is an existential failure.

The technical people noticed, left, and they had to hire new ones who didn't know yet. Now the new ones also know.

Basically Wile E. Coyote running in the air.

I'd say if it was such a house of cards, my best bet is that this security chain is full of holes. Maybe the ERP used a fixed password, which can be guessed/bruteforced.

honestly, "password" would be my first guess.

Oh come now, there are password complexity policies in place in any modern software! Try: password123.

it doesn't sound like modern software. At my current employer (to remain unnamed) when I started there were a bunch of MS-SQL servers with an SA password of <blank> (i.e. no password). It took a long time to fix that because we had hundreds of local installs of the client app that had SA/<blank> in the app config file (yes, they were setup to access as system administrator), so fixing it meant reconfiguring hundreds of local installs. (at the time we didn't have a mechanism for automating it.) We still have "enterprise" software that does no password rules, and would happily allow a blank password.

Oh please, even such a crappy place knows better.

Its Password123. Adding capital letters makes it more secure.

But hackers might be expecting capital letters, so disallowing them from passwords is more secure!

Need capital letters and symbols:

Password@123

Reply on news.ycombinator.com