7 ms·

FTC takes action against CafePress for data breach cover up

121 points by reidrac 4y ago

kevin_thibedeau 4y ago
> inadequately encrypted passwords, Assuming this means unsalted hashes. Since when has the FTC been going after this?
- blacksmith_tb 4y ago
  That whole sentence is even more interesting: "the FTC alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain text Social Security numbers, inadequately encrypted passwords, and answers to password reset questions." Why would CafePress have anyone's SSN? I suppose potentially a merchant selling on it might need to have provided banking details, but that still doesn't seem like it should include a SSN?
  - kayodelycaon 4y ago
    Sole proprietors use their SSN for tax purposes. May also apply to single-member LLCs.
    - lsaferite 4y ago
      Can't Sole Proprietors obtain an EIN as well though? No way I'm using my SSN for stuff like that. I always used an LLC with an EIN.
      - xeromal 4y ago
        They can. I assume DBAs (Doing business as) folks are the ones that use their SSN. Just real small-time shops.
      - mcculley 4y ago
        Many sole proprietors execute under their SSN. Most will not bother to acquire an EIN.
      - lfowles 4y ago
        I think the W9 form says to use SSN in case of a disregarded entity (such as a single member LLC).
        lsaferite 4y ago
        > You must show your individual name and you may also enter your business or DBA name on the “Business name/disregarded entity” name line. You may use either your SSN or EIN (if you have one), but the IRS encourages you to use your SSN. That's straight from the W-9 instructions. You _can_ use an EIN. In my opinion you _should_ use an EIN.
        lfowles 4y ago
        Now I'm even more confused, heh. From the previous page: > If you are a single-member LLC that is disregarded as an entity separate from its owner, enter the owner’s SSN (or EIN, if the owner has one). *Do not enter the disregarded entity’s EIN* Edit: I suppose the distinction is that you should have an EIN for your name
  - mcculley 4y ago
    An individual can sell custom/branded merchandise on CafePress. If CafePress is sending more than $600 per year to an individual, they have to issue a 1099, which has to have a TIN, which is going to be an SSN for most individuals.
  - olliej 4y ago
    Income reporting? If you’re a non-business merchant? Or if you’re a business the businesses tax is? This is me stabbing in the dark, no actual knowledge or anything :)
- dontbenebby 4y ago
  I saw one darknet site where they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for password if they were dumb enough), I wonder how often that happens in the corporate world but absent a whistleblower or a helpful hacker no one would find out. (I'm not clear if they were being run by the police when I showed up, or if that was an extortion technique, but it's been over two years since that adventure, so the CFAA has expired and if someone takes issue I tried to take down a den of hurtcore creeps because one of them obstructed my job search before the portmanteau had been popularized, form a line to my left so you don't interfere with the baristas taking orders, as I operate in the clear and I will not abide absolute scumbags who abuse their access.)
  - inetknght 4y ago
    > they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for password if they were dumb enough), I wonder how often that happens in the corporate world https://en.wikipedia.org/wiki/Credential_stuffing https://en.wikipedia.org/wiki/Credential_stuffing Indeed, it's a major problem.
    - dontbenebby 4y ago
      Oh yeah I know the re-use is common, I more meant the technique of purposefully not hashing or disabling hashing to compare hashes across services and connect users.
- nerdponx 4y ago
  For all the apparent inaction and broken promises of the Biden administration, it's been very refreshing to see "technical" government agencies returning to basic competency, and in some cases apparently actively bucking long trends of regulatory capture. The bureaucrats seem surprisingly progressive this cycle (once again highlighting the fragility of a system that functions in spite of, rather than because of, the primary lawmaking body). It's a shame that they will probably be voted out next go around, possibly in favor of the prior Twitter User In Chief.
- pavon 4y ago
