7 ms·

Dell announces security breach

66 points by frdmn 8y ago

abo2t 8y ago
It's insane that companies are allowed to say "yes there was a security hole, but no we don't have logs, therefore nothing was stolen, so stop asking." Their refusal to give the number of exposed accoundlts makes it seem like it's pretty bad.
ndrake 8y ago
From https://www.dell.com/customerupdate https://www.dell.com/customerupdate What is a “hashed password”? Hashing is a cryptographic security mechanism, similar to encryption, that scrambles customers’ passwords into an unreadable format. Dell ‘hashes’ all Dell.com customer account passwords prior to storing them in our database using a hashing algorithm that has been tested and validated by an expert third-party firm. This security measure limits the risk of customers’ passwords being revealed if a hashed version of their password were to ever be taken.
- NoPicklez 8y ago
  They've provided some pretty reasonable information. Not just, your account details are safe.
  - shakna 8y ago
    To me, it looks like just 'Your account details are safe.' > Additionally, Dell cybersecurity measures are in place to limit the impact of any potential exposure. These include the hashing of our customers’ passwords and a mandatory Dell.com password reset. Hashed, how? Still using MD5? Is there even a salt? Verified, by whom? Tim's brother-in-law's new startup who have no security expert staff? Verified as in had the encryption technique tested for collisions? That Dell were using it in the correct manner? Or just, 'Hey, I know that library, it works if you use it right.' > Dell also retained a digital forensics firm to conduct an independent investigation Who? Is this just someone who will tick boxes? Or is it a group who know what they're doing? Or were they just hired by marketing based on a pretty website? > We are disclosing this incident now based on findings communicated to us by our independent digital forensics firm about the attempted extraction. Wait... This investigation has already been done? Okay... They would have told you a hell of a lot more than you're telling us... So we can't look forward to more information? > Though it is possible some of this information was removed from Dell’s network, our investigations found no conclusive evidence that any was extracted. > Credit card and other sensitive customer information was not targeted. One cannot be said conclusively, whilst the other can... Why? Tell us that CC data is kept separately, and tell us it is safe too. Just saying it's hashed doesn't mean bupkus, so feel free to say it publicly, you reveal nothing about your security features. > The potentially extracted customer information is limited to names, email addresses and hashed passwords. There is no conclusive evidence any customer information was extracted. Additionally, Dell cybersecurity measures are in place to limit the effects of a potential exposure. What additional cybersecurity measures? If the data is gone, it's in the wind. Names, and emails and possibly-breakable passwords. Are you talking about how you closed the hole? Then say how you accidentally exposed your victims. --- Finally, before anyone says that this is an excessive amount of information for Dell to give out... It's what other tech companies relay in their post-mortems. [0] All this is, is Dell admitting they had a problem. Not saying what that problem was, and not saying what they're doing to prevent it in future. And assuring their victims that they're taking care of them, despite their victims possibly sitting on lost information (a password, possibly in the wild) for nearly a month. [0] https://github.com/danluu/post-mortems https://github.com/danluu/post-mortems
- xoa 8y ago
  Bleh. Maybe it's too much to hope for a company like that to give any specifics but that's pretty empty by itself. I mean, great, they didn't use plain text(!), but "MD5 with no salt" would fit that blurb just fine too. I really hope Dell was properly using an adaptive hash, but usually when companies do a good job there they want to tout it because it does in some small way show they care somewhat despite the breach. Even if it should be the norm saying "we used bcrypt with 65k+ rounds" or whatever is legitimately reasonable to put in there.
  - tialaramex 8y ago
