3 ms·

They didn't exactly hack Marriott. They hacked Starwood, which had been bought by Marriott. I don't mean to nitpick but there are far more Marriott guests than

They didn't exactly hack Marriott. They hacked Starwood, which had been bought by Marriott. I don't mean to nitpick but there are far more Marriott guests than Starwood guests.

verst 7y ago
The Marriott system is still riddled with vulnerabilities. Had someone transfer 200,000 points out of my account recently. No way they stole my session cookie, and the password was very complex, unique to Marriott and generated / stored by LastPass. There was no attempt to change my password. Now what's interesting is that the points to airline infrastructure likely is a SPG legacy backend that is still running.
- ycombonator 7y ago
  Woah. 200,000 points. Thats a lot of stays and or purchases. Did they acknowledge the theft ?
- sneak 7y ago
  Most people who have workstation malware are unaware of the fact that they have workstation malware.
  - zrobotics 7y ago
    So assuming that his machine is compromised, the first method of attack was Marriott points? Sounds shockingly similar to the responses I got in a similar situation with my Bethesda.net account getting hacked. Again, complex PW from a manager. How likely is it that if someone gained access to that vault or my PC the first thing they would attack would be an account which only lets them gain access to a garbage fallout game and not my email/social media/bank account? Considering the large amount of points in OP's Marriott account, I highly doubt that was the highest-value target available. Considering it's already known that parts of their network were compromised, Occam's razor points to this being a vuln on the hotel's end.
    - bouncycastle 7y ago
      Sounds like they would be specifically targeted. It could be mailware that's delivered over the hotel's wifi or perhaps the maids dropping mailware on unattended laptops? If Marriott investigates this, they should look if similar incidents happened and correlate them with recent stays.
WillPostForFood 7y ago
Far fewer is still: 343 million customer records, 25.55 million passport numbers (5.25 million in plaintext), 8.6 million encrypted payment cards. https://www.reuters.com/article/us-marriott-intnl-cyber/marriott-cuts-estimate-on-size-of-massive-starwood-hack-idUSKCN1OY13K https://www.reuters.com/article/us-marriott-intnl-cyber/marr...

They didn't exactly hack Marriott. They hacked Starwood, which had been bought by Marriott. I don't mean to nitpick but there are far more Marriott guests than Starwood guests.

verst 7y ago

The Marriott system is still riddled with vulnerabilities. Had someone transfer 200,000 points out of my account recently. No way they stole my session cookie, and the password was very complex, unique to Marriott and generated / stored by LastPass. There was no attempt to change my password. Now what's interesting is that the points to airline infrastructure likely is a SPG legacy backend that is still running.

ycombonator 7y ago
Woah. 200,000 points. Thats a lot of stays and or purchases. Did they acknowledge the theft ?
sneak 7y ago
Most people who have workstation malware are unaware of the fact that they have workstation malware.
- zrobotics 7y ago
  So assuming that his machine is compromised, the first method of attack was Marriott points? Sounds shockingly similar to the responses I got in a similar situation with my Bethesda.net account getting hacked. Again, complex PW from a manager. How likely is it that if someone gained access to that vault or my PC the first thing they would attack would be an account which only lets them gain access to a garbage fallout game and not my email/social media/bank account? Considering the large amount of points in OP's Marriott account, I highly doubt that was the highest-value target available. Considering it's already known that parts of their network were compromised, Occam's razor points to this being a vuln on the hotel's end.
  - bouncycastle 7y ago
    Sounds like they would be specifically targeted. It could be mailware that's delivered over the hotel's wifi or perhaps the maids dropping mailware on unattended laptops? If Marriott investigates this, they should look if similar incidents happened and correlate them with recent stays.

WillPostForFood 7y ago

Far fewer is still: 343 million customer records, 25.55 million passport numbers (5.25 million in plaintext), 8.6 million encrypted payment cards. https://www.reuters.com/article/us-marriott-intnl-cyber/marriott-cuts-estimate-on-size-of-massive-starwood-hack-idUSKCN1OY13K https://www.reuters.com/article/us-marriott-intnl-cyber/marr...