  I was curious about what legal theory they were using to enforce this. It appears that 5/7 of the counts are just false or misleading statements - CafePress claimed to have good security but didn't. Another is just tangentially related to security. The interesting one is Count III: > As described in Paragraph 11, Respondents’ failure to employ reasonable data security measures to protect Personal Information caused or is likely to cause substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers themselves. This practice is an unfair act or practice. ... > in violation of Section 5(a) of the Federal Trade Commission Act. If I'm reading this correctly, it is saying that the FTC interprets poor security of user's data to be in violation the FTC act even outside of any promises given to the customer. That seems like a big stretch IMO.
  - bombcar 4y ago
    It's the legal theory of "agree to these things or we're going to publicly try to nail your assets to the wall" - even if they actually can't do it, do you want to pay the costs of fighting it, or give the FTC their little PR moment.
- tptacek 4y ago
  I'm a little nerd-sniped by the callout over using SHA-1; SHA-1 is broken in a way that has nothing to do with password storage security (they're not using a password KDF at all, so the thrust of the complaint isn't wrong, and no sane person would use SHA-1 to build a new password KDF in 2019, but still!)
- bityard 4y ago
  They're not going after them for that. They're going after them for that plus an incredibly long list of other basic security failures, failing to notify customers that their personal data was now in the wild, and other negligence
olliej 4y ago
It sounds like the concealing of it is (rightfully) a bigger part of things.
- encryptluks2 4y ago
  Which is okay if you're an Xfinity or other entity that frequently lobbies congress.
  - olliej 4y ago
    Yeah, except that seems to be true of /any/ crime, in any industry.
    - dontbenebby 4y ago
      The BCP is kind of a joke, they do these enforcements usually when a practice is widespread, it's like when they pull over one car on the highway and the rest slow down. The GOP commissioners do not believe in the mission, and obstruct it, so you have the same issues with enforcement you saw play out on the SC recently -- GOP presidents stack the org with people who aim to destroy it. Then to add insult to injury, they require you to have a JD (which entails not be able to operate a computer apparently, or when you do, needing to have 1 pagers on encryption from the 90s rewritten every two weeks to two years), and when they do hire anything remotely related to the liberal arts, they label them as "economists" and don't allow anyone who actually believes in sound economics in -- only Austrian bull crap, the usual Keyes neoliberlism, or, at best neoliberalish "behavioral economists" who rediscover concepts I learned in my cognitive psyc class in undergrad that date back decades. (Dark patterns being a classic example -- we're gonna discover the lies that were explained in Consumer Reports for Kids in the 1990s at an exploratory workshop in 2020s? Stuff like that is why more and more people are leaving America permanently.)
tptacek 4y ago
From the consent agreement, in addition to a bunch of fuzzier stuff about standing up a security program, the FTC has demanded: 1. Technical measures to monitor all of Respondent’s networks and all systems and assets within those networks to identify data security events, including unauthorized attempts to exfiltrate Personal Information from those networks; 2. Policies and procedures to ensure that all code for web applications is reviewed for the existence of common vulnerabilities; 3. Policies and procedures to minimize data collection, storage, and retention, including data deletion or retention policies and procedures; 4. Encryption of all Social Security numbers on Respondent’s computer networks; 5. Data access controls for all databases storing Personal Information, including by, at a minimum, (a) restricting inbound connections to approved IP addresses, (b) requiring authentication to access them, and (c) limiting employee access to what is needed to perform that employee’s job function; 6. Policies and procedures to ensure that all devices on Respondent’s network with access to Personal Information are securely installed and inventoried at least once every twelve (12) months, including policies and procedures to timely remediate critical and high-risk security vulnerabilities and apply up-to-date security patches; 7. Replacing authentication measures