Slashdot Mirror
Zappos Hacked: Internal Systems Breached
wiredmikey writes "Zappos appears to be the latest victim of a cyber attack resulting in a data breach. In an email to Zappos employees on Sunday, CEO Tony Hsieh asked employees to set aside 20 minutes of their time to read about the breach and what communications would be sent to its over 24 million customers. While Hsieh said that credit card data was not compromised, he did say that 'one or more' of the following pieces of personal information has been accessed by the attacker(s): customer names, e-mail addresses, billing and shipping addresses, phone numbers, the last four digits of credit card numbers. User passwords were 'cryptographically scrambled,' he said."
Is there a site covering breaches like these? It would be nice to have an easily searched database with number of users, the kind of info that was accessed, the attack vector etc.
What?
SOME... SHALL... PASS!
I hope the cyber police do what they can to find the cyber criminals who committed this cyber crime against Cyber Zappos. After all, Cyber CEO Tony Hsie- oh fuck I can't keep this up.
Don't call it a cyber attack. It was an attack. This isn't 1996.
Other than my email, and the last 4 of my nearly maxed out credit card, that's pretty much all public record anyway.
from the email going out to customers:
Subject: Information on the Zappos.com site - please create a new password
First, the bad news:
We are writing to let you know that there may have been illegal and unauthorized access to some of your customer account information on Zappos.com, including one or more of the following: your name, e-mail address, billing and shipping addresses, phone number, the last four digits of your credit card number (the standard information you find on receipts), and/or your cryptographically scrambled password (but not your actual password).
THE BETTER NEWS:
The database that stores your critical credit card and other payment data was NOT affected or accessed. ...translation:
The Bad News is that things are shitty.
The Good News is that people are learning to love the smell of shit.
To suss it all out, they'll need to hire a gumshoe...
Sadly password storage is actually tricky and most places do it wrong (using MD5/SHA1 for example). Covered in Nov 2011 article Storing your passwords properly (disclaimer: I wrote it, and it's a PDF file). One problem is that even if zappos enforces strong passwords users have a tendency to reuse their strong passwords between sites (you can only memorize so much gibberish or passphrases). Hopefully Zappos learns from this and builds a more resilient system.
Is 6PM.COM a part of ZAPPOS? Because they just sent a similar announcement.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
6 pm appears to be a "value" branch of zappos: http://blogs.zappos.com/blogs/ceo-and-coo-blog/2008/02/19/zapposcom-and-6pmcom
So was it salted or just an hash? Without a salt they have all of the passwords pretty easily. They might as well as store the passwords in plain text at that point.
"Don't Panic!"
Shit happens, the way handle crisis is what matters. Zappos was very open about this, sent me an email, asked me to change password, set up new email addresses and web pages for this problem and questions that customers may have, and announced the issue quickly.
I wish more companies would act like this.
"If fifty million people say a foolish thing, it's still a foolish thing."
So, they reset your passwords, if you use a few different passwords across sites and don't remember which is which, you can't try any of these to tell which one you did use at the site.
This seems less secure to me. Resetting the password means you can't tell what password you used there.
Zappos hacked. Mollres and Atticuno come next.
Such a cheerful thing to find waiting for you in your inbox. My email was waiting for me this morning.
I suppose it is a small price to pay for my semi-orthopedic, little old lady Crocs, the ugliest and most comfortable shoes on the planet.
Passwords are becoming a bummer.
"Here's what's happening. You're starting to drive like your Dad..." - Red Green
The CEO thinks it takes 20 mins for his employees to read the email. Does this say anything about the quality of their staff?
...what Zappos is. I mean, why not just call it $companyfunction $company. Would it be so much to say what this company with millions of users does/sells?
Their they're doing there hair.
I assume you mean http://www.tarsnap.com/scrypt.html and https://github.com/pbhogan/scrypt? Looks interesting, I'll have to check them out.
A better idea would be to switch to storing the SRP verifier:
x = H(s,p) ; s = salt, p = password, H() is SHA-1
v = g^x
Store v, s, and u (the username).
http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
Anyone who can get the password (or even the hash) from the above deserves to get them. :)
The Good News is that people are learning to love the smell of shit.
indeed. as one joke in a japanese anime so aptly put it :
...."
....
"Even an old man's armpits grow on you with prolonged exposure
im telling you.... the people making those animes. crazy
Read radical news here
...stop my wife from spending all my money there anyway.
...an "Applications Security Engineer" (http://about.zappos.com/jobs) Duties include: "Develop security improvements for the company’s websites and backend applications." Evidently, this position is still unfilled.
Back in December there was a Zappo's Rock n' Roll marathon in Las Vegas that drew a lot of ire for its many short comings including running out of food and water, replacing said water with non-potable fire hydrant water making many people sick, overcrowding, disorganized medical response teams, etc. It would not surprise me to learn that some one decided to inflict this attack as retribution. However, that's just speculation. There are plenty of other feasible motives.
For those in the Vegas IT/InfoSec community and have heard the stories (or have firsthand experience) of their hiring/screening process, this was only a matter of time. If you are screening out the folks with the hacker/InfoSec mindset (those that think differently/outside the box), are you hiring the best folks for the InfoSec role?
Seems the 'cool kids club' at Zappo's was not enough to defeat the attackers.
n/t
Zappos is owned by amazon isnt it? Does that mean this was actually a significant breach of amazon cloud services?