    It seems like they could add a parenthetic which is more specific to help those of us who actually understand the question gauge for others who ask. As it stands if my mother asked whether this means her password is protected, my answer realistically is "No". Her passwords are not great (it is, after all, not a great sign that I'm saying "her passwords" meaning I know what they are) but they're not in the Pwned Passwords list for example, still a reasonable brute force of MD5 would get most of them. Whereas if they said they had even a crummy salted and pessimised hash, say PHK-MD5-crypt, I'd feel comfortable saying that "Yes", nobody is going to break her password. Which isn't to say nobody could in theory, just that salt means they'd need to target her and pessimisation means it'd cost money, and so why her? I guess the reason not to is that it invites Monday Morning Quarterbacks. "Oh, why did they use PBKDF2 with this many rounds? Why not Bcrypt? Why not not Argon2?" and so on.
Already__Taken 8y ago
Dell's been an open book for years. One piece of spam I've got on a brand new email account was ~1 day after ordering a brand new XPS. It was a fake tracking code email about my dell order with correct details like laptop, account name, price. I contacted dell and only managed to find out my order wasn't even in the post yet. They weren't interested in anything. And I also never got any more than that specific 1 piece of spam.
- logicallee 8y ago
  What makes you think Dell didn't send it? I get that the tracking code was fake but what else? (Example: direct link to a phishing site.)
- lostgame 8y ago
  Out of curiosity, how did you/did you confirm it was a fake?
  - Already__Taken 8y ago
    The tracking number was a zipfile I have to run a program to get. I messaged Dell to confirm who they ship with, who said it's not in the post yet. Once another tracking number came in a week or so it was from dell since it had more branding and did actually contain just a number and did work in the shipping companies website.
- acct1771 8y ago
  Have read stories about Dell support members out of the US doing these scams using their privileged info.
tyingq 8y ago
Dell redirected the vulnerability press release link to a Christmas Deals page. Heh.
- lostgame 8y ago
  Oh. Wow. That's just awful.
donaltroddyn 8y ago
If software development was a true profession, then I firmly believe that many developers would be struck off for extreme negligence or incompetence. I’ve found and reported serious security vulnerabilities to many companies that I’ve worked with, and become very disillusioned with some of the responses. Companies that operate in fields which materially affect people's lives (such as healthcare, finance and telecoms) will deploy software that is so badly designed that there is often no need to break any technical aspect to get access to private and sensitive data. Yet, when I report a breach, the same people who deployed software with broken (or sometimes no) authorisation models, access control, etc, are suddenly competent enough to investigate their own failure. Invariably, they always have perfect logging and reporting that could not possibly have been evaded and which proves that no breach occurred or data was exfiltrated before the vulnerability was reported. If another professional, say an engineer, lawyer, or doctor, had demonstrated the incompetence or negligence in their field that I’ve seen some software developers display (sometimes wilfully - “It’s a feature”), they would never be allowed to work again. Software is now so important that I believe that some of the developers and technical leaders that I have dealt with in resolving security vulnerabilities should never again be allowed to work with software that interacts with personal or sensitive data (or, more generally, with software that could affect human life, safety, or privacy).
- benzoate 8y ago
  I agree emphatically, and it’s why I’m a member of the BCS (British Computing Society). It’s absurd that we have people building essential public infrastructure with close to no repercussions when their failure screws people over.
  - iamben 8y ago
    Controversial opinion, but I'd have little problem with Google (for instance) having anonymised access (and obviously there is _a LOT_ of caveats here) to medical data (again, for instance) in exchange for digitising the NHS (again, for instance). At least you'd have some assurances it worked and was secure. The amount of low ball quotes for government work that I've seen or heard of that go over budget or barely work is a little worrying. I've also seen teams of developers that are by no means first rate; it's little surprise we end up with these failures.

