Slashdot Mirror
Hundreds of Hotels Affected by Data Breach at Hotel Booking Software Provider (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: The personal details and payment card data of guests from hundreds of hotels, if not more, have been stolen this month by an unknown attacker, Bleeping Computer has learned. The data was taken from FastBooking, a Paris-based company that sells hotel booking software to more than 4,000 hotels in 100 countries -- as it claims on its website.
In emails the company sent out to affected hotels today, FastBooking revealed the breach took place on June 14, when an attacker used a vulnerability in an application hosted on its server to install a malicious tool (malware). This tool allowed the intruder remote access to the server, which he used to exfiltrate data. The incident came to light when FastBooking employees discovered this malicious tool on its server.
In emails the company sent out to affected hotels today, FastBooking revealed the breach took place on June 14, when an attacker used a vulnerability in an application hosted on its server to install a malicious tool (malware). This tool allowed the intruder remote access to the server, which he used to exfiltrate data. The incident came to light when FastBooking employees discovered this malicious tool on its server.
... is this even possible:
In some cases, but not all, the intruder also obtained payment card details were also stolen, such as the name printed on the payment card, the card's number, and its expiration date.
Seriously. How is it possible that this data is not stored on hosts on separate, fortified networks, with decryption keys available only on other locked down machines that exist only to generate bank settlements and/or transmit billing information to the hotel as needed?
This cavalier attitude by so many organizations towards data security, the culture of expediency over security, and the fact that so often security is a zero sum game that no one really wants to be involved with has got to change. If it doesn't, there will be such a lack of trust and saturation of everybody's personal data that I could see the entire system becoming destabilized. Wouldn't that be fun. /rant
Check your premises.
A problem with penalizing companies that fall victim to hackers is that most such incidents are easy to hide, which is precisely what you don't want. You don't want companies covering up a breach to avoid penalties. You want the systems to be safe in the first place, which requires communicating about risks and attacks.
People also have a terrible intuition about judging risks. They probably won't have a major breach this year, so it's not a top priority.
What you want is to have people make their stuff safe. The fire code gives us a pattern for this that has worked. Companies comply with the fire code, and avoid fires, because otherwise their insurance company or the fire marshall will bust them for not following safety code - before they ever have a fire. You don't penalize people for having a fire, the insurance company checks that you're following fire code BEFORE a fire occurs.
If I understand the GDPR correctly, they have to notice every people affected by the security incident.
However, I think they will do nothing as usual.
Its ridiculous when you think of how many notable breaches already have happened to think business are still awful at protecting data of its customers. Most likely a company who decided security was just to hard and expensive to do.
By their report in the article the berach has been discovered on June 19 and they are informing affected parties on June 26, one week later. Doesn't the GDPR (they are even based in France) require to inform in just 72 hours (3 days)? Also if they adhered to PCI-DSS standards credit card numbers shouldn't have been stored unencrypted.
"FastBooking revealed the breach took place on June 14, when an attacker used a vulnerability in an application hosted on its server to install a malicious tool (malware)."
What was the name of the Application and the name of the Operating System this malicious tool ran on. How did this malicious tool get onto the server in the first place.
Just because it has "Secure" in the name does not mean leaving port 22 open to the world is a good idea. Either only allow access to that port from behind a VPN with two-factor authentication or deploy Web Knocker Firewall Service.
Just had to check to make sure it wasnt hotels.com!