Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data

https://hackread.com/disneys-internal-slack-breached-nullbulge-leak-data/

by artninja1988 • 2 years ago

331 209 2 years ago

hackread.com

postepowanieadm• 2 years ago

leaked 1.1 TiB (1.2 TB)

I don't know why but I find this funny.

Jerrrrrrry4• 2 years ago

Would you rather have three fingers and a thumb or seven fingers and a thumb?

70 million year old evolutionary technical debt rearing its head, yet again.

Jerrrrrrry4• 2 years ago

(humans have a number of fingers that isnt a base of two)

robxorb4• 2 years ago

Perhaps one day, we can return to the days when a KB was a KB and a MB was a MB. Those grand old days, when we all accepted kilo and mega stretch a little more for computers. Because in binary, base10 metric is a wee bit of a shoehorn. Just a bit.

SoftTalker3• 2 years ago

It all changed when "normal people" started using computers. 1 KB = 1024 bytes makes perfect sense except to 98% of the world.

croes3• 2 years ago

The bigger the storages get the bigger the discrepancy. 1 pebibyte isn't 10^15 byte but more than 10% more.

mlfreeman• 2 years ago

Even if we can't can we think of better names?

"kibibyte" sounds like a dog treat not a unit of measurement.

rvense• 2 years ago

I've honestly never been in a situation where I actually cared about the difference. Just nerd pedantry.

shakow• 2 years ago

I remember in the 90's we used the prefix case to differentiate between SI (kB) and powers of 1024 (KB). Not sure how widespread it was though; no Internet to poll at the time :)

fhars• 2 years ago

Yeah, the innumeracy is strong in that one.

Tokkemon• 2 years ago

Alex has us covered: https://www.youtube.com/watch?v=TCTWyNstpD0&t=55s

qup• 2 years ago

The built in video player on Reddit will say 2:21 in the preview, then the video will be 2:22 long

1231232131231• 2 years ago

I wonder why there are so few articles considering this happened last night. Also, it's sad how the "insider" (who probably was hacked/RATed) had his SSN and other info leaked :/

jachee• 2 years ago

After the bell on Friday is an infamous time for releasing news you don’t want to be covered.

SoftTalker3• 2 years ago

Again highlighting the unrecognized liability companies are taking on by logging every scrap of internal communication, no matter how informal or ill-conceived it may be.

KerrAvon• 2 years ago

In a very large company like Disney there are often legal data retention requirements from ongoing litigation, which means Corporate Slack might be more complicated than the AT&T customer data breach.

Zondartul• 2 years ago

With how big and aggressive Disney is I'd expect it to be under ongoing litigation 24/7/365.

05• 2 years ago

Proper logging for retention would surely involve a point where you encrypt the data with a temporary key and then encrypt that key with the public key and only your top brass would have access to the HSM that could decrypt that blob..

nyrikki2• 2 years ago

Retention doesn't require it to be online.

A tape sitting in Iron mountain would have a smaller attack surface and be compliant.

Potentially this breach will allow litigation that was financially infeesable for some people.

As a former WDIG employee I am not even suggesting anything concrete or that I have any knowledge of unlawful activity.

But as someone who also worked in the electronic evidence discovery field, the cost of blind discovery has a chilling effect on lawsuits.

Now that targeted discovery is possible, it will be within the budgets of more potential cases.

The forever retention was a marketing differentiator for Slack, so this type of events were a risk you have to accept.

But all about convenience and not compliance.

xyst• 2 years ago

It may be a requirement or law depending on where the company does business.

For example, the financial companies I used to work for had a “standard practice” of archiving all e-mails and internal chats for 7-8 years. Not sure if phone calls on company equipment were recorded or retained though (may be a YMMV case).

This is why I separate work and personal assets. I never do work on personal devices nor do I use work devices for personal activities (ie, social media, e-commerce, shit posting). Also if I’m shit talking the boss’s boss. It’s never using work devices.

Have been asked a few times to use personal devices for work but absolutely refused. I would be asked to install their invasive spyware and root kits so they can abide by their draconian corporate policies. So far, they haven’t forced me otherwise I would have quit those companies long ago.

exe34• 2 years ago

or you buy a shitty phone for the company crapware and leave it at your desk when you go home.

viraptor5• 2 years ago

Requirement to log doesn't mean the record has to be in online storage though. It could easily get rotated into cold storage every month with only a unique offline password granting you access.

accrual• 2 years ago

Also if I’m shit talking the boss’s boss. It’s never using work devices.

It's wild that some don't get this. A couple years back some employees at my company were fired for doing just this over the same IM system we used to coordinate everything else.

blitzar• 2 years ago

for 7-8 years. Not sure if phone calls on company equipment were recorded or retained though

For a front office role - archiving of; emails, internal chats, external chats, phone calls / squawk lines, browser history, pc screenshot every X interval, same for work laptop at home. Office cctv, room microphones, mobile phone calls + text messages + device monitoring to ensure no other apps.

I never do work on personal devices nor do I use work devices for personal activities

This is now the way.

whoiscroberts• 2 years ago

Does Cisco AnyConnect fall into the invasive spyware root kit category?

KennyBlanken2• 2 years ago

Setting (formally or informally) corporate policies which destroy or even prevent the creation of a record of internal communications, regardless of how formal those communications may be - is very well illegal depending on a variety of factors.

The shining poster boy for this would be Google, who told staff to disable logging when discussing sensitive topics:

https://www.techspot.com/news/102874-doj-alleges-google-dest...

They also told employees to never use certain keywords, so that records of conversations would not be found by legal teams using search tools, but also they wouldn't be shown talking like monopolists:

https://arstechnica.com/tech-policy/2023/09/google-hid-evide...

SoftTalker3• 2 years ago

Right, but not using Slack at all would not violate any laws. At least today, conversations at the water cooler or in the lunchroom are not required to be recorded.

matt-attack3• 2 years ago

So I guess whispering is a crime now?

JumpCrisscross2• 2 years ago

the unrecognized liability companies are taking on by logging every scrap of internal communication

Do any large companies not delete everything at the first opportunity?

houseplant3• 2 years ago

no, of course not. Especially not disney. they need every shred of everything, for liability's sake. If someone brings something to HR, they need to be able to tamp it down. They keep receipts of everything, all the time.

I know a lot of these types of entertainment companies employ things like keyloggers or remote screen viewers in case an employee is working on a writing project or drawing/painting a picture during their lunch hour, because if they are, everything they make, write, sketch or even jot down belongs to disney exclusively... and if they, say, bring that script to prospective publishers outside the company a year later, or try to sell a print of the artwork they created, they can intervene and stop you.

if you take a shit in their staff bathrooms, that turd belongs to them too.

filoleg• 2 years ago

Google used to have all 1:1 chats autodeleted in 24hrs, unless the employee explicitly disabled it for a specific chat in question. But then they got in trouble with DOJ for that last year[0].

0. https://news.bloomberglaw.com/antitrust/google-chat-deletion...

simonsarris• 2 years ago

Interestingly Disney has done this since inception which is why the (IMO, excellent) biography Walt Disney: The Triumph of the American Imagination can be so detailed.

pylua3• 2 years ago

Is it even legal to view that data ?

falcor843• 2 years ago

Why would it not be? What data is it illegal to view? Other than perhaps CSAM, which I would strongly hope Disney don't host on their Slack.

aflag• 2 years ago

You just gave an example. There are loads of classified information out there. Though Disney will probably not be able to sue you for just reading the data necessarily, doing so is a big liability if you're a competitor or work for a competitor.

pylua3• 2 years ago

I don’t know why it would be illegal, but it feels skeevy. Besides, Disney has a a good legal team — I wouldn’t be surprised if they could find a reason.

kelseyfrog• 2 years ago

Viewing the data necessary copies it. The data is of course, all Disney IP in the sense that all employee output is the employers intellectual property. Copying Disney IP hasn't historically worked out for folks.

houseplant3• 2 years ago

every piece of writing, every sketch and illustration, and a lot of discussions about the process or development of shows/films/books/games/etc are copyrighted and under NDA.

Have you ever worked in entertainment?

raphman• 2 years ago

Train an LLM on it...

pylua3• 2 years ago

If someone did that, it would be copyright? As the consumer of the llm, would that breach copyright

486sx33• 2 years ago

Seems like slack has a problem

Maybe a dumping tool that uses a stolen api key? Rate limiting and monitoring on slack’s part could help…

kjkjadksj2• 2 years ago

Hardly slacks fault. With so many clients and so much money behind that, theres such a big target on their back that shoring up defenses is fundamentally impossible. It’s probably best to just consider such services from such large providers as already compromised, and keep sensitive data off them entirely.

prng20212• 2 years ago

Whether you’re talking about enterprise file storage, email, or chat messaging software, they all have APIs and/or admin user interface to allow retrieving any and all data to support eDiscovery.

scherlock• 2 years ago

All their APIs are rate limited. Disney would have a Grid and with Grids you get data dumps. The feature is normally used for litigation and you need pretty high admin access to get a dump. They either found an exploit or they compromised an Admins account.

denysvitali• 2 years ago

https://slack.com/help/articles/12914005852819-Slack-data-lo...

johndhi4• 2 years ago

Can someone explain why hackers dump the files publicly rather than just tell the victim they got access? What's the point?

beeboobaa3• 2 years ago

techno-anarchism

thegrim33• 2 years ago

If you read the article, the answer to your question is in the fourth sentence. There's even an entire section under the headline "Who, Why, and How" that goes into motives.

walterbell2• 2 years ago

https://www.csoonline.com/article/565048/what-hackers-do-the...

  Financial motivations
  Nation-state sponsored/cyberwarfare
  Corporate espionage
  Hackivists
  Resource theft
  Gamer issues

  Financial theft and nation-state attacks are easily the largest portion of cybercrime. Decades ago, the lone, solitary youth hacker powered by junk food was an adequate representation of the average hacker. They were interested in showing themselves and others that they could hack something or create interesting malware. Rarely did they do real harm.

  Today, most hackers belong to professional groups, which are motivated by taking something of value, and often causing significant harm. The malware they use is designed to be covert as possible and to take as much of something of value as is possible before discovery.

guerrilla• 2 years ago

You missed non-state political motivations. There are plenty of revolutionaries and so-called terrorists around.

It appears that this is actually the case here, as it's supposedly about artist's rights.

johndhi4• 2 years ago

if you're trying to steal, wouldn't it be best NOT to publicly dump it, and just quietly use the breached material?

vondur• 2 years ago

Some people just like to watch the world burn?

rexpop• 2 years ago

Disney is a cultural slash-and-burn enterprise, themselves.

johndhi4• 2 years ago

this is the main explanation that makes sense to me

kjkjadksj2• 2 years ago

Maybe they shorted the stock.

nerdponx2• 2 years ago

Bad move unless they're actively day trading. This won't have any serious effect on Disney stock.

KennyBlanken2• 2 years ago

The motto of the group that leaked it is "A hacktivist group protecting artists' rights and ensuring fair compensation for their work", so my guess is that they're trying to give the press and researchers a look at what goes into the sausage, because the industry abuses the hell out of creative talent.

One question is whether there is one massive slack, or multiple different ones. I'd certainly hope that sensitive stuff is limited to a separate slack, for extra insulation.

They mention a name, and a google search shows that person works in Disney IT, so maybe their credentials were leaked and they had admin access to the slack. In that case, relying on slack permissions to limit the scope of a breach isn't really going to work.

coldcode• 2 years ago

There isn't a single slack instance, nor is there a single IT organization. Disney is a huge company with many mostly autonomous divisions. I highly doubt they took everything as it would not be all in one place. I presume given the message it was likely the folks making movies or Disney+, not Parks. Of course, it could also be something much more benign.

soupbowl• 2 years ago

Disney pissed off a lot of fans of marvel, starwars and most IPs they recently bought. The hackers dump the files publicly to be mined to shaming Disney. Maybe...

houseplant3• 2 years ago

they themselves said why: Disney is responsible for cancelling, burying, and destroying the records of a lot of shows that fans seem to really love. TAG, the largest animation union, has been raising awareness of extremely unfair treatment of the creative side of Disney and other companies for a while now, how years of their hard creative work has been squatted on without ever seeing the light of day.

apparently, the hackers don't really seem to consult the artists they're purportedly trying to help by doing this, because none of them want to see their work leaked like this. I think these hackers just selfishly want to see the materials behind cancelled shows they were looking forward to.

ranger_danger2• 2 years ago

Interesting logic... what's the point of "just telling them"?

johndhi4• 2 years ago

well, there are a few things you could do short of publicly dumping a ton of private information to achieve the same or similar goals:

-publicly announce that you've breached X amount of data, and provide hashes of the files and tell the breached entity to confirm the hashes are accurate otherwise you'll publicly dump; -publicly prove you've accessed the files in a way that requires breach notification laws to be triggered -- so the company is forced to post embarrassing announcements but the actual risk to the underlying people in the dataset is reduced

what I don't understand is why you have to screw over all of the little people and individuals by just making everything public.

karaterobot• 2 years ago

They should learn opsec from the Disney Vault.

linuxdude314• 2 years ago

As someone who literally used to own the digital version of the Disney vault I find this leak highly unlikely what it is claimed to be.

Disney doesn’t just use one Slack instance across the whole company and everyone knows to not put pre-release content on my public platforms.

Maybe they compromised an instance owned by DTSS (Disneys centralized IT entity), but this would have little to do with Disney Studios like they imply.

Its pretty standard in the industry to only store pre-release content on airgapped systems.

doctorpangloss• 2 years ago

I don't know, the Sony hacks were pretty comprehensive. Why not Disney? Because of some aspirations about imagineers and giant corporations or whatever? They aren't software specialists. The software they sold to other people, like their games business, was kind of a disaster. They don't compete on software.

Its pretty standard in the industry to only store pre-release content on airgapped systems.

Unreleased narrative content isn't actually valuable, so nobody actually cares. I mean of course they say it's valuable. But there are aspects of value that are objective, and I am saying objectively, not in some aspirational sense, it's not valuable. And anyway, surely, how did such pre-release content get on such airgapped systems? They have tens of thousands of vendors, and those people talk, and they have ordinary desktop computers. They make mistakes all the time. It doesn't really matter.

Their business communications are valuable. So people hacked that.

I understand there is a lot of gestural, performative security measures in the industry, I belong to it. At the end of the day, Disney (Hollywood) asks too much from IT for too little money, does not attract talent comparable to a middle-of-the-road Series A startup in San Francisco, and is led by people who don't value technology (on average).

skoopie• 2 years ago

No, they should learn opsec from whoever runs our elections--the most secure elections in the world.

morbicer• 2 years ago

Lol, only in USA people don't mention which country is "our" and blindly claim they are best in the world.

https://www.electoralintegrityproject.com/eip-blog/2022/6/13...

https://www.pewresearch.org/short-reads/2016/10/31/u-s-elect...

https://citizen-network.org/library/global-ranking-of-electo...

v3ss0n• 2 years ago

Thats for Ruining MCU!

slowhadoken• 2 years ago

The spin from Disney is going to be entertaining.

egypturnash• 2 years ago

I can’t stop giggling at this group’s name.

roxy9006• 2 years ago

Any news on the contents in terms of unreleased films?

lopkeny12ko• 2 years ago

I don't understand the situation with the insider (Matthew J Van Andel). Is the implication that he was originally collaborating with the hackers to give them access, then regretted doing so and decided to cut off their access, and the hackers retaliated by doxxing him?

omgwtfusb• 2 years ago

this video alleges that it might've been because he downloaded an infected mod for a game: https://youtu.be/ZGScvWIyw2E

Not sure why they would dox him, maybe to throw him under the bus after he found out he got pwned and cut them off?

drexlspivey2• 2 years ago

I’d like to know if that’s really how Kathleen Kennedy eats her Linguini.

matt-attack3• 2 years ago

Could you please explain this reference? I know who she is but I don’t get it.

drexlspivey2• 2 years ago

It’s from South Park https://youtu.be/TWhsjai-OVE?si=i8VAiEZ4kt885xa5

hd4• 2 years ago

Anecdotally it feels like there has been an uptick in these high-profile hacks recently, maybe a result of more security people being laid off as a result of companies thinking they would replace everyone with AI?

sva_• 2 years ago

Perhaps even hybrid warfare

layer8• 2 years ago

If AI is a factor at all, then more likely on the hackers’ side.

