11 ms·
Hackers raid eBay in historic breach, access 145 million records
- panarky 12y agoNew information in this article: 1) The user database wasn't just accessed, but 145 million user records were stolen. 2) eBay hired FireEye's Mandiant subsidiary to do the forensic work.
- adventured 12y ago"EBay spokeswoman Amanda Miller told Reuters late on Wednesday that those passwords were encrypted and that the company had no reason to believe the hackers had broken the code that scrambled them." That seems to imply that eBay used a singular encryption key across its accounts. Surely not?
- panarky 12y agoJournalists and PR people don't know the difference between encryption and hashing. eBay is steering media reports toward the password story. Much more important and potentially damaging to eBay's reputation and revenue is that 145 million user records were stolen. This could be much more damaging than the Target or Adobe breaches.
- SoftwareMaven 12y agoTarget had payment info. That trumps this easily.
- tommu 12y agoLike panarky, I wouldn't take that on face value. I'm going to guess that a significant number of people use the same password for Ebay as for Paypal. Someone's got a lot of incentive to generate some hashes tonight..
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- ghshephard 12y agoHere is what I get when I try and change my password: Page not available Ebay is asking its users to reset their passwords due to the unauthorized access to our corporate information network. This may result in a delay of service due to the high traffic volume. We ask for your patience and that you return to eBay soon. I wouldn't think that "password changes" were really that heavy a function. Edit - Finally got through. They are not letting you change your password directly, you either need to respond to an SMS or Email. Probably a (very) good idea if they are worried that someone has done a bulk theft of passwords.
- yeukhon 12y agoI changed it this morning and had no problem. Yeah I agree that's their intent to stop bad guys from changing passwords.
- fatbat 12y agoActually having difficulty even locating where to change my eBay password! Also I did not receive ANY emails from eBay regarding this. Not sure if it meant my account was not affected, or it is just taking a while... ( EDIT: Finally found it, http://ocsnext.ebay.com/ocs/sr?st=1&query=How%20do%20I%20change%20my%20eBay%20password http://ocsnext.ebay.com/ocs/sr?st=1&query=How%20do%20I%20cha...? )
- digitalengineer 12y ago"3 months ago"... And "eBay suggest users chanche their password"... Wait, what? I suggest a policy where important breaches in security are disclosed within a short timeframe.
- watson 12y agoThey didn't know about the breach until about two weeks ago [1], though that doesn't normally excuse that they waited two weeks to go public with the knowledge. One reason to hold back this information is if going public would make their investigation harder OR if going public would increase the security risk (e.g. if the security hole used wasn't yet fixed and going public meant disclosing something about how the hackers got access). But according to what had been made public so far this doesn't seem to be the case. [1] http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-users-change-passwords http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-u...
- digitalengineer 12y agoAgree. Those should be the only reason not to disclose breaches (to the public).
- throwwit 12y agoWith such a large user database, why isn't tar pitting db requests the norm?... or at the very least, instituting something as simple as a flag on dummy record requests?
- thrownaway2424 12y agoA flag on dummy record requests? You mean have records that don't correspond to real accounts, and audit access to them? How would you censor them from legitimate full traversals of the user database? How would you tar-pit attackers without throttling such legitimate processes?
- dchest 12y agoThere's an interesting project called "Honeywords" (one of the authors is Ron Rivest) http://people.csail.mit.edu/rivest/honeywords/ http://people.csail.mit.edu/rivest/honeywords/ Link to paper: http://people.csail.mit.edu/rivest/honeywords/paper.pdf http://people.csail.mit.edu/rivest/honeywords/paper.pdf (see also recent paper "Some Remarks on Honeyword Based Password-Cracking Detection" https://eprint.iacr.org/2014/323.pdf https://eprint.iacr.org/2014/323.pdf)
- rdl 12y agoSeems easier to just delete my account.
- thrownaway2424 12y agoYep. My ebay account can go to its final resting place, next to my linkedin account and my yahoo account.
- christogreeff 12y agoBut "they" already have you personal information?
- presty 12y ago> Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay's corporate network, the company said. Working with law enforcement and leading security experts, the company is aggressively investigating the matter and applying the best forensics tools and practices to protect customers. Seems like the kind of tactic used by spy cells to target people in certain places.
