Slashdot Mirror
Vudu Resets User Passwords After Burglary
New submitter Chewbacon writes "If you can't hack it, smash and grab it. Video streaming service Vudu has emailed customers informing them of the theft of hard drives containing customer information. CNET reports the information on the stolen drives included: names, e-mail addresses, postal addresses, phone numbers, account activity, dates of birth, and the last four digits of some credit card numbers. Vudu's Chief Technology Officer Prasanna Ganesan said while no complete credit card numbers were stored on the hard drives and expressed confidence in password encryption, he felt the need to be proactive with the password reset and encouraged users to be proactive as well should the encrypted passwords become compromised. Vudu fails to mention, perhaps in a downplaying move, the last 4 digits of a credit card and much of the other information stolen is often enough to access an account through virtually any company's phone support."
when the thieves come in thru the window. (No, not Windows OS, but the actual window.)
Be seeing you...
keeping a night-watchman (armed guard) on duty during "off hours" would have more than likely prevented this
Politics is Treachery, Religion is Brainwashing
Does used commodity x86 server gear(with hot serial numbers, no less) actually have enough resale value somewhere that it would be reasonable to imagine that the thieves might actually have been after the hardware, or would they have had to have other motives(whether data access, or something else they thought was in the building) to make taking the risk worth it?
I can see the case for smash-n-grabs on consumer gear, especially laptops and iDevices and such, where gullible and/or morally flexible people do seem willing to buy dubiously sourced goods for a chance at cheap consumer electronics; but the phrase 'used hard drives from ebay' is the sort of thing that I'd only ever use in a server context if I were sneaking up behind an admin and trying to make him jump and turn a curious shade of purple...
Is the used market more robust than I give it credit for(or the scrap value higher)? Or would grabbing the hard drives be a fairly clear sign that you are after what is on them?
Security through obscurity: My data is safe, even if the thieves break in. No way they can find anything in the mess that I call home. :)
Everything was encrypted and the key was not stored locally, right? RIGHT? Fucking amateur hour wherever you look.
Wish I knew which fucktard started that. The first 4-6 digits identify your card issuer, so if I knew you had a discover card (6011) and the last 4 digits, it would halve the search space for your card and LUHN will take care of a huge chunk of the rest. I once freaked out a coworker by reading her credit card number aloud as she typed it from across the room - she had the same university CC I had, the first 8 digits were the same. Look in your wallet and tell me how many cards you have from the same bank? If you were given back the first 4 digits of the card # on your receipt, you'd know exactly which card you used. Nobody else needs to know.
i'm a customer and i wouldn't have known about this if not for the slashdot article.
as a vudu customer the worst part is the realization that i can't cancel my account, can't remove my credit card info, and can't do anything other than sit on my hands. they offer some year long identity guard protection that looks more like a scam than anything actually useful.
googling to find out how to cancel the account reveals their suggestion of following the steps on their FAQ only there aren't any steps on their FAQ. instead there are complaints on google from 2008 onward about there being no steps to cancel on their FAQ. can't delete the credit card info without adding a new credit card. calls to their support desk let me know they don't open for hours (thanks for taking this seriously enough to extend your support hours) so i'm left sending an email to support@vudu.com and hoping someone decides to cancel my account otherwise there's nothing i can do.
sad thing is this is currently the most common way online businesses operate.
It strikes me as a little silly to think that the type of personal information on those drives is somehow going to stay a secret. You have to give it to dozens of organizations: banks, employers, stores, and so on. So using this information as a security identifier is a very flawed approach. We seem to accept this since the level of fraud is tolerable. Plus the alternatives such as smart cards are extremely expensive to implement across all of society.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
How much do you bet this data was copied onto someone's laptop, sitting on a desk, rather than a thief breaking into a datacenter and pulling an entire server?
that quite a few providers do not take security seriously. I know, having been in IT security for many years, that these types of services and companies attract the attention of miscreants looking for low-hanging fruit.
It's well known that once anyone has physical access to your stuff, all bets are off. Security is a process, not a product. No amount of guards, firewalls, etc., make a difference if your processes suck. No security is 100%, but what with so many companies being affected by either theft, cracking, DDoS attacks, etc., the idea of "defense in depth" has not sunk in. Companies are too quick to see the dollar signs but loathe to protect the investments allowing those dollars to flow.
I, like many other techies, am fascinated by online services (let's not say cloud, OK?) and what they can offer, but until online providers take security seriously, I refuse to place one bit on a server I do not control personally. I understand that spending money on security and setting up good processes is not only time consuming, but can be very expensive, but it's a most necessary item. Companies are loathe to spend money on things like security because there is no ROI on security. Apparently, there is no ROI without good security processes and defense-in-depth security.
Anybody hear ever use vudu?
Yes, I. Use VUDU...solely because every BD I get has a redemption code for Vudu and UltraViolet. I'm not worried; they essentially got data on my that's accessable...last 4 of the CC number? That's been out there since. Everyone else merely just gets hacked. I don't use the same identity details on important things...you couldn't access my back with jus VUDU info...you need several pieces of info for that. At lease they're doing something; most places just say you're on your own and we're sorry...VUDU gave everyone affected a year of AllClearID identy protection.
Ganesan does not appear to have actually said "proactive" twice, or even once. "New submitter Chewbacon" is apparently a marketing droid.
Seems like they would be better of just stealing drives than hacking anyway. What with how every da wants to make an example out of hacker types.