8 ms·
There was no brute forcing done. The credentials were from other sites that were leaked via Tor and the users on 23andMe used the same email/password combo. Tha
by dpkonofa 3y ago
There was no brute forcing done. The credentials were from other sites that were leaked via Tor and the users on 23andMe used the same email/password combo. That’s why you don’t reuse passwords, when possible.
Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user.
- drcongo 3y agoHow does something leak on Tor?
- MattGaiser 3y ago> Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user. This seems to be the big societal discussion, in the same way that people blame banks for them sending money to crypto and romance scammers overseas.
- dpkonofa 3y agoThat is a great analogy.
- 2devnull 3y agoOr the way people blame bars for stuff when it’s the drunken fools who go to bars and drink too much that are the actual problem.
- ribosometronome 3y agoYour analogy is unfair. There's not really any evidence any of the users were using the platform in any way other than intended. I think this would be far more akin to finding out someone has stolen a card number, which has happened in breaches, and used it to purchase a lot. Generally, we do expect recourse on the bank's end.
- dpkonofa 3y agoIt's not unfair. The data that was exfiltrated is data that was accessible to the users. If someone gives their routing number and checking number to a scammer, that is also considered "using the platform in any way other than intended". In 99% of cases, you'd be providing that information to someone you had an actual business relationship with. My employer, for example, might have that info in order to process my direct deposit payments. A debtor may have that info in order to process ACH payments. Giving that info to a total stranger would be an issue but that wouldn't be the bank's fault. Neither would it be the bank's fault if you chose a poor or reused password. That's what happened here. Users shared data with total strangers who requested their connection to their DNA data based on some percentage of shared DNA. Users accepted those requests. The users who reused their passwords had all their info accessible. The users who accepted sharing requests with those users had their shared info accessible. Both cases are "using the platform as intended".
- toomuchtodo 3y agoIf you’re not providing secure MFA as an option and invalidating breached credential pairs via HIBP, you’re negligent as an idp. 23andme failed hard, and they should own it. FFS, default to magic link login via email if you have to. At least then you're relying on Google, Apple, or someone else for auth (in most cases of unsophisticated users).
- dpkonofa 3y agoIt is an option. Every user has the option to setup MFA when they set up their account. The fact that people reused their passwords and chose not to setup MFA is not 23andme’s fault.
- toomuchtodo 3y agoAs a 23andme user who has filed a complaint with the FTC, purposely opted out of arbitration and intending to join a class action, and is responsible for customer IAM at a fintech, I politely disagree. Poor IAM and AAA decisions are a choice, and there must be consequences for resulting harm.
- brvsft 3y agoLol, enjoy your $20 because someone reused their password.
- toomuchtodo 3y agoI don't care about the money, let the lawyers and regulators extract. That is the incentive mechanism.
- dpkonofa 3y ago[flagged]
- toomuchtodo 3y agoI absolutely have an axe to grind against consumer harm incurred by lazy and/or negligent technology companies (all companies, really, just scoping for this convo). Guilty as charged. When good behavior is not forthcoming, spin up regulators and the legal framework. EDIT: I do not believe this is an unreasonable position to take. Years ago, I interviewed with the CTO of 23andme and almost took an infra job there (comp too low) ~12 years ago. I am a customer. I have mostly good things to say about them as an org. That is not a free pass when you do harm. Do better, it is not hard.
- tuetuopay 3y ago> Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user. Well not recognizing you have 14k logins coming from the same place, possibly with a lot coming from someplace else than the last login on the account, is definitely a failure on their part. That's why more and more websites send you emails to allow logins from a new location. Or have login rate-limiters (too many request from your network).
- dpkonofa 3y agoThey weren't from the same place. It was from a botnet over the course of several months.
- tuetuopay 3y agothanks, this was not clear from the article. I wonder how easy it is to have the location (at least country) of a user from the breached data, to use bots in the appropriate country and evade "login from a new location" protections. I guess easy enough if whole accounts have leaked.
- dpkonofa 3y agoIf was indeed a DB leak, as claimed, some sites will have emails/hashes/passwords/last know login location/ip potentially. It’s not a stretch to think that a botnet could run from not only the same country but even the same region or city as the last known login or IP cluster.
- uses 3y agoIn 2023 an org of their size and with such sensitive data needs to give a bit more of a fuck about who is accessing users' accounts. Mass leakage of potentially reused credentials is an ancient concept at this point and should have been on their radar as an attack to protect their users' data against. Basically, they shouldn't have just been relying on passwords to authenticate users. Many orgs of their size and with much less sensitive information than the literal genetic data of their users do a lot better.
- dpkonofa 3y agoAnd how would they know that when the access was done via the correct user/pass combo for accounts where the users chose not to enable MFA?
- disgruntledphd2 3y agoI mean, the right thing would have been to force password changes for the breached accounts. This is doable through have I been owned etal, right?
- dpkonofa 3y agoHow would they know which passwords were breached? The data leak was from a different site and not from 23andme. Additionally, current evidence suggests that the breach was not known on haveibeenpwned prior to it being used and the reused credentials were tested over a period of months using a botnet.
