7 ms·
Zomato security breach: 17M email addresses and hashed passwords leaked
- subsidd 9y agoLack of which security measures might lead to this?
- crivabene 9y agoIn the post they mention the probable cause is a developer account which got compromised. One of the most important rules of most security frameworks (including PCI DSS) is segregating access between development and production: developers are not supposed to be able to access production data. I suppose this rule was not followed here - or an alternative mitigating control (which can be applied instead of the rule above) was not good enough to prevent this.
- dvfjsdhgfv 9y agoZomato is almost 10 years old, hardly a "startup".
- shubhamjain 9y agoIt won't be appropriate to paint every Indian company with the same brush, but I knew one that was in a professional spamming business who slyly marketed themselves as an "email marketing company". The business model was to — 1) Lure employees of big companies (especially e-commerce ones) with cash and buy email dumps of their users. I don't think email security was something many companies were vigilant about. 2) Send email campaigns for their clients, which included other e-commerce companies, colleges, and travel agencies. The business, as I remember, was quite profitable. I can't say if something like this is at work here but there's a healthy black market of buying email lists.
- flukus 9y ago> I can't say if something like this is at work here but there's a healthy black market of buying email lists. There's a healthy 100% legitimate (legally) market too. They correlate data from all sorts of retailers with things like your bank account, email address, etc. Pay cash for anything you'd be embarrassed about someone finding out.
- throwaway32414 9y agoSomeone who owned and operated a globally blacklisted spam company came to power in Delhi, ironically on an "anti-corruption" message. Ethics aren't part of contemporary social contracts in India. See "Somnath (Spamnath ?) Bharati".
- CarMaker 9y agoCome on, please don't single him out. Who will pay attention to the drama queen?
- rishabhd 9y agoI can relate to that. I know multiple firms in NCR who operate on a model like that. Mass email campaigns, promotions and spam - undertaken from offshore servers hosted on shady ISPs based on data like this. I can bet this data has been made available to them and it has been already put in use.
- Buge 9y ago>The hashed password cannot be converted/decrypted back to plain text - so the sanctity of your password is intact in case you use the same password for other services. What? Hashed passwords can definitely be cracked for a significant percent of users.
- kirankuppa 9y agoIf they are simply hashed, rainbow tables can be used to crack them. Password must be salted preferably using bcrypt or something equivalent.
- Buge 9y agoA rainbow table is not necessary to crack passwords, and is not able to crack all passwords (even if not salted). And even if salted, a regular (non-rainbow table) attack will crack some passwords.
- Jackalopiate 9y agoThey state thatthey weresaltedin the blog post, however, they do not specify through what method.
- redditmigrant 9y agoThey should mention if the passwords were salted or not. Just saying the passwords were hashed isnt sufficient.
- wapz 9y ago> we encourage you to change your password for any other services where you are using the same password Based on that statement it sure doesn't sound like the PWs were salted (or at least properly salted).
- deleted 9y ago[deleted]
- wapz 9y agoSo can someone explain to me why the downvotes? If the salts are unique to the user wouldn't it be nearly impossible for the hacker to use the hashed pw on other sites? (I'm not a web dev but to my understanding that's how it works)
- ktta 9y agoEven if salts are unique to a single user, there's still a possibility where someone determined can get the password. That's because the user specific salts were probably in the same db. This will make it difficult since a brute force attack must be done for every single password. But it is still not impossible.
- sudshekhar 9y ago> If the salts are unique to the user wouldn't it be nearly impossible for the hacker to use the hashed pw on other sites Even if the salts aren't unique, can you explain how can they use the hashed password anywhere? If I give you a hashed password and the salt used, what exactly can you do with it? (apart from brute forcing)
- MichaelGG 9y ago
- flukus 9y agoThat'll teach them to outsource development to Africans making a third the wage!
- deleted 9y ago[deleted]
- kbart 9y agoIf you provided more information and facts (if it's really true) on this matter besides emotional accusation, you'd get upvotes instead of downvotes.
