4 ms·

MOVEit Hack at AutoZone

52 points by LinuxBender 3y ago

h2odragon 3y ago
Why would AutoZone have customer social security numbers?
- codeTired 3y ago
  I think they offer a credit card. Might be storing info.
- jetbalsa 3y ago
  And don't forget Employee records
bell-cot 3y ago
Reaction: Pay With Cash
- pixl97 3y ago
  Eh, this is messy in the sense if you have an older car that you tend to fix yourself it can be useful for them to have your information. For example I replaced some kind of ignition pack on my car that had a multi year warranty. I had moved since I bought it an long lost the receipt. It started to go out, and I went to the store, gave them my name, and they were able to swap the unit out then and there.
  - pavel_lishin 3y ago
    An alternative is to not actually give them your social security number, but a different number that's not likely to collide with an existing customer's. It's not like they run it past a government database to verify.
    - ars 3y ago
      AutoZone does not and never has asked for social security numbers. They just use your phone number.
  - jabroni_salad 3y ago
    They will also use that info to tell you if a part you installed has been recalled. I also don't like giving my info out, but it has its uses.
TekMol 3y ago
What is the danger here? What damage could an individual suffer because the data a dealer of auto parts holds about them got in the wrong hands? And is this just a theoretical danger "Someone could use the pieces of data to impersonate you and then run some kind of social engineering attack against you for which the involved companies will reject to compensate you" or did something like this ever happen to someone here among us and resulted in real financial loss? UPDATE: So far all answers are of the form "With the SSN, theoretically, someone could impersonate you". That is what I meant with my "is this just a theoretical danger" question. But what concrete harm could someone do with your SSN? Did anybody here on HN ever had something happen to them because someone got hold of their SSN?
- nix0n 3y ago
  > cybercriminals have stolen information, including social security numbers Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN". > some kind of social engineering attack It's not really even social engineering at that point. It would take a lot of work to convince a company that person was not who they claimed to be.
  - Swizec 3y ago
    > Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN" Why is USA like this? The SSN thing has felt ridiculous ever since I moved here. “This is your SSN! It is super top secret important information, do not share with anyone ever” … “Oh also please give this number in plaintext to every company under the sun”
    - ensignavenger 3y ago
      What do other countries generally do? I know many have national IDs, but if the USA had a national ID #, wouldn't that just put us in the same bucket as SSN? X.509 certs with public private keys may offer a solution, but I don't think there are many large countries that have adopted anything like that on a nationwide scale? X.509 certs still have an authority issue with managing their life cycle, something I personally beleive a competent goverment could figure out, though, but I know there are security experts who are skeptical. Biometrics offer another possible solution, but privacy advocates have been pretty, leery, perhaps for good reason, of mass biometric collection. What countries have successfully adopted a nationwide biometric identification system? Other soltions? I certainly agree SSNs as identification is a.complete.joke, but I am not sure the identification problem is completely a solved solution, either.
candiddevmike 3y ago
This isn't the first time they were hacked, and it won't be the last. There are no repercussions here aside from some process shit around notifying folks (that companies get better at doing the more times they are breached...!). We need laws with teeth similar to HIPAA for personal data usage.
wojciii 3y ago
These stories makes me wonder why no standard for keeping customer data has been developed. I mean a company needs my data when I buy something from them and then again when they have to pay taxex. Do they need to have my full info with name, email and phone number? I could send them the same info again if I want to buy something again .. they could keep some hash or unique id used to check that it's really me. Why is this so hard?
teeray 3y ago
At this point, we should just make the name -> SSN mapping public information by some deadline. They’ve proven to be an uncontrollable secret time and again. The answer is to make SSNs completely worthless to fraudsters.
- lcnPylGDnU4H9OF 3y ago
  They're already public, including the name map. Nothing difficult needs to happen other than to convince the general public -- and institutional support staff -- that SSNs are not private information which can be used to securely verify a person's identity.
  - ars 3y ago
    Autozone is not using SSN to verify identity, they use it to report taxable income. (They don't collect SSN from customers, it's from employees.) What would you do instead of SSN? Or how would you change the process of providing a number for income tax purposes?
    - kulahan 3y ago
      I think you're pushing upon an idea that's philosophically more significant than "how do we fix/replace SSNs". We really need to start talking about how to verify who a human actually is. I don't see a future where we just have to remember some shitty, leakable password when more and more things are entering some sort of password-based trust system. I have no ideas for implementation, I just think we're having the wrong conversation.
    - lcnPylGDnU4H9OF 3y ago
      You might sometimes see people say that a SSN is both a username and a password. What they mean is that it’s used both for unique identification as well as authentication; imagine if your email address was also necessarily the password for your email. There’s nothing wrong with having the identifier. What’s wrong is treating the identifier as though only the person it identifies knows it, which is patently false because that would make it useless as an identifier. As for what I’d do instead: create an application that is fully managed by the IRS and let me login with some combination of a client certificate, password, U2F device, TOTP, et. al. Have the IRS securely implement something like OAuth (I hear “securely” doesn’t quite fit with “OAuth” but they could implement something custom-built if they want to) so I can get the IRS to tell whoever I need them to tell that I am me. Ideally, replace IRS with a purposeful identification organization for these purposes and let the IRS use what this new organization gives them.
Obscurity4340 3y ago
Its beyond disgusting the banks and corporations and government have gaslit people into believing identity theft and the fraud derived therin is in any sense "YOUR problem, not OUR problem". I would never lift a finger and sue the fuck out of them in parallel both in the court of public opinion and the Court of real opinion (the Courts).

