News for hackers. Stuff that matters.

A comment on Former Ubiquiti employee charged with stealing data and extorting company. Parent comment

Re:Former Ubiquiti employee charged with stealing data and e... by neom on Thursday December 02, 2021 @09:42AM (#29416705)
Should there be a chat bot for this? "Hey, I see you just shared a credential, I'll remind you in 5 minutes to delete it, if the message is not deleted I'll alert a member of the security team" kinda thing?
[ Parent | on HN ]
Re:Former Ubiquiti employee charged with stealing data and e... by mnahkies on Thursday December 02, 2021 @10:56AM (#29417726)
Ideally shouldn't the credential be rolled even if you delete the message?

Unless slack hard deletes messages, but my guess would be soft deletion. Even then it's not really designed for sending sensitive credentials

[ Parent | on HN ]
Re:Former Ubiquiti employee charged with stealing data and e... by mvanbaak on Thursday December 02, 2021 @11:33AM (#29418349)
of course they should be rolled.

Even if slack would delete the message, clients like bitlbee and wee-slack exist, and save the messages as soon as they came in, and slack will not be able to delete them. Bots get those messages as well.

Just because the chat service deletes messages from their backend does not mean the message is deleted at the clients.

[ Parent | on HN ]
Re:Former Ubiquiti employee charged with stealing data and e... by staticassertion on Thursday December 02, 2021 @11:03AM (#29417856)
Slack has no concept of a hard delete. There's always a record, as far as I know.

So yes, you'll want to: 1. Delete the message 2. Revoke the token 3. Notify the user/ security operations team

[ Parent | on HN ]
Re:Former Ubiquiti employee charged with stealing data and e... by staticassertion on Thursday December 02, 2021 @09:54AM (#29416865)
Absolutely. I know lots of companies have rolled their own. I'm unaware of a public one. I've been meaning to write one myself, maybe I'll do that this weekend.
[ Parent | on HN ]
Re:Former Ubiquiti employee charged with stealing data and e... by neom on Thursday December 02, 2021 @10:04AM (#29416993)
Can I help you with it just for fun? I'm not an engineer but somehow I'd love to help you! :) I added you on linkedin.
[ Parent | on HN ]
Re:Former Ubiquiti employee charged with stealing data and e... by staticassertion on Thursday December 02, 2021 @10:08AM (#29417034)
Sure, though I'm planning to write it in Rust so if you're not an engineer it may be a bit rough. Will reply on Linkedin though.
[ Parent | on HN ]