based on the use of security questions and answers to access accounts with multi-factor authentication methods that use a secure authentication protocol, such as cryptographic software or devices, mobile authenticator applications, or allowing the use of security keys; and 8. Training of all of Respondent’s employees, at least once every twelve (12) months, on how to safeguard Personal Information; #7 jumps out at me. The problem CafePress has is that they used security questions rather than the industry-standard practice of just sending password-reset emails, which meant the answers to those security questions were password-equivalent, and, of course, stolen in the SQLI attacks. But the simpler fix here is just to require password reset emails, not to mandate multi-factor authentication. Though I wonder if they'll just claim email resets are a second factor.
- bombcar 4y ago
  #1 sounds like a boondoggle for security companies, selling software that doesn't actually do much; but perhaps I'm out of the market too long to know what's the current standard.
4oh9do 4y ago
Bullshit like this will continue happening en masse until there are mandatory prison sentences for C-suite executives for negligence and malice like this.
- QuarterReptile 4y ago
  As much as we love to imprison people in the US... Maybe just make the expected value of cover up massively negative with fines as significant multiples of actual damage?
  - 4oh9do 4y ago
    It's all Monopoly money to corporations. If there is no fear of an actual corporal punishment, then there is no personal skin in the game, so to speak. An executive who causes a corporation to be fined may worry about losing their job, but they'll be much more worried if the risk is going to prison. And it's not that we love to imprison people in the US, it's that we love to imprison the wrong people.
    - QuarterReptile 4y ago
      >It's all Monopoly money to corporations. Surely you don't mean by this that they don't care about money. Isn't the cynical take normally that corporations are amoral money maximizing juggernauts? Why wouldn't they respond to adequate threats?
      - 4oh9do 4y ago
        What I mean is that executives value their personal livelihoods above money, though the two are often correlated. Therefore the punishment needs to strike at the core, their personal as opposed to financial freedom. "Big" fines for corporations have been around forever, I don't see them changing anything.
      - themitigating 4y ago
        It's not that they don't care about money it's that they are less affected by loss. Once someone earns about 10 million they can live for the rest of their life in a reasonable way without working again. So when you are an executive who has assets of 50 to 70 million and your stock, which was worth 10 mil is now worth 7 mil you aren't hurt that bad. The company can they raise prices, cut quality, and fire people to reduce costs to make up for the fine. The stock might eventually even go higher than it was before.
arlattimore 4y ago
What they are requiring might be interesting when compared to the Whitehouse Zero Trust Architecture [1] that was announced last year. [1] https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action...
indymike 4y ago
One of the complaints was closing merchants who were breached and then charging them a $25 account closure fee. Wow.
bogota 4y ago
This explains why I had about 20 random transactions from cafe press last year. I wasn’t even aware I ever used them.
- mistrial9 4y ago
  I heard (here) that some California Community Colleges were willfully ignoring blatent fake accounts, due to $INCOME and $LIABILITY incentives and fines, respectively. Is it possible that this online retail company, feeling in corner financially, willfully turned a blind-eye to account activity for similar reasons?
reidrac 4y ago
I submitted the link just after CafePress sent me an email with the information. A lot of stress in "previous owners" and "before 2019". OK, fair enough. I asked them to remove my details from their DB, because I ordered something back in 2007 but I don't think I'll do it again. The response was interesting: "Thank you for contacting CafePress. Per your request, I will be happy to ensure that your information is no longer stored. However, I was not able to locate an account with the email address provided so it appears you do not have any information stored with us." Yet, I got the email from them with the FTC settlement information.

