8

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up, and I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

I ask this because I manage a large database with sensitive information (FirstName, Surname, Address and DOB) and wondering how safe this data is, and how it can be made safer.

Improve this question
2
  • 4
    I'll simply say that if you can imagine the size of the infrastructure needed for 50 million users and the number of staff employed in these companies then you'll be able to see why security across the entire environment becomes very difficult
    – NULLZ
    Apr 28, 2013 at 4:14
  • 5
    To err is human... To take advantage of that is Hacker :))
    – pnp
    Apr 29, 2013 at 6:47

3 Answers 3

Reset to default
13

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements,

Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues.

I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up

Have a look at OWASP Top Ten again... Poorly implemented session state management have always been a constant source of problems as well...

I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

Again, assumptions. There is a whole bunch of vulnerabilities out there that will allow privilege escalation into root. This is especially true if you are running old, unpatched or misconfigured systems. Have a look at exploit-db and take your pick...

Improve this answer
1
  • 1
    As far as patches go, one of the biggest problems in large "100% uptime needed" businesses is change resistance. Bringing down critical systems for patching is expensive and time consuming, and results in having to report smaller numbers to the bosses. So, as such, you'll find that many places lag behind on patches and only do a quarterly patch cycle on critical systems, unless there's a critical service-affecting bug that requires immediate attention. And even then, there's a lot of red-tape and change request politics to go through first.
    – Polynomial
    Apr 29, 2013 at 9:31
4

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements,

SQL injection is a big issue for a site of any size. All it takes is one missing mysql_real_escape_string() and your program is compromised. As with most things in computer security, there are vulnerabilities everywhere, and you have to patch up stuff you don't necessarily know exist. One mistake can bring down the entire establishment.

Another thing is that these are large and complicated frameworks. It's quite plausible that there are a few chinks in its armor somewhere.

I ask this because I manage a large database with sensitive information (FirstName, Surname, Address and DOB) and wondering how safe this data is, and how it can be made safer.

Hire a security consultant. This is not something that can be reasonably answered in a post, and is quite a situation-specific thing.

Improve this answer
2
  • 3
    If a single missing mysql_real_escape_string can compromise your site, then your main mistake was using a bad API, not the forgotten escape. There are very few places where one wouldn't use parameterized statements.
    – CodesInChaos
    Apr 28, 2013 at 8:43
  • @CodesInChaos: A single missing API call can do that too. A new developer may decide to use bare mysql_ functions for a certain new feature. And this doesn't just apply to SQL injection: there are tons of simple mistakes which can cause big vulnerabilities.
    – Manishearth
    Apr 28, 2013 at 8:56
2

Insider knowledge / access may be a possibility. Employees with drug habits, alcohol or gambling problems, a grudge....

You also have to consider backups, discarded tapes or failed disks and test/DR databases or extracts made for data analysis. Most of these breaches would work just as effectively with data three or six months old.

PS. The Imperva blog also suggest the possibility of an unpatched Ruby vulnerability http://blog.imperva.com/2013/04/a-look-into-the-livingsocial-hack.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .