Slashdot Mirror
Adobe Breach Compromised Over 38 Million Users, Photoshop Source Code
rjmarvin writes "Adobe's investigation into the massive data breach they were hit with this past August has revealed that over 38 million active users, not to mention inactive accounts, had their user IDs and passwords pilfered by hackers. An Adobe spokesperson confirmed the number, along with the theft of Adobe Photoshop source code. The initial report earlier this month put the extent of the breach at only 3 million credit card accounts, plus stolen Adobe Acrobat, Reader and ColdFusion source code."
The breach was made possible by a bug in Adobe Acrobat Reader I hope.
That would be Karma.
I can finally write that lens flair javascript library
-- Jim
Weekly feedback for your website.
The untold story is that the hackers tried to give back the source code but Adobe said NO GIVE BACKS!
Adobe hasn't notified me of anything so my data must be safe. Right?
Right?
So how's that new "Cloud all the apps" thing working out for you guys so far? Ah. I see you leaked pretty much your whole database of people who had signed up for it. Well then, carry on.
In other news, I hope your new strategy crashes into the dirt so hard the only thing that'll be memorable about Adobe in 5 years will be is the case study on it in business classes around the world on how not to do it.
#fuckbeta #iamslashdot #dicemustdie
I know we're gonna get all the "ha ha, it's an evil megacorp anyway", but damn it must be stressful moments to some of the folks at Adobe. :/ Especially if the source code leaks turn out to be true.
I keep hearing about this breach and that breach, but what I'd love to see are some seriously ambitious groups of skilled security engineers standing up to help encourage good security practices that are widely recognized and standardized. The networked computing eco-system is so intertwined and desperate that how can any Jack or Jill admin be expected to have a fair set of skills in their toolbox to tackle such a hurdle? To expect any or ALL admins to have enough competence to just know the depth and complexity of a highly enabled enterprise is very unlikely.
For a possible first step, lets consider blocking broadcasts by default. All computers fall into 255.255.255.254 and rely on tight enforcement of shared communication as a reasonable start.
A second may be for all communications channels to be flagged with security credentials of the communications user (or machines), or anonymous for completely un'authorized' communications and rely on block by default as a sane start. Allow 'users' to reach out to unsecured locations if you like, but make sure that their connection to secured resources are a lot harder to reach (and fully audited when performed)
Anyways, this is a huge problem which is at least in part to why this happens over and over again. I could say X, and 100 experts will give me 101 answers to why its the most stupid solution in the world, so.... enjoy!
Bye!
While I fully realize that it would be both wrong and illegal, with the Photoshop source code in the wild, is it possible some of it could added to or at least quietly re-engineered into OSS projects? Real CMYK support for Gimp would be like birthday + xmas combined times a million.
Brought to you by Carl's Junior.
I don't. Their source code would be better off in the hands of just about anybody else, including monkeys with typewriters.
This is my signature. There are many like it, but this one is mine.
Bring it! :D
Anyone else wondering why the sourcecode was even able to be accessed? Seems like a stupid thing to have on a web server, or able to access from a web server.
That's like leaving a laptop sitting on a seat in car while you are out shopping/whatever.
Be seeing you...
Even the best of security practices does little to dissuade them when all of the eggs are in one basket.
I know it's popular to rubbish Adobe here, but this report, if true, would seem to justify the Adobe-hate.
And I say this as someone who has happily used many of their products over the years, (although less so, lately).
Yes, we all know security is hard, but if you're a leading tech company with internal safeguards so lax that one breach can leak both user IDs and source code well, frankly, you're shit.
I don't. Their source code would be better off in the hands of just about anybody else, including monkeys with typewriters.
I was under the impression that it was initially created by monkeys with typewriters.
"Never let your sense of morals prevent you from doing what is right" - Salvor Hardin
including monkeys with typewriters.
It's unfair to marginalize the support team like that. They work hard.
Science advances one funeral at a time- Max Planck
I understand this is /. but I don't understand why every "insightful" post is against Adobe. Adobe has marketed to to their users. Their market is not an opensource market. Their market is people who want something that works. Their IP is priceless and I believe their "Cloud" platform has been correctly. Up until they offered Creative Cloud I never had a licensed version of an Adobe product. I now have a licensed adobe product on my home and work computers. They are not evil by any means. My subscription can lapse and things still work. Programs are installed locally. The only connect now and then to confirm the license. I now get updates on a regular basis. Their code is considered top notch by professionals. I have rarely had an Adobe application crash on me. It just works. You can't say that about any of the competitors, open-source or not. I've tried using Gimp or Paint Shop Pro. They don't even compete with Photoshop.
As far as we know this breach has nothing to do with the "security" or "programming ability" at Adobe. It could have easily been an insider. Or maybe just someone who knows what they are doing and has been at it for years. Any system can be easily breached internally and any system can be breached given time.
Stop making assumptions and look at the facts. The facts about the situation are non-existent. The facts about their programming ability is public knowledge and they have proven themselves. Anyone that thinks otherwise... show me what you have done that has the capabilities of their software. You won't. Their software (Adobe Acrobat) is used everywhere. More than Flash was (Flash was Macromedia, not Adobe) If it sucked it won't be used. Don't give me any analogies about how Windows sucks and it still is used! Windows doesn't suck. Any professional Linux user will agree that it satisfies its market, which happens to be a very large market. I love Linux but all my computers have Windows. Why? because it works as it should. Oh it's not free? You get what you pay for. That goes for Adobe products too. Talk to one of their programmers. Find out what a real development environment is like. Ask them how much time is devoted to their product. Ask them how much time is devoted to testing. Ask them how much time is devoted to refactoring their code. This is not Microsoft. They can't get away with just adding on. They invent and make new. They are worth it.
A small hiccup like this is nothing. It has happened to companies magnitudes greater and no one blinks an eye. Adobe as been completely transparent about what happened.
They should be applauded for their efforts to inform people.
I can't wait until slashdot is compromised. It will happen. My encrypted password will be stolen. Oh no! 100's of sites have my encrypted password. Just like they all have yours. Oh... you use a different password for every site. First.. I call BS! You don't. You want to project a fake reality. Fine. You are then just stupid. You really only need 3 - 4 different passwords.
1. Banking/PayPal
2. Email
3. Other Sites
4. Optional/ Social Sites (could fall under "other sites"
This keeps you safe. A max of 4 passwords. If you can't figure out the logic, then just move on.
So how does all this roll back into Adobe?
1. If you use only 1 password you are stupid.
2. If you use 2 - 4 passwords, you don't care.
3. This isn't Adobe's fault, it just happens.
4. If it bothers you then why do you have an Adobe account in the first place?
5. We all use Adobe products and could not live without them. (btw... this is not a monopoly! think before you respond with those ideas)
I think this is enough to get my point across.
High cost and stagnant development weren't enough?