121 points by reidrac 4y ago

kevin_thibedeau 4y ago

> inadequately encrypted passwords, Assuming this means unsalted hashes. Since when has the FTC been going after this?

blacksmith_tb 4y ago
That whole sentence is even more interesting: "the FTC alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain text Social Security numbers, inadequately encrypted passwords, and answers to password reset questions." Why would CafePress have anyone's SSN? I suppose potentially a merchant selling on it might need to have provided banking details, but that still doesn't seem like it should include a SSN?
- kayodelycaon 4y ago
  Sole proprietors use their SSN for tax purposes. May also apply to single-member LLCs.
  - lsaferite 4y ago
    Can't Sole Proprietors obtain an EIN as well though? No way I'm using my SSN for stuff like that. I always used an LLC with an EIN.
    - xeromal 4y ago
      They can. I assume DBAs (Doing business as) folks are the ones that use their SSN. Just real small-time shops.
    - mcculley 4y ago
      Many sole proprietors execute under their SSN. Most will not bother to acquire an EIN.
    - lfowles 4y ago
      I think the W9 form says to use SSN in case of a disregarded entity (such as a single member LLC).
      - lsaferite 4y ago
        > You must show your individual name and you may also enter your business or DBA name on the “Business name/disregarded entity” name line. You may use either your SSN or EIN (if you have one), but the IRS encourages you to use your SSN. That's straight from the W-9 instructions. You _can_ use an EIN. In my opinion you _should_ use an EIN.
        lfowles 4y ago
        Now I'm even more confused, heh. From the previous page: > If you are a single-member LLC that is disregarded as an entity separate from its owner, enter the owner’s SSN (or EIN, if the owner has one). *Do not enter the disregarded entity’s EIN* Edit: I suppose the distinction is that you should have an EIN for your name
- mcculley 4y ago
  An individual can sell custom/branded merchandise on CafePress. If CafePress is sending more than $600 per year to an individual, they have to issue a 1099, which has to have a TIN, which is going to be an SSN for most individuals.
- olliej 4y ago
  Income reporting? If you’re a non-business merchant? Or if you’re a business the businesses tax is? This is me stabbing in the dark, no actual knowledge or anything :)
dontbenebby 4y ago
I saw one darknet site where they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for password if they were dumb enough), I wonder how often that happens in the corporate world but absent a whistleblower or a helpful hacker no one would find out. (I'm not clear if they were being run by the police when I showed up, or if that was an extortion technique, but it's been over two years since that adventure, so the CFAA has expired and if someone takes issue I tried to take down a den of hurtcore creeps because one of them obstructed my job search before the portmanteau had been popularized, form a line to my left so you don't interfere with the baristas taking orders, as I operate in the clear and I will not abide absolute scumbags who abuse their access.)
- inetknght 4y ago
  > they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for password if they were dumb enough), I wonder how often that happens in the corporate world https://en.wikipedia.org/wiki/Credential_stuffing https://en.wikipedia.org/wiki/Credential_stuffing Indeed, it's a major problem.
  - dontbenebby 4y ago
    Oh yeah I know the re-use is common, I more meant the technique of purposefully not hashing or disabling hashing to compare hashes across services and connect users.
nerdponx 4y ago
For all the apparent inaction and broken promises of the Biden administration, it's been very refreshing to see "technical" government agencies returning to basic competency, and in some cases apparently actively bucking long trends of regulatory capture. The bureaucrats seem surprisingly progressive this cycle (once again highlighting the fragility of a system that functions in spite of, rather than because of, the primary lawmaking body). It's a shame that they will probably be voted out next go around, possibly in favor of the prior Twitter User In Chief.
pavon 4y ago
I was curious about what legal theory they were using to enforce this. It appears that 5/7 of the counts are just false or misleading statements - CafePress claimed to have good security but didn't. Another is just tangentially related to security. The interesting one is Count III: > As described in Paragraph 11, Respondents’ failure to employ reasonable data security measures to protect Personal Information caused or is likely to cause substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers themselves. This practice is an unfair act or practice. ... > in violation of Section 5(a) of the Federal Trade Commission Act. If I'm reading this correctly, it is saying that the FTC interprets poor security of user's data to be in violation the FTC act even outside of any promises given to the customer. That seems like a big stretch IMO.
- bombcar 4y ago
  It's the legal theory of "agree to these things or we're going to publicly try to nail your assets to the wall" - even if they actually can't do it, do you want to pay the costs of fighting it, or give the FTC their little PR moment.
tptacek 4y ago
I'm a little nerd-sniped by the callout over using SHA-1; SHA-1 is broken in a way that has nothing to do with password storage security (they're not using a password KDF at all, so the thrust of the complaint isn't wrong, and no sane person would use SHA-1 to build a new password KDF in 2019, but still!)
bityard 4y ago
They're not going after them for that. They're going after them for that plus an incredibly long list of other basic security failures, failing to notify customers that their personal data was now in the wild, and other negligence

olliej 4y ago

It sounds like the concealing of it is (rightfully) a bigger part of things.

encryptluks2 4y ago
Which is okay if you're an Xfinity or other entity that frequently lobbies congress.
- olliej 4y ago
  Yeah, except that seems to be true of /any/ crime, in any industry.
  - dontbenebby 4y ago
    The BCP is kind of a joke, they do these enforcements usually when a practice is widespread, it's like when they pull over one car on the highway and the rest slow down. The GOP commissioners do not believe in the mission, and obstruct it, so you have the same issues with enforcement you saw play out on the SC recently -- GOP presidents stack the org with people who aim to destroy it. Then to add insult to injury, they require you to have a JD (which entails not be able to operate a computer apparently, or when you do, needing to have 1 pagers on encryption from the 90s rewritten every two weeks to two years), and when they do hire anything remotely related to the liberal arts, they label them as "economists" and don't allow anyone who actually believes in sound economics in -- only Austrian bull crap, the usual Keyes neoliberlism, or, at best neoliberalish "behavioral economists" who rediscover concepts I learned in my cognitive psyc class in undergrad that date back decades. (Dark patterns being a classic example -- we're gonna discover the lies that were explained in Consumer Reports for Kids in the 1990s at an exploratory workshop in 2020s? Stuff like that is why more and more people are leaving America permanently.)