- nzonbi 12y agoBillion dollar startup opportunity: un-hackable, secure databases as a service.
- avelis 12y agoI believe the initial attack was coordinated via social engineering.
- beedogs 12y agonothing's un-hackable.
- Noctem 12y agoYou mean like when Oracle claimed that its servers were "unbreakable"? It's a ridiculous claim for anyone to make.
- pjc50 12y ago"Much more hacker resistant" authentication is certainly something you could sell as a service; but it's not cheap and nobody wants to pay for security.
- nly 12y agoHow many billion $ companies will it take before we finally rid ourselves of plain-text password authentication (regardless of whether or not it's performed over TLS, or they're using a 'good' hash function for verification)? The lack of a usable secure password authentication standards for the web is the most pressing issue in web security these days. If there's one thing in the next HTML standard that should be depreciated, it's <input type="password">
- dchest 12y agoThere is no usable secure password authentication standard that will protect from password compromise after password database leak. In fact, if you're talking about SRP, it's worse in this regard compared to, say, using bcrypt.
- nly 12y agoSRP as published in RFC2945 (circa 2000), which uses SHA-1, is worse. The protocol and general idea is a lot better, and can be adapted to use any hash function you like. Replacing RSA with EC is also trivial. Half a day and a room full of cryptographers and browser guys and you could RFC these changes. Given more time, I have no doubt that they could come up with something entirely new and web-centric. We have a standards body responsible for stewarding the web, and a handful of some very smart and well resourced browser vendors who can solve these problems. Ultimately these guys have to take this burden eventually, and these people write web standards... not having a standard yet just isn't an excuse. Why aren't they doing so? Is it because they're more interested in pushing their own platforms and authentication solutions (hint: all 3rd party authentication is horrific). It's not like Google, to pick one, is shy when it comes to developing their own protocols. And it's not just protocols... why don't browsers come with cracklib style hints regarding password strength yet? Why no builtin password generation to go with the existing password storage? So many things not being done because it's easier to blame the next company when their database is compromised than cooperating to solve hard technological and UI failings.
- dchest 12y ago
- lena 12y agoIs it safe to change my password now? All I read in the article is how much they are investigating this. How do I know the hackers don't still have access and are now actively monitoring password changes potentially getting more info? I am concerned that there is nothing about this on the eBay front page and that I have not received an email from eBay about this
- jacquesm 12y agoI wonder if this means the dutch auction site 'Marktplaats' also had its data copied. PayPal is apparently in the clear (not that I would ever use them again), but I do have a Marktplaats account and that's an ebay subsidiary. (they got bought out after ebay realized they were not going to be able to out-compete them).
- robomartin 12y agoJust changed it. I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password. I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example, if the question is "What's the name of your high school?" the answer could be "violet and purple are similar". In other words, make it impossible to socially engineer the answer to such questions. I wonder if these answers were also stolen.
- watersb 12y ago> I don't understand why eBay (and others) don't offer two-factor authentication eBay implements 2-factor auth via a PayPal s/Key hardware token. https://www.paypal.com/securitykey https://www.paypal.com/securitykey
- robomartin 12y agoDoesn't that just protect PayPal? How does it protect from someone social-engineering their way into your eBay (not paypal) account through, say, customer service?
- jacquesm 12y agoI don't understand why after a breach of this magnitude people continue to use a service, but just change their passwords and then move on.
- chrissyb 12y agoWhat is the new eBay? That's a serious question too, not rhetoric.
- jacquesm 12y agoExcellent question, I had ebay in a post I was preparing, I've updated the text and bit and posted it. http://jacquesmattheij.com/ripe-for-disruption http://jacquesmattheij.com/ripe-for-disruption Ebay has been setting itself up for failure for a long time now, but I'm not surprised that people decided not to take on Goliath. But with this incident there might just be an opportunity to swing the scales in favour of a new entrant.
- guelo 12y agoOk, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
- dchest 12y agoYou need to know how they store passwords because ... what?
- hackinthebochs 12y agoSo we can understand the risk of compromise.
- dkarapetyan 12y agoAmazon is probably next.
- jacquesm 12y agoIt probably isn't for lack of trying that this has not happened.