66 points by frdmn 8y ago

It's insane that companies are allowed to say "yes there was a security hole, but no we don't have logs, therefore nothing was stolen, so stop asking." Their refusal to give the number of exposed accoundlts makes it seem like it's pretty bad.

ndrake 8y ago

From https://www.dell.com/customerupdate https://www.dell.com/customerupdate What is a “hashed password”? Hashing is a cryptographic security mechanism, similar to encryption, that scrambles customers’ passwords into an unreadable format. Dell ‘hashes’ all Dell.com customer account passwords prior to storing them in our database using a hashing algorithm that has been tested and validated by an expert third-party firm. This security measure limits the risk of customers’ passwords being revealed if a hashed version of their password were to ever be taken.

NoPicklez 8y ago
They've provided some pretty reasonable information. Not just, your account details are safe.
- shakna 8y ago
  To me, it looks like just 'Your account details are safe.' > Additionally, Dell cybersecurity measures are in place to limit the impact of any potential exposure. These include the hashing of our customers’ passwords and a mandatory Dell.com password reset. Hashed, how? Still using MD5? Is there even a salt? Verified, by whom? Tim's brother-in-law's new startup who have no security expert staff? Verified as in had the encryption technique tested for collisions? That Dell were using it in the correct manner? Or just, 'Hey, I know that library, it works if you use it right.' > Dell also retained a digital forensics firm to conduct an independent investigation Who? Is this just someone who will tick boxes? Or is it a group who know what they're doing? Or were they just hired by marketing based on a pretty website? > We are disclosing this incident now based on findings communicated to us by our independent digital forensics firm about the attempted extraction. Wait... This investigation has already been done? Okay... They would have told you a hell of a lot more than you're telling us... So we can't look forward to more information? > Though it is possible some of this information was removed from Dell’s network, our investigations found no conclusive evidence that any was extracted. > Credit card and other sensitive customer information was not targeted. One cannot be said conclusively, whilst the other can... Why? Tell us that CC data is kept separately, and tell us it is safe too. Just saying it's hashed doesn't mean bupkus, so feel free to say it publicly, you reveal nothing about your security features. > The potentially extracted customer information is limited to names, email addresses and hashed passwords. There is no conclusive evidence any customer information was extracted. Additionally, Dell cybersecurity measures are in place to limit the effects of a potential exposure. What additional cybersecurity measures? If the data is gone, it's in the wind. Names, and emails and possibly-breakable passwords. Are you talking about how you closed the hole? Then say how you accidentally exposed your victims. --- Finally, before anyone says that this is an excessive amount of information for Dell to give out... It's what other tech companies relay in their post-mortems. [0] All this is, is Dell admitting they had a problem. Not saying what that problem was, and not saying what they're doing to prevent it in future. And assuring their victims that they're taking care of them, despite their victims possibly sitting on lost information (a password, possibly in the wild) for nearly a month. [0] https://github.com/danluu/post-mortems https://github.com/danluu/post-mortems
xoa 8y ago
Bleh. Maybe it's too much to hope for a company like that to give any specifics but that's pretty empty by itself. I mean, great, they didn't use plain text(!), but "MD5 with no salt" would fit that blurb just fine too. I really hope Dell was properly using an adaptive hash, but usually when companies do a good job there they want to tout it because it does in some small way show they care somewhat despite the breach. Even if it should be the norm saying "we used bcrypt with 65k+ rounds" or whatever is legitimately reasonable to put in there.
- tialaramex 8y ago
  It seems like they could add a parenthetic which is more specific to help those of us who actually understand the question gauge for others who ask. As it stands if my mother asked whether this means her password is protected, my answer realistically is "No". Her passwords are not great (it is, after all, not a great sign that I'm saying "her passwords" meaning I know what they are) but they're not in the Pwned Passwords list for example, still a reasonable brute force of MD5 would get most of them. Whereas if they said they had even a crummy salted and pessimised hash, say PHK-MD5-crypt, I'd feel comfortable saying that "Yes", nobody is going to break her password. Which isn't to say nobody could in theory, just that salt means they'd need to target her and pessimisation means it'd cost money, and so why her? I guess the reason not to is that it invites Monday Morning Quarterbacks. "Oh, why did they use PBKDF2 with this many rounds? Why not Bcrypt? Why not not Argon2?" and so on.

Already__Taken 8y ago

Dell's been an open book for years. One piece of spam I've got on a brand new email account was ~1 day after ordering a brand new XPS. It was a fake tracking code email about my dell order with correct details like laptop, account name, price. I contacted dell and only managed to find out my order wasn't even in the post yet. They weren't interested in anything. And I also never got any more than that specific 1 piece of spam.

logicallee 8y ago
What makes you think Dell didn't send it? I get that the tracking code was fake but what else? (Example: direct link to a phishing site.)
lostgame 8y ago
Out of curiosity, how did you/did you confirm it was a fake?
- Already__Taken 8y ago
  The tracking number was a zipfile I have to run a program to get. I messaged Dell to confirm who they ship with, who said it's not in the post yet. Once another tracking number came in a week or so it was from dell since it had more branding and did actually contain just a number and did work in the shipping companies website.
acct1771 8y ago
Have read stories about Dell support members out of the US doing these scams using their privileged info.

tyingq 8y ago

Dell redirected the vulnerability press release link to a Christmas Deals page. Heh.

lostgame 8y ago
Oh. Wow. That's just awful.

donaltroddyn 8y ago

If software development was a true profession, then I firmly believe that many developers would be struck off for extreme negligence or incompetence. I’ve found and reported serious security vulnerabilities to many companies that I’ve worked with, and become very disillusioned with some of the responses. Companies that operate in fields which materially affect people's lives (such as healthcare, finance and telecoms) will deploy software that is so badly designed that there is often no need to break any technical aspect to get access to private and sensitive data. Yet, when I report a breach, the same people who deployed software with broken (or sometimes no) authorisation models, access control, etc, are suddenly competent enough to investigate their own failure. Invariably, they always have perfect logging and reporting that could not possibly have been evaded and which proves that no breach occurred or data was exfiltrated before the vulnerability was reported. If another professional, say an engineer, lawyer, or doctor, had demonstrated the incompetence or negligence in their field that I’ve seen some software developers display (sometimes wilfully - “It’s a feature”), they would never be allowed to work again. Software is now so important that I believe that some of the developers and technical leaders that I have dealt with in resolving security vulnerabilities should never again be allowed to work with software that interacts with personal or sensitive data (or, more generally, with software that could affect human life, safety, or privacy).

benzoate 8y ago
I agree emphatically, and it’s why I’m a member of the BCS (British Computing Society). It’s absurd that we have people building essential public infrastructure with close to no repercussions when their failure screws people over.
- iamben 8y ago
  Controversial opinion, but I'd have little problem with Google (for instance) having anonymised access (and obviously there is _a LOT_ of caveats here) to medical data (again, for instance) in exchange for digitising the NHS (again, for instance). At least you'd have some assurances it worked and was secure. The amount of low ball quotes for government work that I've seen or heard of that go over budget or barely work is a little worrying. I've also seen teams of developers that are by no means first rate; it's little surprise we end up with these failures.