hacking | Paul Wallbank - Communications Professional

GorillaStack – the weekend hacking exercise that grew into a business

As a business born out of a weekend hack Sydney based GorillaStack is almost a classic tech tale.

“I was involved in a startup previously,” says GorillaStack’s CTO, Elliott Spira, recalling how the company was his co-founder Oliver Berger at the AWS Re:Invent conference in Las Vegas last week.

“We noticed we had spikes in our AWS spend, there was a big attribution issue and one day we said ‘how about we do a weekend project and try to spin something up that listens to our Cloudwatch metrics and tells us how much we’re spending at any time of the month.”

As the challenge was accepted, the team went to work. “We hacked away all weekend as we like to do, being nerds, and by the time the weekend was over we had the basic cost dashboard that told us how much we were spending each month.”

Adding more features

“The next weekend we decided to add another feature and we decided to add cost alerting where we’d get an email when we passed a certain threshold. That was really cool as we could budget and know when we were spending too much.”

“On the following weekend we started working on periodic alerts on how much we were spending over a set set time and from there the idea started to prosper, we thought ‘oh wow, we have a bit of a product going here. Let’s show some friends who also use AWS.’ From that feedback we found people wanted to keep the dashboards up and keep track of what was being spent.”

Today GorillaStack offers a service that allows companies to manage their AWS usage, something that can easily get expensive for organisations not closely watching what they are using. “What we try to do is make a cultural change where people become conscious of what is actually theirs in the cloud.” Elliott says. “We’re actually seeing that change.”

Living the culture

“In terms of that culture, we try to live that culture as well. We have private Slack channels with each of our customers so there’s a constant line of communication,” says Oliver. “Those Slack channels have proved to be an effective customer support and product development tool. “we’ve fostered quite a good community.”

With the initial hack being successful the company was formally founded in June 2015 and to date is bootstrapped, having not taken any investor’s money. “We want to get to a stage where we’re comfortable with the product,”says Oliver.

Currently the user base includes paid customers like Citrix, Bauer Media, Health Direct and the Australian Football League. “We have quite a good spread in terms of geography and mix of customers,” observer Oliver. “Right now the breadth suits us.”

Applying the freemium business model

Following the freemium model, the company also offers a free tier offering a single switch. “If you want anything more you move onto our paid tiers,” says Elliott.

To the question whether the company is looking at catering to other services such as Microsoft Azure or the Google Cloud, the dominance of AWS comes into play. “Right now we’re definitely sticking with the giant, we’re really looking at growing our capability so we do more and offer more to our existing customers,” says Elliott. “I think it’s really important to focus on delivering value to them and our business’ future,” Elliot says.

Looking to the immediate future, their focus is on extending their current customer offering. “We’ve a fair bit on our roadmap, we have a bit focus on chatops with a more in depth integration with Slack and Hipchat integration with our existing product,” says Elliott.

In talking to the Gorilla Stack founders, it’s striking just how the startup follows the classic tech model of a bootstrapped company that started by a bunch of hackers solving their own problem. How the business evolves will be fascinating to watch.

Paul travelled to AWS Re:Invent in Las Vegas as a guest of Amazon Web Services

Locking down the firmware of the internet of things

As the smart devices become common in our homes, cars and workplaces suppliers will have to do more to secure their software.

There’s a fundamental problem with smart devices warns Kim Zetter and Andy Greenberg in Wired magazine.

In Why Firmware Is So Vulnerable to Hacking, and What Can Be Done About It, Zetter and Green look at the problem with the embedded software that is shipped with every computerised device from Personal Computers to smart sensors.

The problem with firmware is that it’s difficult to check it’s not been changed, awkward to upgrade and complex to find, the Wired piece mentions how even the batteries in Apple laptops have vulnerable software embedded into their chips.

As the smart devices become common in our homes, cars and workplaces suppliers will have to do more to secure their software.

Will Sony ever learn its security lessons?

Once again Sony remind us of the importance of IT security.

For the last week the gossip and tech industry websites have been full of revelations gleaned from a massive hack into the network of entertainment company Sony.

Sadly it isn’t surprising that Sony that targeted in that hack, 2011 was described by this site as the ‘year of the hack’ and at the time I wondered when corporate managers would start taking IT security seriously.

As the most recent security breach shows, Sony’s managers certainly weren’t taking their information security seriously as alleged North Korean hackers gleefully disabled systems and downloaded confidential documents.

While Sony’s woes are deeply damaging to the company, not least for the executives caught out gossiping about movie stars, the stakes are far higher for other companies.

In Turkey its alleged a 2008 oil pipeline explosion was caused by Russian hackers while in the US, Palestinian sympathisers are accused of causing massive damage to the IT systems of the Sands Casino group.

Sony may be one of the most digitally incompetent business in history – at least in respect to IT security – but it’s important for every business to making sure their information systems and critical business systems are hardened against attacks.

Exploiting the weak points

The Great ATM Heist illustrates weaknesses in outsourcing business processes

The Great ATM Heist, where a crime gang subverted the credit card system, could well be the digital equivalent of the Great Train Robbery of the 1960s.

