3 ms·
> Nothing on 23andme’s end failed Other than allowing at least 14,000 login attempts from the same system without blocking suspicious activity. Nor using servi
by mvdtnz 3y ago
> Nothing on 23andme’s end failed
Other than allowing at least 14,000 login attempts from the same system without blocking suspicious activity. Nor using services like haveibeenpwned to prevent users from reusing passwords.
- dpkonofa 3y agoIt wasn’t from the same system. It was from a botnet. The account credentials were leaked on Tor. Is haveibeenpwned omniscient? Do they know about every breach out there without fail?
- mvdtnz 3y agoA botnet is a system. > Do they know about every breach out there without fail? They know about a lot of them. I'd hazard a guess that at least three quarters of the affected accounts would have been in HIBP, probably far more.
- brvsft 3y ago> A botnet is a system. How would you detect that these requests are coming from the same "system?"
- dpkonofa 3y agoA botnet is not a single system. It is a network of multiple compromised computers or devices, in all kinds of locations. Each piece of a botnet could be in a different country or even city. HIBP only knows about breaches that are made public. Based on the current evidence, this was not a breach that was made public. It was a breach being sold.
- mvdtnz 3y ago[flagged]
- ziddoap 3y agoUnnecessarily condescending comment. You said: >Other than allowing at least 14,000 login attempts from the same system But from 23andMe's end, they didn't see these login attempts originating from a single system because it was from several locations, with different user-agents, fingerprints, etc. How do you propose they were to identify these various computers to be part of the same botnet? If you have a reliable way to do so, many people would pay you large amounts of dollars for that service.
- velavar 3y agoWorking in fraud prevention and I would love to know how to detect a botnet system, beyond the usual velocity checks. A decade of working in this space and I haven't found a reliable, fail-safe way to do this. Genuinely interested to know if there's a suggestion.
- peddling-brink 3y agoWatching failed password attempts across the board is a simple metric. Correlate that with the ips responsible for the sudden increase and you have a starting point for your investigation and remediation.
- lolinder 3y agoHas anyone said that the login attempts all came from the same system? A smart attacker would spread the logins out over a large number of devices and a long period of time to avoid detection.
- mvdtnz 3y agoWhat do you think the word "system" means? Do you think it means "computer"?
- beambot 3y ago"System" could refer to a botnet -- i.e. a whole bunch of distributed computers from which the credentials may have been exfiltrated.
- lolinder 3y agoIn context, "computer or collection of computers that are distinguishable as a unit by the server they are attacking".
- mvdtnz 3y agoI'm not really sure how to proceed with a conversation in which you invent, from scratch, your own definitions of the words I am using.
- lolinder 3y agoFrom Wikipedia [0]: > The term computer system may refer to a nominally complete computer ... or to a group of computers that are linked and function together The only thing that I added was "that are distinguishable" because you implied that the server ought to be able to tell that this is a coherent attack by a single system and not just normal traffic from unrelated systems. If victim hosts do not have enough information to recognize the disparate computers as part of a botnet, then from the perspective of the attacked host the computers are separate systems. [0] https://en.wikipedia.org/wiki/Computer https://en.wikipedia.org/wiki/Computer