- breeze_em_out 9y agoIrrelevant, since he's correct. I've actually known an ex-Zomato employee who's said the same thing, this is the first time I've heard strangers mention it though. Upvotes do not determine if information is true or not, and there's plenty of people out there who aren't the least bit concerned with whether or not HN upvotes them. Tangentially, I don't think outsourcing is really that big of a deal. LOTS of companies do it, and it's easy to get bitten by it, but it's also easy to check over what they bring back, as well. I'm not trying to make a case for excusing this incident, as they could have very easily dedicated some dev time to quality check the code (if it's the code that they outsourced in the first place, which we don't know for sure or not) so there's really no excuse for it. People in the states outsource to india, people in india outsource to africa or south america, people in africa probably have some place they outsource to, maybe china or something. It's an economical oddity, not a moral dilemma, imo.
- buyx 9y agopeople in africa probably have some place they outsource to, maybe china or something Companies in South Africa outsource to India quite often. Africa is huge, and hard to generalise about.
- flukus 9y ago> Irrelevant, since he's correct. Purely coincidental, it was a joke like we normally hear about outsourcing to India.
- hoodoof 9y agoSuch notifications are becoming routine. Seems to me that you need to design your systems around the question of "how can the problem be minimised when our systems get hacked".
- ktta 9y agoMany people came to the same conclusion during the WannaCry malware attack. I'd suggest taking a look at those threads fpr related discussion.
- csmattryder 9y ago"We really need to invest in technical security" - Everyone after WannaCry "We really need to invest in technical security" - Everyone after Heartbleed If the end-user doesn't notice it, it's barely budgeted for by the business bods. We're condemned to repeat history, much to my own chagrin.
- fowl2 9y agoI did not know that Zomato was Indian.. nor am I quite sure why it matters that they are? Breaches are common everywhere and at least these guys (apparently) salt, etc.
- hoodoof 9y agoYes, a little bit of salt on your Zomato makes it much more palatable.
- namanyayg 9y agoPuts the 17m into a more appropriate scale, imo.
- denzil_correa 9y ago> at least these guys (apparently) salt, etc It seems the salt was stored in the database itself. https://twitter.com/sajal_thomas/status/865134165288599553 https://twitter.com/sajal_thomas/status/865134165288599553
- Confiks 9y agoI don't see anything in that Twitter thread indicating where the salt was stored, but salts are actually supposed to be stored next to the password hash. They purely try to prevent precomputation of password hashes by introducing a random value per password, and that works just fine by putting them next to the hash. Today, of course you shouldn't be manually maintaining salts and instead use a proper PBKDF (which indeed uses a salt, which is stored alongside the hash).
- easilyBored 9y agoWe need password managers and use unique 20 digit password (or max allowed) for each login. If it's online, we need to assume that it will be hacked in time.
- albeva 9y agoFrankly this is to be expected when "developers" working on these projects tend to be script kiddies more concerned with UX/design rather than solid architecture engineering. When backends are thrown together as an afterthought in node, piled in bunch of 3rd party services and things just hacked together ... well this is exactly results one would expect.
- Sujan 9y agoSaying this in this way is very impolite.
- instakill 9y agoDoesn't make it any less true.
- TassSinclair 9y agoI'm not convinced that you read the article properly. You're making projections about their infrastructure without having all of the facts.
- thewhitetulip 9y agoYou should read the reddit AMA done by the Zomato CEO, it'll give nice insight into how the company works :)
- helb 9y agoHeh, thanks for that. It's two years old, but certainly worth reading: https://www.reddit.com/r/india/comments/2yo614/hi_im_deepinder_goyal_founder_and_ceo_of_zomato/ https://www.reddit.com/r/india/comments/2yo614/hi_im_deepind... > Do you really expect a good developer to be able to be in the zone for 12 hours straight? > Why would we contribute to open source if we are barely able to ship what we need to ship to keep our users happy.
- 9y ago
- narsil 9y agoI'm curious about how the hack occurred. With the recent Hipchat hack, it is unclear if the login server was compromised or the database dump was obtained some other way. If the Hipchat webserver that handles sign-in attempts was the one compromised, which is what I've been lead to believe, then it doesn't matter how the passwords were hashed. The plain-texts would be exposed in the majority of use cases. Sure, the DB data could also get stolen triggering reporting requirements in organizations with controls, but that may be less of a concern at that point.
- vasco 9y agoDevelopment environments with access to live data. Tasty!