tptacek 4y ago

From the consent agreement, in addition to a bunch of fuzzier stuff about standing up a security program, the FTC has demanded: 1. Technical measures to monitor all of Respondent’s networks and all systems and assets within those networks to identify data security events, including unauthorized attempts to exfiltrate Personal Information from those networks; 2. Policies and procedures to ensure that all code for web applications is reviewed for the existence of common vulnerabilities; 3. Policies and procedures to minimize data collection, storage, and retention, including data deletion or retention policies and procedures; 4. Encryption of all Social Security numbers on Respondent’s computer networks; 5. Data access controls for all databases storing Personal Information, including by, at a minimum, (a) restricting inbound connections to approved IP addresses, (b) requiring authentication to access them, and (c) limiting employee access to what is needed to perform that employee’s job function; 6. Policies and procedures to ensure that all devices on Respondent’s network with access to Personal Information are securely installed and inventoried at least once every twelve (12) months, including policies and procedures to timely remediate critical and high-risk security vulnerabilities and apply up-to-date security patches; 7. Replacing authentication measures based on the use of security questions and answers to access accounts with multi-factor authentication methods that use a secure authentication protocol, such as cryptographic software or devices, mobile authenticator applications, or allowing the use of security keys; and 8. Training of all of Respondent’s employees, at least once every twelve (12) months, on how to safeguard Personal Information; #7 jumps out at me. The problem CafePress has is that they used security questions rather than the industry-standard practice of just sending password-reset emails, which meant the answers to those security questions were password-equivalent, and, of course, stolen in the SQLI attacks. But the simpler fix here is just to require password reset emails, not to mandate multi-factor authentication. Though I wonder if they'll just claim email resets are a second factor.

bombcar 4y ago
#1 sounds like a boondoggle for security companies, selling software that doesn't actually do much; but perhaps I'm out of the market too long to know what's the current standard.

4oh9do 4y ago

Bullshit like this will continue happening en masse until there are mandatory prison sentences for C-suite executives for negligence and malice like this.

QuarterReptile 4y ago
As much as we love to imprison people in the US... Maybe just make the expected value of cover up massively negative with fines as significant multiples of actual damage?
- 4oh9do 4y ago
  It's all Monopoly money to corporations. If there is no fear of an actual corporal punishment, then there is no personal skin in the game, so to speak. An executive who causes a corporation to be fined may worry about losing their job, but they'll be much more worried if the risk is going to prison. And it's not that we love to imprison people in the US, it's that we love to imprison the wrong people.
  - QuarterReptile 4y ago
    >It's all Monopoly money to corporations. Surely you don't mean by this that they don't care about money. Isn't the cynical take normally that corporations are amoral money maximizing juggernauts? Why wouldn't they respond to adequate threats?
    - 4oh9do 4y ago
      What I mean is that executives value their personal livelihoods above money, though the two are often correlated. Therefore the punishment needs to strike at the core, their personal as opposed to financial freedom. "Big" fines for corporations have been around forever, I don't see them changing anything.
    - themitigating 4y ago
      It's not that they don't care about money it's that they are less affected by loss. Once someone earns about 10 million they can live for the rest of their life in a reasonable way without working again. So when you are an executive who has assets of 50 to 70 million and your stock, which was worth 10 mil is now worth 7 mil you aren't hurt that bad. The company can they raise prices, cut quality, and fire people to reduce costs to make up for the fine. The stock might eventually even go higher than it was before.

arlattimore 4y ago

What they are requiring might be interesting when compared to the Whitehouse Zero Trust Architecture [1] that was announced last year. [1] https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action...

indymike 4y ago

One of the complaints was closing merchants who were breached and then charging them a $25 account closure fee. Wow.

bogota 4y ago

This explains why I had about 20 random transactions from cafe press last year. I wasn’t even aware I ever used them.

mistrial9 4y ago
I heard (here) that some California Community Colleges were willfully ignoring blatent fake accounts, due to $INCOME and $LIABILITY incentives and fines, respectively. Is it possible that this online retail company, feeling in corner financially, willfully turned a blind-eye to account activity for similar reasons?

reidrac 4y ago

I submitted the link just after CafePress sent me an email with the information. A lot of stress in "previous owners" and "before 2019". OK, fair enough. I asked them to remove my details from their DB, because I ordered something back in 2007 but I don't think I'll do it again. The response was interesting: "Thank you for contacting CafePress. Per your request, I will be happy to ensure that your information is no longer stored. However, I was not able to locate an account with the email address provided so it appears you do not have any information stored with us." Yet, I got the email from them with the FTC settlement information.