Believe it or not a lot of hacking is more like this than you think.
Social engineering is probably 95% of modern attack vectors. And that's not even unexpected, some highly regarded computer scientists and security researchers concluded this more than a decade ago.
When the technical side reaches a certain level of security, the humans become the weakest link.
I work in security and I kinda doubt this. There are plenty of issues just like what is outlined here that would be much easier to exploit than social engineering. Social engineering costs a lot more than GET /secrets.json.
There is good reason to be concerned about both, but 95% sounds way off and makes it sound like companies should allocate significantly more time to defend against social engineering, when they should first try to ensure social engineering is the easiest way to exploit their system. I can tell you from about a decade of experience that it typically isn't.
https://www.infosecinstitute.com/resources/security-awareness/human-error-responsible-data-breaches/
You're right. It's 74%.
https://www.cybersecuritydive.com/news/clorox-380-million-suit-cognizant-cyberattack/753837/
It's way easier to convince someone that you are just a lost user who needs access than it is to try to probe an organization's IT security from the outside.
This is only going to get worse with the ability to replicate other's voices and images. People already consistently fall for text message and email social engineering. Now someone just needs to build a model off a CSO doing interviews for a few hours and then call their phone explaining there has been a breach. Sure, 80% of good tech professionals won't fall for it, but the other 20% that just got hired out of their league and are fearing for their jobs will immediately do what they are told, especially if the breach is elaborate enough to convince them it's an internal security thing.
Many years ago, I discovered that my then-employer’s “home built” e-commerce system had all user and admin passwords displayed in plaintext at home/admin/passwords.
When I brought this to the attention of leadership, they called the “developer” in and he said “oh, well, that’s IP locked, so no one on the web can access it!” When I pulled it up on my phone, he insisted my phone was on the work WiFi, despite it being clearly verifiable that was not the case. (The same work WiFi that had an open public connection, which is the one my phone would have been on, if it were on it…)
He did fix that, but many other issues remained. Eventually a new COO hired someone competent as his ‘backup’, replaced our website and finally suggested he pursue other employment opportunities before he could no longer voluntarily pursue them. (There was concern he might sabotage.)
I think that’s less about “hacking” and more about modern day devs being overworked by their hot-shit team lead and clueless PMs and creating “temporary” solutions that become permanent in the long run.
This bucket was probably something they set up early in the dev cycle so they could iterate components without needing to implement an auth system first and then got rushed into releasing before it could be fixed. That’s almost always how this stuff happens; whether it’s a core element or a rushed DR test.
modern day devs being overworked
And then there is meningspunktet.dk which had all the time in the world to do whatever they wanted, and even get their hosting paid for by a university. They still leaked everyones email, phone, full legal name and location on day one and only fixed it because I pointed it out.
Shodan lists 100'000s of publicly accessible security cameras.
If I was a hacker, I would just get a job as a night cleaning person at corporate office buildings. And then just help myself to the fucking post-it notes with usernames and passwords on them.
AI just enables the shit programmers to create a greater volume of shit
I'll tape this to my office door.
This reminds me of how I showed a friend and her company how to get databases from BLS and it's basically all just text files with urls. "What API did you call? How did you scrape the data?"
Nah man, it's just... there. As government data should be. They called it a hack.
When getting data legitimately is beyond them…
ah yes, the forbidden curl hack
I remember when a senior developer where i worked was tired of connecting to the servers to check its configuration, so they added a public facing rest endpoint that just dumped the entire active config, including credentials and secrets
That was a smaller slip-up than exposing a database like that (he just forgot that the config contained secrets) but still funny that it happened
That's not a "senior developer." That's a developer that has just been around for too long.
Secrets shouldn't be in configurations, and developers shouldn't be mucking around in production, nor with production data.
I would have put IP address access restrictions on that at the very least. I may have even done something like that more than once for various tools in the past.
That way it acts completely open to people (or other servers) in the right places and denies all knowledge to anything else.
Peak Vibe Coding results.
while True:
Jesus Christ
You know that's not the Tea code, but the downloader, right?
