7 ms·
7M Adobe Creative Cloud Accounts Exposed to the Public
- codyogden 7y agoAnother day, another major company exposing a huge trove of user data. Will GDPR be at play here since the data was exposed?
- libertine 7y agoIf it was in EU ground and/or involved EU citizens, for sure something will happen.
- anon1m0us 7y ago> Comparitech conducts security research that entails scanning the web for exposed databases. When we uncover a database that hasn’t been properly secured and allows unauthorized access, we immediately notify the owner. Germany, the government, does this. They routinely scan systems in Germany and alert the owners to security issues. I wonder if this is something all governments should do. I'm not convinced yet, but heavily leaning toward that it is something governments should do. Exposed servers are a national security risk. They are a risk to public safety. Governments are there to protect their citizens.
- colejohnson66 7y agoAre we sure the governments don’t already do this? The difference between the US and Germany is that the NSA doesn’t alert the company there’s a security hole. The NSA has been found multiple times to be exploiting exploits under the pretenses of catching terrorists. Arguably, by not telling companies about holes in their systems, they are doing the exact opposite of what they were founded to do: secure the US.
- sargun 7y agoThe FBI does this in the US.
- deleted 7y ago[deleted]
- K0SM0S 7y agoIt's generally the thing to do, whether governement or lone programmer —security is a collective matter, bigger than us. Just like we notify people when there's a fire hazard, we don't just stand idle when many people are at risk of something.
- colejohnson66 7y agoA problem arises when you notify them they have a security hazard: they either ignore it, or threaten a lawsuit if you don’t shut up.
- AnthonyMouse 7y agoSome government -- anywhere in the world -- should offer a responsible disclosure service. You disclose to them a vulnerability, anonymously (e.g. via Tor) if you prefer, then they notify the target and impose a reasonable remediation deadline before publication. And then they would all do it because everyone would prefer that they rather than a foreign government are the ones holding 0-days during the remediation period.
- ipsa 7y agoIn the Netherlands there is the NCSC (National Cyber Security Centre). They also scan the internet: It continuously monitors all (potentially) suspect sources on the internet. When it identifies a threat (such as a virus or an attack on a website), it alerts public authorities and organisations. and can act as a mediator: If you discover a security flaw in another government body (such as a municipality or province) or in an organisation with a vital function (such as an energy or telecoms company), please contact the body or organisation first. If you receive no response, please notify the National Cyber Security Centre, which will mediate between you and the body or organisation concerned. with anonimity garantuee: The government treats the notifications it receives confidentially. It will not share your personal details with third parties without your permission unless required to do so by law or a court order. while avoiding court cases for doing your civic duty: When you report the security flaw, check that you comply with the conditions described above. If you do so, the government will not attach any legal consequences to your notification.
- aagd 7y agoBeing from Germany I never heard about government based security checks. IT-wise our government doesn't make a very competent impression. Do you have any background info on this?
- phit_ 7y agohttps://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-Bund/CERT-Reports/reports_node.html https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-... https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/IT-Situation-Centre/itsituationcentre_node.html https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/IT-Si... https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/IT-Crisis-Reaction-Centre/itcrisisreactioncentre_node.html https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/IT-Cr...
- aurelian15 7y agoI remember receiving an email from the BSI ("Bundesamt für Sicherheit in der Informationstechnik"; engl. "Federal Office for Security of Information Technology") regarding a misconfigured NTP server that could be abused for NTP reflection attacks. The functions of the BSI are explained in English here [1] based on the following law [2]. I guess initiatives such as informing about the NTP problem fall into what is listed under §3.2. [1] https://www.bsi.bund.de/EN/TheBSI/Functions/functions_node.html https://www.bsi.bund.de/EN/TheBSI/Functions/functions_node.h... [2] https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/BSI/bsiges2009_pdf.pdf?__blob=publicationFile&v=1 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/BSI/bsig...
- KenanSulayman 7y agoThey pretty quickly send you emails once your email comes up in the whois of a domain that’s pointing to an IP in the allocation space of German companies. Example: hetzner.
- StudentStuff 7y agoThe German government has contributed the base layer to OpenStreetMaps, and uses it for their official parcel/lot line maps. It is much better than the janky pile of crap Esri dumps on most counties in the USA.
- tyingq 7y agoI imagine the NSA routinely keeps vulnerabilities to themselves, for their own use.
- rukuu001 7y agoUtter silence from Adobe on this (I'm a CC customer)
- jacquesm 7y ago7M is way - really, way - above the disclosure floor so in the EU at least they will have to do a proper disclosure to the various DPA's. One document I read put the lower floor at 5 records for a 'major breach' so I would very much caution against trying to wipe this sort of thing under the carpet. That's the best way to find out how serious the EU is about those fines. That and repeats while ignoring previous DPA instructions.
- cameronbrown 7y agoSecond time's a charm!
