Comment by WestCoastJustin | Hacker News Reader

Comment by WestCoastJustin | Hacker News Reader

Parent Full thread

WestCoastJustin

Just trying to develop a timeline here.

  Buffer security breach - October 26, 2013 [1]
  MongoHQ security breach - October 28, 2013 [2]

But the Buffer security breach was via MongoHQ, so MongoHQ has likely had the issue since at least the 26th, and probably earlier, since the attackers had to have enough situational awareness to target Buffer. I guess my point is, MongoHQ likely had the issue for a while and it went undetected.

[1] http://open.bufferapp.com/buffer-has-been-hacked-here-is-wha...

[2] http://security.mongohq.com/notice

Joel and Josh have it right, we found the actual breach yesterday. You also have it right, the breach happened before Monday. We're hoping to find reasonably conclusive evidence of a start date we can share with affected customers.

Hi Justin. To clarify, from what I understand, October 28 is the date MongoHQ detected this. They've provided us with the logs of database access, and unfortunately the queries leading to our spam attack on Saturday started as early as October 19.

I can understand that MongoHQ wanted to obtain the full picture here and not put other customers at risk by exposing this information before the situation was fully locked down.

I'm not sure what the implication (if any) of your post is, but the timeline seems fairly reasonable to me.

I wouldn't be surprised if it was Buffer's investigation that tipped MongoHQ off to the breach.

Reply on news.ycombinator.com