alt Hacker NewsA Blackstone real estate company exposed SSN digits, DOBs, addresses and more
Comments
I work for a company building real estate adjacent software and have worked on connections to all the major property management systems and large (and small) proptech companies. I can tell you that at least 90% of them have some of the worst security practices you've ever seen. Many of the largest property management systems allow a third-party vendor to export your Social Security number and date of birth, and most property managers I've seen don't bat an eye at giving up as much information as their vendor requests (which they usually don't need).
Real estate is very much a closed of group of more traditional business and has not begun to understand their responsibility to keep this data safe.
Edit for more detail: To tack onto this, it's very much the case we're all familiar with where management doesn't care about something being built correctly, they just want it built. Add on top that the management usually has no technical background. Also add that very few engineers that are passionate about writing good software want to stick around at these companies. It's a real nightmare industry.
There are some companies that will give you faith, but they're the occasional large property manager that's been scared shitless about a security based lawsuit (fine by me) or a proptech that's "disrupting" the industry that will be acquired by one of the big dogs in 18 months and slowly eroded away.
My biggest take away from this is not really anything about the specific security vulnerability, but rather that real estate industry people will buy any SaaS product without research or any due diligence.
I have personally seen real estate people buy some trendy new app based intercom or entry phone system and jam it onto the front of their building and try to require that all of the residents use it...
What a trashfire of a company. Where are the legal penalties for such reckless behavior?
I'm glad you did this, but be careful man. Dudes have been prosecuted (right? wtf?) for way less:
https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...
Hoping this doesn't happen to you!
Hah. This is nothing.
I know a blackstone company, who were a client of mine before they underwent a hostile takeover (blackstone fired everybody).
They claim to be ISO 27001 certified. They are not. They never removed me from their ISMS, and I can see it has not been touched in three years now.
Wait, it gets worse.
My root credentials still work, both for the app, and for AWS. Nobody has logged into AWS in years (hey, we built a reliable system).
I have unfettered access to highly sensitive (in some cases literally classified) commercial data for the likes of Apple, Siemens, Philips, BAE Systems, Raytheon, and more.
Wait, it gets worse.
They did something to the API endpoint. You can now bypass authentication entirely and anyone has access to this data.
Anyway. Bunch of shysters. Incompetent shysters.
Beam Living is just the property management company that runs buildings Blackstone owns in New York City. There are thousands of companies like this all over the country and if you poke hard at any of them you will find stuff like this.
There's nothing wrong with pitching stories this way, but for context, if you look at this researcher's archive, they're all basically "I found a vulnerability in some big company's thingy". The news hook here is literally just "I found a GraphQL bug". This is not Alex Schapiro's most interesting front-page story (by which I mean: they've posted some genuinely interesting stuff before).