StressedDev• 2 years ago

Probably not - The reason we continue to see attacks is for a couple of reasons:

1) There are very few consequences. At worst, a hacker will get 5-7 years, and the chance of getting caught is low.

2) Security is very very very hard. The defender must get everything right. The attacker only needs to find one flaw.

3) Security does not just depend on security staff. It depends on every software engineer, operations (or devops) engineer, every software dependency, every piece of hardware, etc. If one of these people or dependencies has a problem, the whole system can be cracked. Examples of problems include writing insecure code, getting hacked, not removing old employees from an ACL or group, installing a tool with a back door, etc.

The point is security is hard and it depends on people doing the right thing. It's very hard to get people to do the right thing.

endorphine• 2 years ago

The reason for this attack is political (in the general sense of the term).

kansface• 2 years ago

I wonder what percentage of cyber attacks come from a country that extradites to the US in practice? I didn't find any handy statistics online.

hudsonjr• 2 years ago

#3 is big as I'm not a security or IT person, but have had a big burden placed on me with regard to security. The biggest factor is work that was once done by internal employees in trusted areas is now outsourcers and contractors, sometimes from low pay higher corruption areas.

There's a constant fight of giving and removing access from an army of people. Additionally, there are often efforts to push these higher risk people into more confidential areas because the push to cut costs. Make one exception and then a "but this person has access" is sure to follow.

mellow-lake-day• 2 years ago

More security people laid off but also layouts in general put strain on the remaining workers who are supposed to do more work to make up the difference hence more likely to cut corners to deliver products

christkv• 2 years ago

Disney seems to be just shooting themselves in the foot over and over again recently.

It will be interesting to see what happens here. Information that leaks could actually impact share price.

shrubble• 2 years ago

Considering the social and political controversies that Disney is unvolved in, I would expect a lot of scrutiny of the contents of this link.

indus• 2 years ago

Dark side of API-based access to everything on SaaS where companies have no control.

I can’t guard the front door effectively.

Nor, I can easily guard the back doors.

Will data breaches like these: AT&T, Ticketmaster, and now Disney—-a nail in Security coffins for SaaS?

werrett• 2 years ago

lol. no. besides which all of these hacks would have been prevented by simple, well established controls (eg. MFA everywhere, not hoarding every scrap of customer data and internal comms).

so all of those basics are going to magically happen when you move your data on-prem?

nerdponx2• 2 years ago

Also the above-mentioned SaaS customers will face no negative consequences from investors or otherwise, just some bad press that will be forgotten quickly and amount to nothing. It's great if your SaaS vendor gets hacked and not you: it spreads blame around in the eyes of the public, and makes it harder for legislators, regulators, and plucky DAs to come after you.

ziofill• 2 years ago

It's clear that 1Tb is a lot of data, but I would have expected more from Disney's slack?

femou• 2 years ago

According to the hackers they lost access so it's possible there's more data that wasn't gathered in time

az226• 2 years ago

This is going to be a anti-DEI treasure trove. The unsaid things will be shown to have very much been said.

ngetchell• 2 years ago

Will it?

TacticalCoder• 2 years ago

Well it seems like a huge leak. And if there's a place where there are illegal, woke, decisions taken it's Disney. For example there's a Disney exec who's been recently caught by an undercover journalist, on video, saying "we don't hire white men as such positions".

It is discrimination and it's totally illegal. I do personally find the "wokeness" of Disney also shows in their cartoons (it's just an opinion but several have that same opinion).

So for such things to happen, there may be a company culture of wokism in place at Disney.

If there's such a company culture and seen the size of the leak, it's very possible that they've been so dumb as to openly discuss how to be anti-white (e.g. both in hiring practices and in picking fictional characters) on their slack channels.

To paraphrase a well-known meme: *"You never go full woke: Disney went full woke".

KomoD• 2 years ago

This is the same group that put malware in ComfyUI_LLMVISION and said they were against crypto but then extorted people for crypto.

(ComfyUI_LLMVISION is probably what caused this breach)

90210• 2 years ago

where can i actually read it

93po• 2 years ago

i would like this too, i don't think it's going to be easily found on some website though, Disney will sue the owner out of existence

matrix12• 2 years ago

https://nullbulge.se/blog.html

Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data

Related Stories