Alibaba security FAIL as brute-force bonaza yields 21 MILLION logins
Up to 21 million accounts on Alibaba e-commerce site TaoBao may have been compromised likely thanks to stolen credentials reused on breached third party sites.
TaoBao is a seller-to-seller commerce site like Gumtree or eBay where users rely on reputation to secure the most sales.
Reuters reports China’s Ministry of Public Security says the hackers used a database brimming with 99 million usernames and passwords, which they entered into Alibaba’s cloud network. Doing so showed that 20.6 million passwords were accurate and linked to TaoBao accounts.
The epic brute force siege lasted from mid-October to November, using compromised accounts to buy products from accounts and post fake reviews to bolster seller reputation.
The attacks were immediately reported to police. Six people have been arrested.
Alibaba says its systems were not breached and adds that it has reminded users not to reuse passwords.
It has not commented on how it’s “world-class security team” failed to detect the likely millions of failed rapid-fire bot entries into its login portals until weeks after it begun.
Sophos security man Paul Ducklin says the attack may have flown under TaoBao’s radar since only a few common passwords needed to be used in order to gain access to a large number of accounts.
“One problem in this case is that with nearly 100 million account names to work with, the crooks didn’t need to try thousands of passwords per account to get a good hit rate, so Taobao may not have seen evidence of massive password guessing,” Ducklin says.
“Taobao is one of the busiest websites in the world, so processing hundreds of millions of logins, even it they come from the same internet region – Alibaba’s cloud network – is all in a day’s work.”
Ducklin says the attack serves as a warning for web site owners to apply login rate limiters and for users to deploy two factor authentication and ensure passwords are not reused. ®
Sponsored:
Go beyond APM with real-time IT operations analytics
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2016/02/08/alibaba_taobao_security_process_failure/