Slashdot Mirror
Acer Suffers Data Breach Through Online Store (itproportal.com)
Sam Pudwell, writing for IT Pro Portal: Taiwanese hardware and electronics giant Acer has announced that it has suffered a data breach via its e-commerce site, and is preparing to inform those customers affected. Due to unauthorised access by a third-party, anyone who accessed the online store between 12 May, 2015 and 28 April, 2016 could have had their personal information compromised. Acer revealed that names, addresses, payment card numbers, card expiration dates and card security codes may have been accessed by the hackers but, following investigations by internal and external professionals, believes login details were not compromised.
I thought Acer went out of business the same time as CompUSA did.
believes login details were not compromised.
I don't really care about "names, addresses, payment card numbers, card expiration dates and card security codes".
All I need to live is my username and password at Acer shop! I'm a lucky guy!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
So only names, addresses, payment card numbers, card expiration dates and card security codes were accessed? My login is safe? Nice!
Oh wait, why would they need the login when they already have every single data about me they want?
Those should not have been stored on their system at all. It is against the agreement with the CC companies.
that is
On storing Credit Card data? I once purchased from a tech outfit that stated up front they did not store credit card data. Once a transaction had been verified by the credit card company, the tech outfit deleted it from their secure sever. It was their stated opinion that the best way to protect (the customer's) credit card data was to not store it. If you don't have it, no one can steal it.
I honestly don't know how I could live without my trusty 15+ Acer bloatware applications on every new laptop.
I always used to think that large businesses, governments, etc. were incredibly careful with things they exposed to the Internet, and that breaches were mainly caused by unpatched vulnerabilities or just coding mistakes. However, when you see a breach that involves full credit card details being leaked, you can tell that a lot of the problem is a lack of standards. At least in the US, businesses aren't allowed to store or transmit card details unencrypted. I'll bet that data was never encrypted in the first place, or the keys were so poorly secured that they were easy to find once the attacker made it inside.
I think one core problem is either a lack of standards, or relying too heavily on one standard. If you just let your developers go nuts and write their own transaction processing system 1990s-style, you can bet something will be missed. On the other hand, leaning too hard on a few established payment systems exposes you to unpatched, undiscovered flaws in them.
The other thing companies need to stop doing is assuming their inside networks are totally safe. I've worked so many places where once you're in, you have full unrestricted access to anything. That requires a major shift in thinking, as many people are still of the mind that firewalls + DMZ + IDS at the front gates are all the company needs to be secure. You need to assume that people can get through all of that and make it difficult to reach critical systems even from inside.
Credit card information only ever needs to travel from the customer via the web interface to the back end, never the other way around. Why is that information accessible from the web server AT ALL? Put a data diode between the web server and the back end. There should not be a way to get the credit card information even if every Russian hacker has completely rooted the web server.
Recent articles on the lack of security for their laptop hardware & OS/firmware (at the bottom of the pile of Windows laptops) indicates that ACER is simply not interested in security for its users.
How long before users bail on ACER?
In order to [falsely] justify increasing control over the Internet, actual US/EU Government programs headed by the CIA are in place to produce news stories of a multitude of hacks here and there. Breaches here and there. Leaks here and there. Make big stories, present the various agencies as heroes out to defend this terror and threat barrage.
Fact is: What did Ed Snowden say and why were they pissed about it? Did it go away? Did 9/11 WTC attacks not happen? Was this not a false flag on such a grand scale that it is incomprehensible any group would be that evil?
OK then why the gun law pressures in the United States all the while they let more and more foreigners in? Come to our terror party, come one come all?
This is precisely how it is.
Acer is a technology company built on crummy cheap technology. Yea, they do make a couple nice notebooks. But in general they crank out crap for cheap.
Not surprising then Acer can't keep its store secure, or protect its customers. One common theme these days to protect yourselves. Is stop allowing browsers to store personal information and more important stop storing all your information on a online store server. You know these servers will be attacked, right?
Yea, I know it's a hassle typing all your information in every time. But it's also a hassle when your personal information ends up on a stolen data base too.
When will someone go to prison for storing credit card information in plaintext? Put the VP in charge of that division in prison for 6 months and make the company pay restitution to the financial institutions that have to issue new cards with new account numbers. And $50 to each consumer because now they have to spend a couple hours updating their billing information with all of their online vendors.
There's no excuse for this shit.