I work for an organization that works in the eComm space. Hosted checkouts, lots of integrations, etc. They process millions each month for thousands of clients. Ever since I started I brought up issues with the security of this organization.
For PCI audits, they move things around and turn off servers to avoid some issues. Username/Passwords are plaintext in API requests (query parameters). Login Password were hashed via SHA1. It's been migrated to argon this year. The company was hacked last month, although I'm positive it's happened multiple times in the past. Co-workers mentioned there was a hack a few years back that wasn't as bad as this. This most recent hack, they got everything. Codebase, databases, client credentials (we don't encrypt client secrets), and card numbers. They had root access to prod servers. Clients have done their own pentesting and found issues. Security wasn't a thing until this hack happened. Anyone with a brain would see the issues.
It took the company about 2 weeks or so to even discover the hack had happened. The only reason the hacker was caught was because they started using the deployment pipeline to modify code/servers. I think it was because they wanted to see just how stupid the company was. The hacker was able to gain all of this access because the code base is garbage. Tons of XSS, SSRF, SQL injections, and poor code in general. They were able to gain access to services because they used default passwords. Secrets were shared between environments (staging and production). AWS keys were not locked down (S3 read-only was setup to read/write to S3 and other services). Logs truncate at 30 days, so no one is sure how long they were in the system.
I have been trying to find another job, but the industry is trash right now. I can't stay here. I've looked into whistle blower laws and seems like none of this would really qualify for anything. I've thought about talking to a lawyer about all of this. I cannot afford to just quit. It took me awhile to get this job and I'm terrified that losing this job will leave me homeless.
One of the biggest issues was our all hands we had today. The CEO, CTO, and another high level person talked to everyone. It was very little truth with a lot of BS. This entire hack was preventable. Other jobs I've had, people would be getting fired and replaced over this.
The question I want to ask is what would you do in a situation like this?
For PCI audits, they move things around and turn off servers to avoid some issues. Username/Passwords are plaintext in API requests (query parameters). Login Password were hashed via SHA1. It's been migrated to argon this year. The company was hacked last month, although I'm positive it's happened multiple times in the past. Co-workers mentioned there was a hack a few years back that wasn't as bad as this. This most recent hack, they got everything. Codebase, databases, client credentials (we don't encrypt client secrets), and card numbers. They had root access to prod servers. Clients have done their own pentesting and found issues. Security wasn't a thing until this hack happened. Anyone with a brain would see the issues.
It took the company about 2 weeks or so to even discover the hack had happened. The only reason the hacker was caught was because they started using the deployment pipeline to modify code/servers. I think it was because they wanted to see just how stupid the company was. The hacker was able to gain all of this access because the code base is garbage. Tons of XSS, SSRF, SQL injections, and poor code in general. They were able to gain access to services because they used default passwords. Secrets were shared between environments (staging and production). AWS keys were not locked down (S3 read-only was setup to read/write to S3 and other services). Logs truncate at 30 days, so no one is sure how long they were in the system.
I have been trying to find another job, but the industry is trash right now. I can't stay here. I've looked into whistle blower laws and seems like none of this would really qualify for anything. I've thought about talking to a lawyer about all of this. I cannot afford to just quit. It took me awhile to get this job and I'm terrified that losing this job will leave me homeless.
One of the biggest issues was our all hands we had today. The CEO, CTO, and another high level person talked to everyone. It was very little truth with a lot of BS. This entire hack was preventable. Other jobs I've had, people would be getting fired and replaced over this.
The question I want to ask is what would you do in a situation like this?