While the logistics of the operation are impressive with hundreds of accomplices across twenty countries, the real moral from the story comes from how the gang targeted outsourced credit card processing companies to adjust cash limits.

Again we see the risks of throwing your problems over the fence, a system is only as reliable or secure as the weakest link and, regardless of how tight commercial contracts are, outsourced services can’t be treated as someone else’s concern.

No doubt banks around the world will be having a close look at their systems and how they can trust other organisations’ outsourced operations.

702 ABC Mornings – Hacking 102

This month’s 702 Sydney tech spot looks at how security is evolving

A number of callers asked about protecting their Facebook pages and information from hackers and spammers. Details are on the Netsmarts webpage

On 702 Sydney Mornings with Linda Mottram, we’re revisiting security and how it affects businesses and consumers after some stories of serious security breaches in everything from shops to pacemakers.

We’re looking at some pretty important issues, including how four million hotel locks are open to hackers and thieves.

Even more scary is the risk that pacemakers can be hacked. This story is a cautionary tale on good intentions being bought undone by bad security practices.

For businesses, the risk of having customers’ credit card details hacked is a serious issue. Two years ago the US fast food chain Subway had a major breach when criminals managed to break into franchisees’ Point Of Sales systems.

Recently the Australian Federal Police broke up a similar crime gang operating out of Romania.

A misconception about computer security is that all hackers are evil. The reality is most aren’t and a good example of this is Random Hacks of Kindness where geeks get together to find ways of using tech to improve society. We’ll look at last weekend’s Melbourne event.

Join us on 702 Sydney from shortly after 9.30am. We’d like to hear your views, comments or questions so call in on 1300 222 702 or SMS on 0467 922 702 or tweet with @702Sydney in the message.

Strategic lessons from a security breach

What businesses can learn from Stratfor’s data lapse

2011 has been the year of the IT security breach. Big and small organisations around the world ranging from major corporations like Sony through to smaller businesses such as security analysts Stratfor found their customer data released onto the web.

The frustrating this is most of these breaches are avoidable and “hacking” is often giving too much credit for the security used by the targeted companies.

While the ‘hackers’ themselves may be skilled, the compromised organisations are often easy targets as they don’t follow the basic rules of protecting their data.

Standards matter

Customer payment account details are covered by the Payment Cards Industry -Data Security Standard (PCI-DSS) operated by the PCI Security Standards Council.

The PCI Security Standards Council helpfully has a range of information sheets for merchants of all sizes and if you are taking payments off the web you should make yourself aware of the basic requirements.

For most businesses, the cardinal rule is not to save customer’s card details. Once the payment is approved, you have no business retaining the client’s credit card or bank account numbers.

In Stratfor’s case, they were almost certainly processing payments manually and credit card details were being saved on customers’ records in case of errors or to make renewals easier.

Call in the professionals

There’s no shortage of payment companies, ranging from PayPal through specialist services like eWay to your own bank’s services. Choose the one that works best for you. If you have no idea, call in someone who does.

One of the arguments for using outsourced services, particularly cloud computing, is how data security is a complex field that requires professional and qualified expertise. The internal systems of Sony, Telstra and Stratfor were not up to the demands placed upon. A professional service is better equipped to deal with these issues.

Size doesn’t matter

A major lesson from the last year’s security breaches is that it’s not just the local shop or garage e-commerce business that is careless with data. Some of the world’s biggest companies and government agencies have been compromised.

If anything, Sony’s experience has shown the double standards at work in the application of security rules; there’s no doubt that had a local computer shop been as thoroughly compromised as Sony were, they would have been shut down on the second breach and the management would have been carted off to jail well before the twelfth.

For the management of Sony, there seems to have been little in the way of sanctions of the people nominally responsible for this incompetence. This has to change both within organisations and by those charged with enforcing the rules.

The lesson for customers is you can’t trust anyone with your data; don’t assume the big corporation is any more secure than the serving staff at your local sandwich shop.

Passwords matter

Every time one of these breaches happen we hear about password security, with “experts” pointing out that some of the subscribers were using passwords like ‘statfor’ or ‘password’.

For customers, this actually makes sense if you can’t trust third parties with your details so specific, disposable passwords for each site should be used. There’s little point in having a complex password if some script kiddie is going to post your login details onto 4Chan.

Naturally your passwords for banking and other critical websites should be very different and far more secure than those you use for sites like Stratfor and the Sony Playstation Network.

Will 2012 be any different?

Given the data embarrassments of 2012 for businesses and government agencies, can we expect lessons to be learned in 2012?

While many businesses are going to learn specific lessons from these breaches, there’s a management cultural problem where any spending on information systems is seen as a cost that has to be minimised.

This cost cutting mentality lies at the core at many organisations’ failure to secure their systems properly and until a more responsible culture develops we’ll continue to see these lapses.

Good managers and business owners who understand the importance of guarding their organisation’s and customer’s data are those who are ahead of their competition. Over time, these folk who will have the competitive advantage.

For customers, the sad lesson is we can’t trust anyone and a layered approach to security along with keeping a close eye on our bank accounts and credit card statements is necessary.