Slashdot Mirror
Jewelry Site Leaks Personal Details, Plaintext Passwords of 1.3 Million Users (thenextweb.com)
Chicago-based MBM Company's jewelry brand Limoges Jewelry has accidentally leaked the personal information for over 1.3 million people. This includes addresses, zip-codes, e-mail addresses, and IP addresses. The Germany security firm Kromtech Security, which found the leak via an unsecured Amazon S3 storage bucket, also claims the database contained plaintext passwords. The Next Web reports: In a press release, Kromtech Security's head of communicationis, Bob Diachenko, said: "Passwords were stored in the plain text, which is great negligence [sic], taking into account the problem with many users re-using passwords for multiple accounts, including email accounts." The [MSSQL database] backup file was named "MBMWEB_backup_2018_01_13_003008_2864410.bak," which suggests the file was created on January 13, 2018. It's believed to contain current information about the company's customers. Records held in the database have dates reaching as far back as 2000. The latest records are from the start of this year. Other records held in the database include internal mailing lists, promo-codes, and item orders, which leads Kromtech to believe that this could be the primary customer database for the company. Diachenko says there's no evidence a malicious third-party has accessed the dump, but that "that does not mean that nobody [has] accessed the data."
Hashing passwords isn't new. So why are people still storing plaintext passwords?
"We just want a webshop" -- Yeah but you're selling expensive luxury goods. That makes addresses of buyers very interesting, don't you think? WHY EVEN KEEP THAT DATA ONLINE?!?
What were you thinking? "We just want a webshop." Right. You were not thinking, nor were the webmonkeys you hired for your webshit. Congratulations, you done leaked, and now your customers' data is all over the place.
But the phrase gross criminal negligence come to mind.
In an ideal world, wanton disregard of decades old security standards should land executives with some fines and possible jail time. For a criminal case, some kind of applicable statute would have to be dug up.
For a civil case, that's way easier. You have to show that it is likely (really a >50% chance) that their actions, negligence or policties lead to some damages. Nobody goes to jail. But some lawyers can get rich settling a million dollar class action suit where everyone that had their identity stolen gets a check for $5 or something equally ridiculous.
“Common sense is not so common.” — Voltaire
... incompetence and gross negligence on this (admittedly extreme) level will remain common. My suggestion: Immediate payout of $500 to anybody affected, and full cost to anybody that can prove they suffered more damage. If they cannot pay, CEO goes to prison for a few years and has personal fortune impounded. This will lead to companies having insurance for this and insurers taking a critical look at their practices.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Just use ******** as your password like I do and nobody will ever guess it.
lot's of apps put DB passwords in plaintext is config files
Can we please create two internets in parallel?
One for the professional programmer folk that use battle-tested tools and design/testing methodologies on secure operating systems.
And one for the codecampers, outsourcers, and MSDN certified (or whatever Microsoft calls it) bros that are just monkey-hammering their keyboards with copypasta from Stackoverflow and spewing their nasty insecure goo on the rest of us?
Thanks.
This is how companies participate in the mass surveillance program.
They 'accidentally' leave all of there customer's info in an unsecured location and pretend it was a snafu.
This has been happening A LOT. And no one is learning anything from all these stories?
The system is trying to appeal to your good, trusting, forgiving nature. Do not fall for it.
There is a war being waged against every single one of us by the people sworn to protect us.
Now you have 1.3 million friends in the diamond business!
#DeleteChrome
It should be a crime to store plaintext passwords for users on any web site where the public can create ids. There is no reason for it and it's been decades since it was an unacceptable practice on any computer system.
Of course, once it's a crime, civil liability follows.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
Mariners and pilots have known for a long time what clouds mean - DANGER!
Where was this file found? In the "safety" of the cloud, along with hundreds of thousands of other sensitive files placed there for "safety".
Some good gems in the .htaccess file downloadable from here Of particular interest might be this section to block access to files that end in certain extensions.
https://pastebin.com/16Xn1gSs
Some good gems in the .htaccess file downloadable from here Of particular interest might be this section to block access to files that end in certain extensions.
https://pastebin.com/16Xn1gSs
Some good gems in the .htaccess file downloadable from here Of particular interest might be this section to block access to files that end in certain extensions.
https://pastebin.com/16Xn1gSs
I backup all my backups to backup.bak
"The Germany security firm"
You probably want to say
"The German security firm" or "The Germany based security firm"
They should of went to Jerads
clear text passwords and unprotected databases, we have learned nothing.
and these things are not even difficult or expensive to implement - there is no excuse here.
On a long enough timeline, the survival rate for everyone drops to zero.
Yuh uh... this is the work of Russian masterminds! We're under attack! Trump was elected by Putin! Yarrr!!!
Obviously storing passwords in plain-text is frowned upon. To protect the database and backups you can enable encryption which is really easy to do in the SQL admin tool. This way everything is protected. I'd still use HASH and SALT for storing passwords.
"We do not share your e-mail address with anyone outside of Limogés Jewelry other than when necessary to fulfill your order."
Don't worry about it bro it was just to fulfill your order.
A couple million bribe to the lawyers of the class action suit, vouchers for 20% discount to the ones affected by the leak. Heck, the company might MAKE money on the deal.
As long as there are no repercussions at all for leaking data, there will be no incentive for securing data.
Storing unhashed passwords in a database means that there will be a major leak, guaranteed. That should be just as illegal as intentionally giving customer details away for money. There needs to be criminal penalties not just civil ones for this kind of crap.
I'm a good cook. I'm a fantastic eater. - Steven Brust
The company was incompetent but they likely didn't know they were incompetent. People who are good cost a lot of money and someone for half the wage will likely bang out something that looks great using the latest web platform of the month in half the time the high priced guy will take. A CEO, who doesn't know how to program can't evaluate who is good and who isn't. This was a screw up and combined with the fact that almost everyone reuses passwords potentially a major expense for a few people. Bankrupting this company won't make any difference. Other companies like this won't change their behaviour. There are lots of bigger companies that should know better that do worse. There are very few companies that will even change their behaviour when security flaws are pointed out. (they will patch the very specific flaw but not the behaviour that led to it). The only exception to this rule is companies that know they will be the ones that bare the cost of the security breach. Your password IS NOT valuable to a company like this. It generally costs them nothing if they lose it, so they don't count it as an asset worth securing.
In law "very great negligence" is a lesser used but equivalent term to "gross negligence".
Research before [sic]ing.