Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up, and I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

I ask this because I manage a large database with sensitive information (FirstName, Surname, Address and DOB) and wondering how safe this data is, and how it can be made safer.

share|improve this question
4  
I'll simply say that if you can imagine the size of the infrastructure needed for 50 million users and the number of staff employed in these companies then you'll be able to see why security across the entire environment becomes very difficult –  NULLZ Apr 28 '13 at 4:14
4  
To err is human... To take advantage of that is Hacker :)) –  pnp Apr 29 '13 at 6:47
add comment

3 Answers

Insider knowledge / access may be a possibility. Employees with drug habits, alcohol or gambling problems, a grudge....

You also have to consider backups, discarded tapes or failed disks and test/DR databases or extracts made for data analysis. Most of these breaches would work just as effectively with data three or six months old.

PS. The Imperva blog also suggest the possibility of an unpatched Ruby vulnerability http://blog.imperva.com/2013/04/a-look-into-the-livingsocial-hack.html

share|improve this answer
add comment

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements,

SQL injection is a big issue for a site of any size. All it takes is one missing mysql_real_escape_string() and your program is compromised. As with most things in computer security, there are vulnerabilities everywhere, and you have to patch up stuff you don't necessarily know exist. One mistake can bring down the entire establishment.

Another thing is that these are large and complicated frameworks. It's quite plausible that there are a few chinks in its armor somewhere.

I ask this because I manage a large database with sensitive information (FirstName, Surname, Address and DOB) and wondering how safe this data is, and how it can be made safer.

Hire a security consultant. This is not something that can be reasonably answered in a post, and is quite a situation-specific thing.

share|improve this answer
3  
If a single missing mysql_real_escape_string can compromise your site, then your main mistake was using a bad API, not the forgotten escape. There are very few places where one wouldn't use parameterized statements. –  CodesInChaos Apr 28 '13 at 8:43
    
@CodesInChaos: A single missing API call can do that too. A new developer may decide to use bare mysql_ functions for a certain new feature. And this doesn't just apply to SQL injection: there are tons of simple mistakes which can cause big vulnerabilities. –  Manishearth Apr 28 '13 at 8:56
add comment

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements,

Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues.

I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up

Have a look at OWASP Top Ten again... Poorly implemented session state management have always been a constant source of problems as well...

I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

Again, assumptions. There is a whole bunch of vulnerabilities out there that will allow privilege escalation into root. This is especially true if you are running old, unpatched or misconfigured systems. Have a look at exploit-db and take your pick...

share|improve this answer
1  
As far as patches go, one of the biggest problems in large "100% uptime needed" businesses is change resistance. Bringing down critical systems for patching is expensive and time consuming, and results in having to report smaller numbers to the bosses. So, as such, you'll find that many places lag behind on patches and only do a quarterly patch cycle on critical systems, unless there's a critical service-affecting bug that requires immediate attention. And even then, there's a lot of red-tape and change request politics to go through first. –  Polynomial Apr 29 '13 at 9:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.