4 ms·

Say there's two tables, users and user_preferences. Someone goes in, takes the contents of users (hashes and salts and all). Only some of the user information w

• cyberferret 10y ago
  I get it about normalised data spread across multiple tables - but usually (from how I interpret it), they seem to be talking about number of rows - i.e. "We think only 10,000 users had their information compromised...". I believe in the case of the LinkedIn breach, they said that something like "less than 20% of their user passwords were leaked". I take that to mean that not all rows were exposed, but only some - that's why I am intrigued as to whether the query was shut off mid stream, or the bulk download of exported data was detected and cut off or similar?
  • arnaudlaudwein 10y ago
    This is the case when attackers don't get access to the database itself - imagine they were able to listen to connections between users and front-end servers, and extracted authentication information. This would only concern users connecting during a specific timeframe. In this post for instance, they indicate that attackers got 'sync users’ passwords' while storing only 'encrypted/hashed data'. Other possibilities: they accessed a partial backup (or prod data used in dev), a caching system, a message broker (Kafka)...