- kobayashi 9y agoAre the hashed passwords salted? If not, then the claim that the "password cannot be converted/decrypted back to plain text" is not defensible. Either way, including such an unclear statement in a security notice is troubling.
- rocgf 9y agoDid you even read the post? It clearly says: "We hash passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password."
- mkagenius 9y agoWhy do they say this then: > We however, strongly advise you to change your password for any other services where you are using the same password.
- 83457 9y agoIt is standard practice to include such a statement. If they said you were safe based on their practices, then it turned out there was a bug in their code or a library that exposed you, that would be really really bad.
- MichaelGG 9y agoSalting is irrelevant to making such a statement. For instance, some users probably have their password set to "zomato1234" or "passw0rd" or (anything in the next 10000+ most common password patterns). Salted or not, it's very feasible to perform that kind of analysis on the leaked data, find weak passwords, then use them with that user's account on other sites.
- 83457 9y agoIt is standard practice to include such a statement. If they said you were safe based on their practices, then it turned out there was a bug in their code or a library that exposed you, that would be really really bad.
- alexellisuk 9y agoOne of the key issues with this type of leak is where people use the same password in multiple sites (check out the data in https://haveibeenpwned.com https://haveibeenpwned.com as an example). They should recommend resetting the passwords they used at Zomato in any other apps/sites.
- beefsack 9y agoWhenever a company says "one way hashing algorithm" without specifying the algorithm, we should all assume it's MD5.
- thisisit 9y agoCouple of things are pretty apparent from the post: 1. Why would compromised developer account cause such a hack? Unless they don't have proper data control in place for production access. 2. The line about how "payment" related information is under PCI DSS compliant shows how these guys are running their business. I frequently see people, who are confronted about not following some form of compliance or hack, argue back on "segregation" of compliance. They say - X data needs (or was) to be compliant while Y doesn't. Sure not everything needed to be PCI DSS compliant but why not have better practices? 3. What about PII (Personally identifiable information) data they collect? Isn't that supposed to be rigorously protected? It seems they believe only payment and passwords are of use to hackers.
- intrepidkarthi 9y ago"A layer of authorisation will be added for internal teams having access to this data to avoid the possibility of any human breach." -- First of all it is not hacked. Data is just stolen by someone internally. Above statement proves that. And they are not a startup.
- intrepidkarthi 9y ago"A layer of authorisation will be added for internal teams having access to this data to avoid the possibility of any human breach." -- First of all it is not hacked. Data is just stolen by someone internally. Above statement proves that. And they are not a startup.
- mdekkers 9y agosigh I really wish these kind of notifications became a lot clearer about what actually happened and what the user is supposed to do. Their message is: (Ignoring the update on top): - Para. 1: Marketing bullshit - Para. 2: Short blurb about what happened - Para. 3: Incomprehensible techno-babble for the average user of their service, ending with an important action point (however, I suspect most users' eyes would have glazed over by now) - Para. 4: A random note, again with important info in the tail. - Para. 5: Something about what they have done that will cause user impact, mixed with some more about their internal remediation, and the suspected cause. It goes on, but I'm already bored. Instead they should clarify their format: - There has been an incident that resulted in an unknown 3rd party getting hold of your email address for this site, and a scrambled version of your password. This may impact you in the following ways: -- There is a strong possibility that the thieves will be able to unscramble your password. --- If you use the same password here as you do with other websites, you should change your password on all those websites immediately See the end of this notice for more assistance and information. -- We will automatically change your password for our site, and this means you will have to [insert process] - We are taking the following steps to ensure this isn't going to happen again: -- Step 1 -- Step 2 - We have reported this incident to the relevant authorities. - For the next x months we will contract with service y to track if any of the stolen data will surface, and will inform you if this happens. - We recommend that you use a password manager. please see [link] for a handy guide on how to choose and get started with a password manager. - You can always reach us via [channels] to discuss this issue further. If any part of this message isn't clear, please click [here] to chat with one of our support staff. - Apology. - More background details, etc.
- parimm 9y agoThey used a 2 alpha character salt with md5 as the hash algorithm. Thats pretty bad
- parimm 9y agoThey used a 2 alpha character salt with md5 as the hash algorithm. Thats pretty bad