52 points by LinuxBender 3y ago

h2odragon 3y ago

Why would AutoZone have customer social security numbers?

codeTired 3y ago
I think they offer a credit card. Might be storing info.
jetbalsa 3y ago
And don't forget Employee records

bell-cot 3y ago

Reaction: Pay With Cash

pixl97 3y ago
Eh, this is messy in the sense if you have an older car that you tend to fix yourself it can be useful for them to have your information. For example I replaced some kind of ignition pack on my car that had a multi year warranty. I had moved since I bought it an long lost the receipt. It started to go out, and I went to the store, gave them my name, and they were able to swap the unit out then and there.
- pavel_lishin 3y ago
  An alternative is to not actually give them your social security number, but a different number that's not likely to collide with an existing customer's. It's not like they run it past a government database to verify.
  - ars 3y ago
    AutoZone does not and never has asked for social security numbers. They just use your phone number.
- jabroni_salad 3y ago
  They will also use that info to tell you if a part you installed has been recalled. I also don't like giving my info out, but it has its uses.

TekMol 3y ago

What is the danger here? What damage could an individual suffer because the data a dealer of auto parts holds about them got in the wrong hands? And is this just a theoretical danger "Someone could use the pieces of data to impersonate you and then run some kind of social engineering attack against you for which the involved companies will reject to compensate you" or did something like this ever happen to someone here among us and resulted in real financial loss? UPDATE: So far all answers are of the form "With the SSN, theoretically, someone could impersonate you". That is what I meant with my "is this just a theoretical danger" question. But what concrete harm could someone do with your SSN? Did anybody here on HN ever had something happen to them because someone got hold of their SSN?

nix0n 3y ago
> cybercriminals have stolen information, including social security numbers Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN". > some kind of social engineering attack It's not really even social engineering at that point. It would take a lot of work to convince a company that person was not who they claimed to be.
- Swizec 3y ago
  > Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN" Why is USA like this? The SSN thing has felt ridiculous ever since I moved here. “This is your SSN! It is super top secret important information, do not share with anyone ever” … “Oh also please give this number in plaintext to every company under the sun”
  - ensignavenger 3y ago
    What do other countries generally do? I know many have national IDs, but if the USA had a national ID #, wouldn't that just put us in the same bucket as SSN? X.509 certs with public private keys may offer a solution, but I don't think there are many large countries that have adopted anything like that on a nationwide scale? X.509 certs still have an authority issue with managing their life cycle, something I personally beleive a competent goverment could figure out, though, but I know there are security experts who are skeptical. Biometrics offer another possible solution, but privacy advocates have been pretty, leery, perhaps for good reason, of mass biometric collection. What countries have successfully adopted a nationwide biometric identification system? Other soltions? I certainly agree SSNs as identification is a.complete.joke, but I am not sure the identification problem is completely a solved solution, either.

candiddevmike 3y ago

This isn't the first time they were hacked, and it won't be the last. There are no repercussions here aside from some process shit around notifying folks (that companies get better at doing the more times they are breached...!). We need laws with teeth similar to HIPAA for personal data usage.

wojciii 3y ago

These stories makes me wonder why no standard for keeping customer data has been developed. I mean a company needs my data when I buy something from them and then again when they have to pay taxex. Do they need to have my full info with name, email and phone number? I could send them the same info again if I want to buy something again .. they could keep some hash or unique id used to check that it's really me. Why is this so hard?

teeray 3y ago

At this point, we should just make the name -> SSN mapping public information by some deadline. They’ve proven to be an uncontrollable secret time and again. The answer is to make SSNs completely worthless to fraudsters.

lcnPylGDnU4H9OF 3y ago
They're already public, including the name map. Nothing difficult needs to happen other than to convince the general public -- and institutional support staff -- that SSNs are not private information which can be used to securely verify a person's identity.
- ars 3y ago
  Autozone is not using SSN to verify identity, they use it to report taxable income. (They don't collect SSN from customers, it's from employees.) What would you do instead of SSN? Or how would you change the process of providing a number for income tax purposes?
  - kulahan 3y ago
    I think you're pushing upon an idea that's philosophically more significant than "how do we fix/replace SSNs". We really need to start talking about how to verify who a human actually is. I don't see a future where we just have to remember some shitty, leakable password when more and more things are entering some sort of password-based trust system. I have no ideas for implementation, I just think we're having the wrong conversation.
  - lcnPylGDnU4H9OF 3y ago
    You might sometimes see people say that a SSN is both a username and a password. What they mean is that it’s used both for unique identification as well as authentication; imagine if your email address was also necessarily the password for your email. There’s nothing wrong with having the identifier. What’s wrong is treating the identifier as though only the person it identifies knows it, which is patently false because that would make it useless as an identifier. As for what I’d do instead: create an application that is fully managed by the IRS and let me login with some combination of a client certificate, password, U2F device, TOTP, et. al. Have the IRS securely implement something like OAuth (I hear “securely” doesn’t quite fit with “OAuth” but they could implement something custom-built if they want to) so I can get the IRS to tell whoever I need them to tell that I am me. Ideally, replace IRS with a purposeful identification organization for these purposes and let the IRS use what this new organization gives them.

Obscurity4340 3y ago

Its beyond disgusting the banks and corporations and government have gaslit people into believing identity theft and the fraud derived therin is in any sense "YOUR problem, not OUR problem". I would never lift a finger and sue the fuck out of them in parallel both in the court of public opinion and the Court of real opinion (the Courts).