Slashdot Mirror
eBay Compromised
New submitter bobsta22 (583801) writes "eBay has suffered a security compromise requiring them to have all users change their passwords. As yet only a press release. Lets hope there's more juice on this."
From the press release: "Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay's corporate network, the company said. ... The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. However, the database did not contain financial information or other confidential personal information. The company said that the compromised employee log-in credentials were first detected about two weeks ago."
what, no link to the press release?
"For I am a Bear of Very Little Brain, and Long Words Bother Me"
A major news story, about a ginormous compromise gets published on Slashdot and there is NO source or link?
Sig it.
How much you want to bet they have been sitting on this? Probably waited until X number of people were compromised and they couldn't cover it up any longer.
Things like this would not happen if security policies were in place to force password changes.
Got to love a major ecommerce vendor who can't even get THAT right!
At some point, that has to count as negligence, and some sort of liability ought to attach.
So they didn't get payment information, but they got everything they needed to apply for credit in your name. Perfect. It took me an hour to buy my last laptop in a retail store with my credit card in my hand because my card company was so totally paranoid about fraud that they put me through the third degree to ensure I was who I said I was. And it's just going to get worse.
At this rate cash will be king again. Oh no, wait, that can be fraudulent too. Essentially, it is getting impossible to spend your own money.
I am not interested in articles about life extension advancements.
If eBay US was using a static salt like eBay Japan was, this is a big deal. If they were using a proper (random) salt, and a strong hash, it's not that big of a deal. Does anyone have any idea how eBay hashes the passwords?
I'm not worried about it if they were doing something like:
UPDATE user SET password= ENCRYPT(password, CONCAT('$5$' , uuid(), '$')
http://money.cnn.com/2014/05/2...
Just one more company giving one more reason why corporations should not be allowed to store personal information beyond what is absolutely necessary. Birthday would not necessarily need to be stored anyplace directly accessible, unless it was legally required but could instead be replaced by a flag for "above 13", "above 18", "above 21". If they absolutely needed to have the birthday for representation or audit purposes it could be stored in an offline version that could be brought online as needed.
In the end, efficiency was prioritized over the need to secure personally identifiable information (PII). eBay should not have stored so much PII in the same database, it should have been stored separately and linked on retrieval.
Sadly, security requirements being ignored or missed during design is a commonplace occurrence and they don't get fixed until something like this brings them to light.
Seems the people at eBay are completely losers, thanx to slashdot I just had a chat with the support at the UK eBay, they confirmed that I should change my password for my own safety, but NO fucking reply why there is no announcement on the local (ie. UK) site. They just only know well to milk their customers (Paypal) too with their fees.
The top management of eBay is going, "OK, the hackers got in, stole the credentials, but what can they do with it? What good does it do to them? They got to sell it in eBay, right? It is in their own interest we stay afloat to provide them sheep for fleecing right? So we are likely to survive till I make bonus right? After we get our boni who cares what happens to the company? I should be able to find another company to wreck next year".
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The personal information screen shows me the length of my password, in asterisks. They wouldn't know how long my password is if they were storing it securely.
It's OK to write down your password. Just keep the card in your wallet instead of on your monitor. You probably already keep a piece of plastic with your credit card number on it in the same wallet anyway.
I was wrong. They are always showing eight asterisks. It's not the length of your password unless your password is eight characters.
item not as described. password salt was actually pepper!
--
"It is now safe to switch off your computer."
Are they following the required procedures in each jurisdiction?
http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx
These laws seem both plentiful, varied and complex. I hope their coporate legal department wasn't planning on sleep for a few months.
I get emails from Ebay all the time recommending I change my password. They even provide a handy link in the email for me to click on.
The hackers gained access to " name, [...], physical address, phone number and date of birth"
But they "did not [access] other confidential personal information"
What other personal information is there on the planet? Your name, address and DOB is pretty much everything needed for identify theft.
Okay - I guess they didn't get Health records. Seriously though - what "other confidential information" does eBay store?
This is the THIRD time this month I've had to change my date of birth due to compromised website.
And ebay wants me to type in my full credit card/bank account information to verify my identity. No, this doesn't look like a phishing attempt at all. Even if it's legit, it's bad form.
If you were me, you'd be good lookin'. - six string samurai
Let's assume they are using a good salt. With more than 64 bits of entropy, that means the bad guy has to crack one password at a time. That's critically important.
Ebay currently requires that passwords have uppercase, lower case, and number or punctuation, so lets say a typical password is about 60 bits of entropy*. (That's a rough guess). So we have roughly 1 X 10^18 passwords to try.
As I recall, crypt() defaults to 110,000 rounds, so we can crypt($5$) about 4,000,000 times per second.
So how many seconds will it take to try all of the passwords?
1 X 10^18 / 4 X 10^6 = 2.5 X 10^11 = 250,000,000,000 seconds
On average, we'll need to try half of the passwords to get the right one, so we'll need 125,000,000,000 seconds.
125,000,000,000 / 3600 = 34,722,222 hours
34,722,222 / 24 = 1,446,759
3963 years
I'm happy with 3,963 years per password.
That assumes 60 bits of entropy in the password - a decently good password. With a 50 bit password, it would be three years per password - still not too feasible for a Paypal password. A 40 bit password would fall in about 33 hours, if I did that bit of math right. That's still kind of high, but certainly doable - you just won't get very many people's passwords.
It seems to me that when using good salt, so the bad guy has to attack one password a time, and a reasonably good password, SHA256 is definitely not too fast to be secure.
I'm getting so tired of these. It seems like every few months now I'm getting affected by one. Last year my bank replaced my debit card three times (Adobe breach, Target breach, and who knows what the third one was)! Consequently, I'm no longer using my debit card as a debit card, but only at ATMs. I use my credit card for any card-based purchases now. But it doesn't stop. You name it: zappos breach, dropbox breach, a breach at an old community college I attended years ago, and probably others that I've forgotten about in the last year or two. Fuck me running.
By the way, the stories about this breach claim that no financial data was compromised. That's fine, except that the data that was compromised may be used for identity theft: your name, date of birth, and street address. I'm pretty much getting ready to use the option that the credit reporting agencies offer to lock down my credit so that no one can obtain credit in my name without me unlocking it. It's a pain, but I don't think it's a choice anymore at the rate these breaches are going.
https://www.paypal.com/us/cgi-...