Other reports state the Tea backend was Vibe Coded: https://www.ainvest.com/news/tea-app-data-breach-exposes-72-000-users-ai-generated-code-security-lapse-2507/
Sure, it might be, I'm not saying it isn't. All I'm saying is: the screenshot shows the code someone wrote to download the images. It's not part of the Tea codebase.
I absolutely despise Firebase Firestore (the database technology that was "hacked"). It's like a clarion call for amateur developers, especially low rate/skill contractors who clearly picked it not as part of a considered tech stack, but merely as the simplest and most lax hammer out there. Clearly even DynamoDB with an API gateway is too scary for some professionals. It almost always interfaces directly with clients/the internet without sufficient security rules preventing access to private information (or entire database deletion), and no real forethought as to ongoing maintenance and technical debt.
A Firestore database facing the client directly on any serious project is a code smell in my opinion.
It's like people learn how to make a phone app in React Native or whatever, but then come to the shocking and unpleasant realisation that a data-driven service isn't just a shiny user interface - it needs a backend too.
But they don't know anything about backend, and don't want to, because as far as they are concerned all those pesky considerations like data architecture, availability, security, integrity etc are all just unwanted roadblocks on the path to launching their shiny app.
And so, when a service seemingly provides a way to build an app without needing to care about any of those things, of course they take it.
And I get it, I really do. The backend usually is the genuine hard part in any project, because it's the part with all the risk. The part with all the problems. The place where everything can come crashing down or leak all your data if you make bad decisions. That's the bothersome nature of data-driven services.
But that's exactly why the backend is important, and especially the part you can't build anything decent without thinking about.
I think it's less about the tech picked and more about developers with no sense of security and a poor understanding of networking. I've seen far too many web applications where the developer needed some sort of database behind it (MySQL, PostGres, MSSQL) and so they stood up either a container or entire VM with a public IP and whatever the networking layer set to allow any IP to hit the database port. The excuse is almost always something like, "we needed the web front end to be able to reach the database, so we gave the database server/container a public IP and allowed access". Which is wonderful, right up until half of the IP addresses in Russia start trying to brute force the database.
Hack has at least two definitions in a computing context.
A lot of times they sort of get used in conjunction to describe interesting ways to gain access to secure systems, but using it to describe accessing insecure things you shouldn't is still a valid usage of the phrase.
That said I definitely wanna see the company face charges for this, this is insane.
No, this was a data leak. The word "hack" has legal implications and shifts the blame away from the company and onto the individual who discovered the leak.
What was the BASE_URL here? I’m guessing that’s like a profile page or something?
So then you still first have to get a URL to each profile? Or is this like a feed URL?
It's a public firebase bucket
Oh Jesus
That should be criminally negligent.
🤦♂️
I always get irrationally angry when i see python code using os.path instead of pathlib. What is this, the nineties?
who'd have thought that javascript and client side programming was incredibly susceptible to security flaws and deeply unsafe
As much as I dislike JavaScript, it isn't responsible for this. The person (or AI) and their stupidity is.
who'd have thought that being shitty programmer was incredibly susceptible to security flaws and deeply unsafe instead of javascript
No, it must be JavaScript that is the problem
principal_skinner.jpg.exe
Disabling index and making the names UUID would make the directory inviolable even if the address was publicly available.
Sounds like a good case for brute forcing the filenames. Just do the proper thing and don't leave your cloud storage publicly accessible.
While proper security is better, you're not gonna brute force UUIDs.
Security through obscurity never works.
It's not security through obscurity in this case. The filenames can't be obtained or guessed through brute force. At least not with current technology or processing power...
Security through obscurity is when you hide implementation details.
Saying that my suggestion is security through obscurity is the same as telling that ASLR is security through obscurity...
Even the best models fine tuned for coding still have training that was based on both good and bad examples of programming from humans. And since it's not AGI but using probability to generate the code, you're going to get crap programming logic dependent on how often such things were used and suggested by humans to other humans. Googling for an answer on how to code something pulls up all sorts of answers from many sources, but reading through them, many are terrible. An LLM doesn't know that, it just knows that humans liked some answers better than others, so GIGO.
What is the Tea hack?
At this point I think the women using it got psyopped
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
