zlacker

[parent] [thread] 21 comments
1. miohta+(OP)[view] [source] 2025-11-13 13:40:06
Not everyone gets hacked. Companies not hacked include e.g.

- Google

- Amazon

- Meta

replies(13): >>ceejay+r1 >>lr4444+S1 >>sigmoi+U1 >>dragon+h2 >>xvecto+24 >>ckozlo+A6 >>Aarons+ae >>skeete+Aj >>red-ir+Dk >>alt227+4m >>jacque+aq >>Thorre+Xt >>edm0nd+G61
2. ceejay+r1[view] [source] 2025-11-13 13:48:20
>>miohta+(OP)
Meta once misconfigured the web servers and exposed the source. https://techcrunch.com/2007/08/11/facebook-source-code-leake...
3. lr4444+S1[view] [source] 2025-11-13 13:50:40
>>miohta+(OP)
... that we know of. Perhaps some of those "outages" were compromised systems.
replies(1): >>red-ir+Rk
4. sigmoi+U1[view] [source] 2025-11-13 13:50:43
>>miohta+(OP)
The relevant difference here is that these companies have actual security standards on the level that you would only find in the FAA or similar organisations were lives are in danger. For every incident in Google cloud for example, they don't just apologise, but they state exactly what happened and how they responded (down to the minute) and you can read up exactly how they plan to prevent this from happening again: https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1S...

This is what incident handling by a trustworthy provider looks like.

5. dragon+h2[view] [source] 2025-11-13 13:53:23
>>miohta+(OP)
Google just got hacked in June:

https://cloud.google.com/blog/topics/threat-intelligence/voi...

https://www.forbes.com/sites/daveywinder/2025/08/09/google-c...

replies(1): >>NBJack+Q4
6. xvecto+24[view] [source] 2025-11-13 14:06:38
>>miohta+(OP)
They also have plenty of domestic and foreign intelligence agents literally working with sensitive systems at the company.
◧◩
7. NBJack+Q4[view] [source] [discussion] 2025-11-13 14:11:07
>>dragon+h2
That was a Salesforce instance with largely public data, rather than something owned and operated by Google itself. It's a bit like saying you stole from me, but instead of my apartment you broke into my off-site storage with Uhaul. Technically correct, but different implications on the integrity of my apartment security.
replies(1): >>scottb+mh
8. ckozlo+A6[view] [source] 2025-11-13 14:18:52
>>miohta+(OP)
Amazonian here. My views are my own; I do not represent my company/corporate.

That said...

We do our very best. But I don't know anyone here who would say "it can never happen". Security is never an absolute. The best processes and technology will lower the likelihood and impact towards 0, but never to 0. Viewed from that angle, it's not if Amazon will be hacked, it's when and to what extent. It is my sincere hope that if we have an incident, we rise up to the moment with transparency and humility. I believe that's what most of us are looking for during and after an incident has occurred.

To our customers: Do your best, but have a plan for what you're going to do when it happens. Incidents like this one here from checkout.com can show examples of some positive actions that can be taken.

replies(1): >>jacque+dr
9. Aarons+ae[view] [source] 2025-11-13 14:58:39
>>miohta+(OP)
Google got hacked back in 2010, lookup Operation Aurora. It wasn't a full own, but it shows that even the big guys can get hacked.
◧◩◪
10. scottb+mh[view] [source] [discussion] 2025-11-13 15:15:22
>>NBJack+Q4
It was a social engineering attack that leveraged the device OAuth flow, where the device gaining access to the resource server (in this case the Salesforce API) is separate from the device that grants the authorization.

The hackers called employees/contractors at Google (& lots of other large companies) with user access to the company's Salesforce instance and tricked them into authorizing API access for the hackers' machine.

It's the same as loading Apple TV on your Roku despite not having a subscription and then calling your neighbor who does have an account and tricking them into entering the 5 digit code at link.apple.com

Continuing with your analogy, they didn't break into the off-site storage unit so much as they tricked someone into giving them a key.