- khoitran19 12y agoCan someone please help me understand why their stock price was not impacted by this? I observed Target when similar incident happened and nothing seemed to change. Is the general market neglecting security exploitations or is the damage too small for those big companies? I personally think that it's a big hit for the companies. They will have to spend money to patch it up and also lose trusts from users.
- iLoch 12y agoTurns out most people probably don't give a shit and likely won't change their passwords now unless they're forced.
- Krunkzie 12y agoToo bad security isn't a concern; only the almighty dollar, right? Cheap excuses for security only add salt to the wound.
- dawkins 12y agoFrom the comments: "This really won’t affect anything. Most people these days are use to being hacked, spied on and violated."
- jacquesm 12y agoNice intrusion detection system they have there. And being able to exfiltrate a chunk of data that size without any alarms going off does not bode well. For all you know there is now a copy of the full db living somewhere else, not just the userdata but also every trade those users ever made. This would allow a whole bunch of other trouble to happen given that addresses and other information were also present in the data taken. For instance, this could be used to set up a series of targeted raids along the lines of what some gangs have done in Europe in the last decade. Knowing who has expendable money, buys fancy art, expensive jewelery, what it looks like and so on could help a lot during the planning of such an excursion.
- rhubarbcustard 12y agoJust tried to change my password and got: "White spaces are not allowed in password." Is there a valid reason to disallow spaces in passwords? I can't think of one.
- KbcdPfA 12y agodump: http://pastebin.com/vmvjGw3N http://pastebin.com/vmvjGw3N
- TTPrograms 12y agoAn idea I had a while back - Build browser add-ons and a javascript site that performs N hashes of your master passphrase (high entropy) concatenated to the website domain (google, ebay, etc.). Set that hashed password to be your password on each website. Then when you use a computer you enter the master password and it generates all the domain-specific passwords. If that website is breached only the specific password is released. Even if someone knows you're using this scheme you can make it arbitrarily difficult for them to break it and get the master password by making N arbitrarily large. This way you could use one master password to procedurally generate all of your passwords from any computer without relying on cloud/storage while still keeping them relatively independent. It's sort of weak to rainbow tables, but you could make N large enough and use a high enough entropy password that this would be a negligible threat I think. Thoughts?
- zepolen 12y agoChanging the master password will be a problem because you will have to update every site your have an account on.
- TTPrograms 12y agoYeah, that's kind of annoying. You could probably get autofill working reasonably decently, but it wouldn't be easy.
- tonylemesmer 12y agoI class any address, date of birth, phone number information about me as "financial related data" as it is used by my bank to identify me. I wish eBay would stop trying to play down the seriousness of this breach. Also, on the BBC news this morning (Thurs AM UK) a journalist seemed to hint that "passwords may or may not have been encrypted".
- msderosa 12y agoWith eBay's response to date, there is very little information that allows users to better evaluate a service in which they have invested trust. Questions of trust and safety are natural for people to raise in a variety of everyday circumstances. For example, when people get on a plane or take medicine its natural for them to be concerned about the safety. In eBay's case, eBay is a market place and a financial services company so it's reasonable to ask for high standards and to question what their security practices are like. One would also think that eBay would have a strong interest in developing trust between themselves and their customers, but there is little evidence of that recognition. Specifically, the going corporate standard for a major security breach among eBay's corporate peers is (a) full and (b) immediate disclosure. By (a) full, note, that eBay has come our with a very murky statement about exactly what happened. There is nothing more substantial than "you should change your password but we don't think there is any danger". Well, was there general database access? Did attackers had access to production servers? All of them? Is there any impartial 3rd party audit that stands behind eBays security statements? Further, as part of a full disclose, it's good procedure to disclose how passwords were stored if they expect to establish trust. They have had 2 weeks at least to prepare their statements and they can't do better than the useless "passwords were encrypted"?. There are really only two possibilities here: (1) passwords were combined with a random salt and then hashed or (2) they were morons. And right now given their public statement it looks like (2). By (b) immediate, note, its not unreasonable to expect that a certain percentage of eBay's users use the same username / password for both their eBay and their PayPal accounts. So for a couple of weeks now eBay has been aware of a potential financial danger to their customers and they have been sitting on the problem. Fail. Security breaches happen to everyone. There is no faulting eBay there. The fault is with all aspects of their response. They have had a major security breach and they have not responded with a proportional disclosure. And that implies that security isn't their largest company problem.