Slashdot Mirror
Adobe Hacked: Almost 3 Million Accounts Compromised
sl4shd0rk writes "Adobe Systems Inc. is expected to announce today that hackers broke into its network and stole source code for an as-yet undetermined number of software titles, including its ColdFusion Web application platform, and possibly its Acrobat family of products. The company said hackers also accessed nearly three million customer credit card records, and stole login data for an undetermined number of Adobe user accounts."
It's too risky to give your credit card number to a company like Adobe.
...to a nicer company. I feel bad for their customers, but I'm hoping this kind of breach pushes people to insist that their sensitive data isn't stored when it isn't absolutely necessary.
you can still buy offline standalone applications from adobe.... oh, wait.
However, as far as the source code is concerned, Adobe assured that there is no "increased risk to customers as a result of this incident."
In other words, the risk is as bad as ever.
What are the odds this attack didn't involve a pdf exploit?
...can't wait until the hackers fork their code, and create something stable and less buggy from it. It will obviously take lots of work, but if they have the skills to hack in, they're up to the challenge.
"National Security is the chief cause of national insecurity." - Celine's First Law
I bet they used Flash to get in: since Adobe seems to be pushing Flash updates about every 10 minutes lately, it's evidently got some major security problems.
Doesn't say much for the security of ColdFusion. Maybe it's time for Adobe to stop eating their own dogfood.
I am becoming gerund, destroyer of verbs.
According to TFA :"no "increased risk to customers as a result of this incident."
Considering that Adobe products are an endless stream of security vulnerabilities and zero days, I would say this is a fair statement. You have the same risk as you had before, when you allow their products onto your machines. As for the credit card data - shame on them. Why was that even on the same network?
Seven puppies were harmed during the making of this post.
Ok, I won't say gimp. How about Corel Draw?
Adobe must be the one company in the world to have a worse track record at security than Microsoft, Oracle or Mozilla. They have ignored industry best practices and been a thorn in the side of the rest of the industry for years while being oblivious to the damage their customers have suffered from their shoddy practices.
This is the same company that wants you to rely on their security as the only way to their products now that they only rent a cloud based versions of Acrobat Suite. Incidents like this are inevitable and people need to learn that their is nothing magical about the 'cloud'. Companies that have cloud dependencies for the use of their products necessarily expose all of their customers when they get cracked.
Do you trust Adobe with your security? Do you really think a company with their track record is going to get their act together?
This makes me happy to have p1r4t3d versions of CS5 and CS6.
Adobe doesn't know my details and neither do the hackers, easy peasie lemon squeezie.
Laughter is the Spackle of the Soul.
This is big news. Expect untold exploits for the Adobe technology stack to emerge out of this. If someone or some group is determined to run Adobe into the ground, they are off to a good start.
Your post looks photoshopped. Yep, definitely. The reflections are all wrong.
Ezekiel 23:20
3 million plaintext numbers means that Adobe's PCI team rides the short PCI bus to work...
Buying a piece of software from a vendor: Adobe doesn't have your details.
Paying on a monthly basis to a software company: Adobe has your details.
Your point about the inability to see the future is intact. However, it doesn't discount being able to predict the potential future based on math and science.
Laughter is the Spackle of the Soul.
ColdFusion is built on JRun which is the most miserable POS Java servlet container conceived by the mind of man.
Since the source code is out maybe it will get some bug fixes.
photoshopped reflections expert here, can confirm
So, let me recap.
Adobe just lost the source code to one of the most exposed attack surfaces known for vulnerabilities?
That'll be one hell of a peer review.
The articles so far seem to indicate the card numbers were encrypted.
"We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
Thank God I've never actually purchased any Adobe products. Phew, that was a close one.
Organization? You must be joking..
After which episode that Adobe had credit card records stolen from it did you make that decision?
Adobe may or may have had one before.
But there are enough other companies that have, that it's easy to make a rational choice based on the probability that it will happen to a company like Adobe, based on what has happened to companies at large that attract large bases of credit card numbers - especially as Adobe has recently moving to a subscription based service where they have presumably got a lot more credit card numbers stored than they used to before.
That was a factor in why I decided that I would not subscribe to the Photoshop subscription, even though the more recent photographically oriented pricing for just a few products was more appealing.
I'm all for paying for products myself, I do so whenever possible. But what I am not for is needless exposure of my financial data just because a company would prefer recurring revenue.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
At my work, they require us to take annual security training ... and this year, I flat out refused to take it from any of my systems ... because I had to install flash & turn on java in my web browser. I had to go to the 'training center' to take it from one of the machines there.
... not a week later, the first of the 2013 Flash vulnerabilities was announced ... then a couple of weeks later, another one ... then the Java one ...
Then I was told that I had to take the 'advanced security' training ... what was the recommendation? to turn off flash & java in your web browser.
ah, the irony.
Build it, and they will come^Hplain.
Citibank offers "Virtual Credit Cards" that are generated for you on demand. Each card is valid for one merchant only (the first transaction locks the merchant), has configurable expiration date and maximum amount limit. Even if stolen such virtual cards are of little use to the bad guys.
It's now running on a heavily customized Tomcat that's been twisted long enough until you could no longer simply update it independently.
stenography efforts flagged
That's why I stick to writing longhand. Take that Adobe!
Forget the credit card info - the real juicy stuff for a criminal would be to get whatever is needed to trick the update feature to trust a malicious piece of code (especially if it can be automated without user interaction!)
This is the most important thing I want to hear from Adobe's response team: Did the attackers get what would be needed to do this, yes or no?
I'll take this one further:
Buying a piece of software from a vendor: Adobe doesn't have your details.
Paying on a monthly basis to a software company: Adobe has your details.
Software vendor not named Microsoft most responsible for exploits and attacks in the last 10 years: Adobe Systems
If they can't even keep something like Acrobat Reader secure, how the hell does anyone trust them with credit card information? The long road that has been "software activation" led us to this place.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.