There's no security vulnerability in Google/Salesforce or your apartment/storage per se, but a lapse in security training for employees/contractors can be the functional equivalent to a zero-day vulnerability.

replies(1): >>Thorre+Gs
11. skeete+Aj[view] [source] 2025-11-13 15:26:01
>>miohta+(OP)
fair or not, if their customers get hacked it's still on them to mitigate and reduce the damage. Ex: cloud providers that provide billing alerts but not hard cut-offs are not doing a good job.
12. red-ir+Dk[view] [source] 2025-11-13 15:30:51
>>miohta+(OP)
Nah.

The Chinese got into gmail (Google) essentially on a whim to get David Petraeus' emails to his mistress. Ended his career, basically.

I'd bet my hat that all 3 are definitely penetrated and have been off and on for a while -- they just don't disclose it.

source: in security at big orgs

replies(2): >>Thorre+ov >>thauma+OL
◧◩
13. red-ir+Rk[view] [source] [discussion] 2025-11-13 15:31:59
>>lr4444+S1
"shit it's compromised. pull the plug ASAP"
14. alt227+4m[view] [source] 2025-11-13 15:37:24
>>miohta+(OP)
Didnt Edward Snowden release documents that the NSA had fully compromised googles internal systems?
replies(1): >>edm0nd+W71
15. jacque+aq[view] [source] 2025-11-13 15:54:22
>>miohta+(OP)
Everybody includes Google, Amazon and Meta.

They too will get hacked, if it hasn't happened already.

◧◩
16. jacque+dr[view] [source] [discussion] 2025-11-13 15:58:03
>>ckozlo+A6
> But I don't know anyone here who would say "it can never happen". Security is never an absolute.

Exactly. I think it is great for people like you to inject some more realistic expectations into discussions like these.

An entity like Amazon is not - in the longer term - going to escape fate, but they have more budget and (usually) much better internal practices which rule out the kind of thing that would bring down a lesser org. But in the end it is all about the budget, as long as Amazon's budget is significantly larger than the attackers they will probably manage to stay ahead. But if they ever get complacent or start economizing on security then the odds change very rapidly. Your very realistic stance is one of the reasons it hasn't happened yet, you are acutely aware you are in spite of all of your efforts still at risk.

Blast radius reduction by removing data you no longer need (and that includes the marketing department, who more often than not are the real culprit) is a good first step towards more realistic expectations for any org.

◧◩◪◨
17. Thorre+Gs[view] [source] [discussion] 2025-11-13 16:05:07
>>scottb+mh
There's no vulnerability per se, but I think the Salesforce UI is pretty confusing in this case. It looks like a login page, but actually if you fill it in, you're granting an attacker access.

Disclosure: I work at Google, but don't have much knowledge about this case.

18. Thorre+Xt[view] [source] 2025-11-13 16:11:24
>>miohta+(OP)
Facebook was hacked in 2013. Attacker used a Java browser exploit to take over employees' computers:

https://www.reuters.com/article/technology/exclusive-apple-m...

Facebook was also hacked in 2018. A vulnerability in the website allowed attackers to steal the API keys for 50 million accounts:

>>18094823

◧◩
19. Thorre+ov[view] [source] [discussion] 2025-11-13 16:17:57
>>red-ir+Dk
Do you have a source that the Google hack was related to David Petraeus? This page doesn't mention it[1]. Does the timeline line up? Google was hacked in 2009[2]. The Petraeus stuff seems to have happened later.

Disclosure: I work at Google but have no internal knowledge about whether Petraeus was related to Operation Aurora.

[1] https://en.wikipedia.org/wiki/Petraeus_scandal

[2] https://en.wikipedia.org/wiki/Operation_Aurora

◧◩
20. thauma+OL[view] [source] [discussion] 2025-11-13 17:29:48
>>red-ir+Dk
> I'd bet my hat that all 3 are definitely penetrated and have been off and on for a while -- they just don't disclose it.

Considering the number of Chinese nationals who work for them at various levels... of course they're all penetrated. How could that possibly fail to be true?

21. edm0nd+G61[view] [source] 2025-11-13 19:00:50
>>miohta+(OP)
You are joking right?

All of these companies have been hacked by nation states like Russia and China.

◧◩
22. edm0nd+W71[view] [source] [discussion] 2025-11-13 19:06:21
>>alt227+4m
Yup. The NSA has every single major US tech company tapped at their server level and are harvesting all their data. Issues them NSLs and there is zero way these companies can refuse the taps.
[go to top]