3 ms·

As someone who isn't versed in security issues, can anyone explain how security breaches like this one (and Adobe etc.) occur? I'm assuming (and I may be compl

As someone who isn't versed in security issues, can anyone explain how security breaches like this one (and Adobe etc.) occur? I'm assuming (and I may be completely wrong) that some kind of software monitors if the database of customer details is being downloaded. If a download is detected, an alert is issued. Does software like this exist? Or there other measure that guard against these data breaches?

icebraining 10y ago
I'm not a security expert either, but I doubt most companies have anything like that running. Many leaks happened through the site itself, which is expected to be able to access and present that data, and even if the attacker transfers an actual file, it's fairly easy to encrypt it beforehand. There is some software that can detect an anomaly in the regular pattern of network usage, and possibly even cut the connection, but again, I'm not sure how effective they would be here. In any case, considering they were using unsalted SHA-1 hashes of the passwords, which was well known to be a poor practice, you should probably assume they had very little protections.
Coincoin 10y ago
You don't necessarily need to get your hands on the actual database. You can also obtain the data through a side channel such as debug pages or errors messages being a little bit too generous with information.
tomc1985 10y ago
a) Basically the cracker acquires access to parts of LinkedIn's database that store user login details, including scrambled versions of passwords. Unfortunately, the algorithm used to do the scrambling is easy to undo. Since the dump is/was being circulated in the underground, anyone with a copy of it and a little bit of time can presumably unscramble the whole list, revealing all passwords stored at the time the dump was generated. Given that so many use the same login/password for multiple sites... b) There is software (intrusion detection systems/software, or IDS) that does that, but it is rarely present by default. The hows and whys of IDS can be difficult for non-security types to grok, and it can be costly in terms of time, equipment, and money, so it often not encountered.

icebraining 10y ago

I'm not a security expert either, but I doubt most companies have anything like that running. Many leaks happened through the site itself, which is expected to be able to access and present that data, and even if the attacker transfers an actual file, it's fairly easy to encrypt it beforehand. There is some software that can detect an anomaly in the regular pattern of network usage, and possibly even cut the connection, but again, I'm not sure how effective they would be here. In any case, considering they were using unsalted SHA-1 hashes of the passwords, which was well known to be a poor practice, you should probably assume they had very little protections.

Coincoin 10y ago

You don't necessarily need to get your hands on the actual database. You can also obtain the data through a side channel such as debug pages or errors messages being a little bit too generous with information.

tomc1985 10y ago

a) Basically the cracker acquires access to parts of LinkedIn's database that store user login details, including scrambled versions of passwords. Unfortunately, the algorithm used to do the scrambling is easy to undo. Since the dump is/was being circulated in the underground, anyone with a copy of it and a little bit of time can presumably unscramble the whole list, revealing all passwords stored at the time the dump was generated. Given that so many use the same login/password for multiple sites... b) There is software (intrusion detection systems/software, or IDS) that does that, but it is rarely present by default. The hows and whys of IDS can be difficult for non-security types to grok, and it can be costly in terms of time, equipment, and money, so it often not encountered.