Restores are Everything | TechSNAP 168

Restores are Everything | TechSNAP 168

A company known for backup shuts down after their AWS account gets hacked, the Hedge fund thats under attack, how far you can get with a little cab data…

Your questions, our answers, and much, much more!

Thanks to:




Direct Download:

HD Video | Mobile Video | MP3 Audio | Ogg Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feeds | Torrent Feed

— Show Notes: —

Company shuts down after their AWS account compromised, all customer data deleted

  • Code Spaces, a source code hosting and backup service has ceased doing business
  • On June 17th the company came under a DDoS attack, which is apparently business as normal for them
  • Later, they found messages in their Amazon Web Services portal, urging them to contact a hotmail address
  • When contacted, the attacker demanded a large ransom
  • When Code Spaces attempted to change their passwords in the AWS control panel, additional administrator accounts added by the attacker were used to delete all EC2 virtual machines, S3 stores and EBS volumes in the account before all accessed could be revoked
  • The most embarrassing part of the situation is the text on the original Code Spaces website:
    “Backing up data is one thing, but it is meaningless without a recovery plan, not only that [but also] a recovery plan—and one that is well-practiced and proven to work time and time again,” “Code Spaces has a full recovery plan that has been proven to work and is, in fact, practiced.”
  • It is not clear what the Code Spaces backup strategy was, but it seemed to involve the same Amazon account
  • In general, the idea with an “offsite” backup is to separate it from a failure of the primary. If you keep the backups for your database beside the database server and your office burns down, what good are the backups
  • What if Amazon suffered a catastrophic data loss? or what if your account is compromised?
  • The backups should have at least been in a different Amazon account that was very strictly controlled, or better yet, stored in some other service
  • It is still unclear how the account was compromised, but it seems likely that Code Spaces was not making use of the Amazon’s Multi-Factor Authentication service, which offers either a mobile phone app, or two different types of hardware authenticators (key fob and credit-card style)

Poorly anonymized NYC Taxi data, de-anonymized

  • Under an Open Data initiative, the New York City Taxi & Limousine Commission released the anonymized GPS logs of all taxi trips in 2013 (173 million trips)
  • Chris Whong got a hold of this data and did some interesting stuff with it
  • When he was done with it, he posted the data for everyone
  • Developer Vijay Pandurangan took a look at the data and noticed that the medallion and hack numbers appeared to simply be MD5 hashes
  • In particular, the driver with ID# CFCD208495D565EF66E7DFF9F98764DA appeared to have an impossibly large number of trips
  • Turns out, that is the MD5 hash of “0”, cases where the data was unavailable
  • Realizing that the data was only anonymized using MD5, and knowing the structure of a drivers license # (5-7 characters, with specific characters being numbers or letters), he was able to brute force all 24 million combinations in only 2 minutes using a single CPU
  • Once this was done, he had the original un-anonymized data
  • Using other websites, it is possible to link the medallion and hack numbers to the owners names
  • Original Post
  • Additional Coverage – Ars Technica
  • To prevent this, there are a number of approaches, the fastest but weakest is a ‘secret key’. Instead of md5(hack#) just do md5(SUPERLONGSECRETKEYhack#), as long as the attacker doesn’t know the secret key, and it is long enough to make guessing it impractical, the data would remain anonymized
  • Another option is to use the md5 hash of the encrypted form of the value. However this eventually just relies on a secret key as well. However, if the data never needs to be anonymized, a very strong key can be used, and that key can then be destroyed, making decryption impossible.

Hackers attack hedge fund for monetary gain

  • BAE systems, a British defense contractor that also specializes in cyber security, was called in to investigate after computers at a hedge fund were hacked
  • The attackers somehow infiltrated the HFT (High Frequency Trading) system, and injected delays of several hundred microseconds into the order entry system
  • This causes the Hedge Fund to miss out on profits it could have made on the trades
  • It is suspected, that the attackers capitalized on this to make those profits themselves
  • “Hedge funds “really have inadequate cybersecurity as a whole” and the attacks threaten to undermine the systems used globally for high-speed trading, said Tom Kellerman, chief cyber security officer for Trend Micro Inc. ”


Round Up:

Question? Comments? Contact us here!