- deleted 7y ago[deleted]
- accounn 7y agoPredictable.
- nyuszika7h 7y agoAdobe hasn't learned... I still get spam to myusername+adobe@mydomain.net (or occasionally, adobe@mydomain.net if the spammers' email parser is dumb) to this day, to the point where I've had to blacklist that address.
- jacquesm 7y agoAnother really good reason to hate these grafted on service models. After all, if you just bought a license and installed the software on your own machine at least you wouldn't have to worry about this kind of stuff. It's clear beyond a shade of doubt that even the largest companies can't be trusted to be good stewards of your data.
- tyingq 7y agoHard to argue with what it did for their company. Look at a 5 year chart for Adobe's stock price.
- jacquesm 7y agoYes, stock price is everything /s. 1) check back on Monday morning 2) we don't know what their stock price would have been otherwise 3) even if it is good for their stock it might still kill the company, though - regrettably - the public is way too accepting of these sort of things.
- tyingq 7y ago~3x return over 3 years. Something's working unusually well.
- jacquesm 7y agoSure, but that's arguing from results and you can justify an awful lot of terrible stuff like that. Interactions between people can to a large extent be governed properly but utilitarianism but as soon as you bring in stockprice as the arbiter then you're very far from safe ground. After all; in times of war the stock price of weapons manufacturers will go up but that does not mean that the net utility gain is positive.
- tyingq 7y agoI'm not justifying what they did here and I get your position. I'm thinking about the motivation, progression, etc. The upside of ignoring proper security seems to outweigh the downside. Target, for example, is doing just fine. Despite their tepid response to an egregious mistake. The consequences seem paltry.
- kitotik 7y agoIt feels like unsecured elasticsearch clusters are becoming the new s3/mongodb. I’ve been noticing increased scans for their default ports on servers I maintain. It’s not very surprising given how insecure the defaults are for the typical ELK stack, and how tedious it is to actually setup sane authz.
- kakwa_ 7y agoWell, putting in place authentication can indeed be difficult, but making the ELK nodes only accessible by a limited set of IPs (preferably private ones) instead of being directly public facing should reasonably be expected.
- bborud 7y agoI wonder if Adobe executives are aware of what kind of image their company has. How long before Adobe reaches the Oracle stage of dickhead'ness where phasing out all their products can be found in large companies (non-public) strategy plans.
- madhadron 7y agoIn favor of what, though? You can replace Premiere with Avid and InDesign with Quark, but what replaces After Effects? PhotoShop? Illustrator? And for the professionals that depend on these tools, retraining is a major pain, equivalent to saying to an experienced vim user that they have to switch to BBEdit.
- bborud 7y agoI was a bit surprised to find that quite a few of my friends who traditionally used Photoshop and Illustrator in their work either have transitioned to Affinity products, or are making a conscious effort to look for alternatives. I would have thought it would take longer and/or that people would be extremely tied to their tools. But you do make a point. Often there is no obvious alternative. And changing tools has a cost. Mostly because they want to pay for software and then not have it stop working on them for silly reasons, but also due to a general "bullshit fatigue" with Adobe. It isn't a company that cares a great deal about its users. I did something similar a few years ago. After Oracle ended up buying Sun, I really wanted to stop using Java since I didn't feel Oracle was a company that I would want to do business with. However, it took me several years to transition away from Java. I really liked Java. Finding a new programming language that is suitable for the kind of work you do, has enough of a community etc. isn't just a matter of deciding to move. You need somewhere to move to. Eventually Go evolved to where it fit my needs really well, so I managed to make the transition. 2-3 years later and I haven't touched Java since. (Which was somewhat unexpected. I didn't expect changing languages would be that fast, but it coincided well with new projects etc). As for switching editors, VSCode managed to attract 2.6M monthly users in roughly 2 years. If you believe estimates of how many developers that are in the world, and you squint a bit when comparing numbers, that's roughly in the neighborhood of 10% of the global developer population. My intuition says you are right. The data seems seems to suggest it wants to disagree with both of us :-)
- Angostura 7y agoJokes on them, they already released my account details once
- rubbingalcohol 7y agooops lol
- downrightmike 7y ago"The exposed user data wasn’t particularly sensitive, but it could be used to create phishing campaigns that target the Adobe users whose emails were leaked. The following user data was included: Email addresses Account creation date Which Adobe products they use Subscription status Whether the user is an Adobe employee Member IDs Country Time since last login Payment status The data did not include payment information or passwords."
- jefftk 7y agoReformatted: " * Email addresses * Account creation date * Which Adobe products they use * Subscription status * Whether the user is an Adobe employee * Member IDs * Country * Time since last login * Payment status The data did not include payment information or passwords"
- pier25 7y agoShouldn't companies be penalized for exposing its users' private data?
- plurple 7y agoAnd I just recently saw one of the top people on Creative Cloud mocking someone on Twitter for their security. Oops.
- philshem 7y agoLink?