Are Facebook, Yahoo, Google, etc. hackable?

Question

Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain.

Since I know a little bit about computers, people automatically assume I know how to have, and I have had a few requests to "retrieve" some data for people. I tell them no, for four reasons usually 1, it's illegal, 2, for any method I could easily think of, I need access to their PC (keyloggers, etc), 3, I have no idea how to phish emails (thanks to my current Enlgish project, I am learning though), and 4, for what I would actually consider hacking, I have no idea how to do this.

By the fourth reason, I am not talking aboaut trying to guess security questions, I mean cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store passwords. From what I read a little bit ago, sites such as these with massive databases don't story every thing in one place, which is good for two reasons in my opinion. A) when millions of people are accessing these databases, it helps to spread out the load, and doesn't bottleneck (I think that is a correct term) the host of the database, and B) this provides a step of security so that if one database is compromised, not every one is, or it makes it more difficult to gather all of the data at the same time.

After Googling 'how to hack into facebook accounts', (out of curiosity), I didn't get any such thing as 'database cracking/hacking', or anything similar, which is what I expected. I only saw things such as keyloggers. Why, though? I am sure that this is possible (even if highly impractical), and that someone somewhere would benefit from something like this (a reference to Palin's cracked Gmail account.. I haven't looked into that, but I assume it was a keylogger or something). I know that these major companies have the money to sue anyone to death who did anything like this, but why hasn't it been done by a hacker yet? (If it has and I didn't realize it, I apologize). Visa and Mastercard are being cracked in to, but why not companies such as Facebook?

In the end, what makes Facebook not hackable? In reality it is, because nothing is ever 100% secure. But why hasn't this been done yet? I am sure some people could find this very profitable, so it will probably happen one day. Why hasn't this already happened, though? What kind of security measures are these companies taking to prvent things like this?

Answer 1

My answer might be a little less Paranoid Parrot than ThinkerThinker's, although I have to agree on some points. These companies invest a lot in security, they also have a lot of security installed. It would be quite embarrassing if anyone could just walk up to them and hack into their database. So the reason you don't find anything about in on google is either:

• It's very secure and near to impossible (nothing is impossible, but it's not something you do with a simple howto guide)
• Even if it happened, why would Facebook even publish it? It's bad publicity.

Spreading a keylogger and just waiting for it to return useful information is easier than trying to hack a facebook database. Plus it generates more passwords for more platforms (paypal,hotmail,gmail,tumblr,...) for one person.

There will always people be trying to get into your system, they use automated scripts. If an open my auth.log I get this from the past 3 minutes (I know I should change the ssh port, but I'm not the one that can decide that):

Apr  1 09:02:14 jugo sshd[15626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:02:20 jugo sshd[15659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:02:24 jugo sshd[15661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:02:29 jugo sshd[15664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:05:33 jugo sshd[16424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:35 jugo sshd[16427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:38 jugo sshd[16429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:40 jugo sshd[16431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:43 jugo sshd[16433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root

They just try automatically to get into a system with some random passwords and users. In the end there will be a few servers they can get into.

Measures you can take to prevent these attacks:

• make your code secure
• white list instead of blacklist
• least privileged principle
• Use of firewalls, IDS and IPS.

They also hire penetration testers and security analysts to test their systems and go look for mistakes or problems. It's not impossible, but not it's very hard. There were companies people were able to get into that were published. You only need to have a look at all the companies Lulzsec was able to get into. But remember these guys are highly skilled.

Answer 2

Its probably happening as we type...

Honestly, if someone exploits a backend somewhere, they usually don't go screaming, "I haxor'd teh shitz" like some more ego-brained attempts.

Why do you think Facebook was created? The NSA LOVES IT! 845 million people just giving them EVERYTHING & a timeline of their lives to boot for FREE no wiretaps, no spies...Its like the land of digital milk & honey...

Not to mention some other countries agencies...Chinese*Cough*Russians*Cough

If your into serious info security, you already assume EVERYTHING is compromised by SOMEBODY...Just because, it has to be, in order for "security" to exist... (security theater, Maintaining the illusion of control)

So, YES it is very hackable but, these companies pay out money to hackers to make sure its less vulnerable but, in the end, its a perpetual cycle that keeps people employed. (on both sides of the firewall)

;-)

Answer 3

Of course these organisations are hackable and of course it has happened and keeps happening, however there is less need to use technical attacks here as it is so much easier to use social engineering and other people attacks - the very model is built to share personal information so that is what attackers do. It does not hold vast amounts of cash so the profile is different.