- deleted 3y ago[deleted]
- disgruntledphd2 3y ago> Additionally, current evidence suggests that the breach was not known on haveibeenpwned prior to it being used Totally fair, I haven't been following this really closely. That being said, if someone re-uses passwords once they probably do it a bunch of times, so it's odd to me that they didn't have a process to detect reused passwords and force a change.
- mvdtnz 3y ago> Nothing on 23andme’s end failed Other than allowing at least 14,000 login attempts from the same system without blocking suspicious activity. Nor using services like haveibeenpwned to prevent users from reusing passwords.
- dpkonofa 3y agoIt wasn’t from the same system. It was from a botnet. The account credentials were leaked on Tor. Is haveibeenpwned omniscient? Do they know about every breach out there without fail?
- mvdtnz 3y agoA botnet is a system. > Do they know about every breach out there without fail? They know about a lot of them. I'd hazard a guess that at least three quarters of the affected accounts would have been in HIBP, probably far more.
- brvsft 3y ago> A botnet is a system. How would you detect that these requests are coming from the same "system?"
- dpkonofa 3y agoA botnet is not a single system. It is a network of multiple compromised computers or devices, in all kinds of locations. Each piece of a botnet could be in a different country or even city. HIBP only knows about breaches that are made public. Based on the current evidence, this was not a breach that was made public. It was a breach being sold.
- dvngnt_ 3y agofor sensitive data, logging into an account from a new IP should trigger an email for verification
- jkaptur 3y agoUsers reuse passwords. We've had decades of trying to educate people to do something else (use a password manager! come up with a unique password and keep it in a little book! anything!) but it simply hasn't worked. That's an engineering fact. It would be good if it weren't true, just as it would be good if virtual memory were indistinguishable from RAM, but it just ain't so. To be a responsible engineer, you've got to design and build for the real world, and that means not relying solely on username and password for extremely sensitive data.
- esrauch 3y agoCambridge Analytica also didn't literally hack data or have it shared without a person doing something, right? It seems the part where 14k leaked credentials provided access to millions of users data is where it becomes their responsibility. It means that people who were fully responsible still had their information leaked because of overexposure of the information.
- brvsft 3y ago> people who were fully responsible... We're talking about people who 'friended' others on 23andme, right? How is that responsible user behavior? I had an account with 23andme before I forced them to delete my data, which was not that difficult to do. One of the things I remember was getting friend invites from random people who were distant cousins, and while I suppose that might be fun conceptually, I never did it because I didn't know any of these people. In what world does a "responsible" user who cares about their privacy add access to personal information, on a website that profiles your DNA, to people who are blood-related but still total strangers? I would call that highly irresponsible, personally. But that's just me, an idiot who avoided all of this by deleting my 23andme account half a decade ago.
- esrauch 3y agoThere's no way that 14k accounts has 7 million friends actively accepted, that would be 500 friends on average. It must be that they reveal info about you to other people who have a genetic match and it was heavily scrapable with the stolen credentials.
- morsch 3y agoThey could force their customers to use MFA. I'm sure they considered it and decided they'd rather have the additional income. At the same time, my bank doesn't let me opt out of MFA. Why? Regulation. That's the answer in this case, as well.
- codegeek 3y agoThis is why MFA (not SMS based) is so critical especially for services like this. I sometimes hate it when it is forced on me as a consumer but for these types of services, it absolutely must be enforced. Kinda cop out for 23andME to just blame the users even though users should take some blame of course. In 2024, if you want to access a highly sensitive database, you must be forced to setup MFA at the minimum. My opinion.
- AnimalMuppet 3y agoLet me make sure I've got this right before I shred you. 14,000 users messed up. As a result, hackers were able to log in to 23andMe's computers as those users. (Is that the fault of those users? Absolutely.) The hackers were able to use those logins to steal the data of 6.9 million users, approximately all of which did nothing wrong. How is that part not the fault of 23andMe?
- dpkonofa 3y agoThis is the part you don't have right: >approximately all of which did nothing wrong They shared some of their data with the users who messed up. All of their info wasn't accessible. The only data that was accessible was the data that was shared with these users - in other words, opting in to sharing data with total strangers (which could be argued but is the #1 use case for 23andMe).
- AnimalMuppet 3y agoAh, I see. So if you want to let user A share info with user B (and as you say, that's likely an essential use case for 23andMe), then 23andMe either 1) cannot let user B mess up, 2) cannot let user A share with user B, or 3) cannot protect user A. Of those options, 1) is impossible, though they could perhaps have done more to make it harder. 2) ruins a major use case. That leaves 3)...
- dpkonofa 3y agoYeah… you can’t protect users from themselves and, apparently, others.
- shapenamer 3y agoTech savvy and privacy-conscious enough to use TOR, but not enough of either of those things to both use a service like 23andMe, and not use password keeper or just be aware that reusing passwords is dangerous. What a strange intersection of users.
- dpkonofa 3y agoI think you misunderstood my Tor reference. The person that exhilarated the data from the hacked site attempted to sell the data via Tor, not that Tor somehow leaked user’s data.
- tlavoie 3y agoWell, there were 14K hits from some list of leaked credentials. That likely means that someone was banging away for a good long time, mostly not getting in. While there could be a raft of IPs working in concert, there should be enough commonality to simply be an annoying target, black-holing IPs that attempt more than a couple times.