STE WILLIAMS

If you wanna learn from the IT security blunders committed by hacked hospital group, here’s some weekend reading

The theft of 1.5 million patient records, including those of Singapore’s Prime Minister, from the city state’s SingHealth hospital group by hackers could probably have been stopped had the IT department not been so useless, an inquiry has found.

In July, citizens were notified that miscreants had siphoned massive amounts of private information from the healthcare organization’s database, which included the records of Premier Lee Hsien Loong, along with those of roughly a quarter of the island state’s population.

A committee of inquiry published its report into the hack on Thursday, and said the attacker, or attackers, probably should have been stopped before they could make off with the data.

Man opens hotel room with key card

Marriott: Good news. Hackers only took 383 million booking records … and 5.3m unencrypted passport numbers

READ MORE

The report suggested that, since the Prime Minister was the main target, a “well-resourced” group “having an extensive command and control network, the capability to develop numerous customised tools, and a wide range of technical expertise,” was involved.

“While our cyber defences will never be impregnable and it may be difficult to prevent an Advanced Persistent Threat (APT) from breaching the perimeter of the network, the success of the attacker in obtaining and exfiltrating the data was not inevitable,” the report stated.

In particular, the hackers exploited poorly secured Citrix servers that should have had two-factor authentication enabled for administrative accounts – but the IT gear just wasn’t secured that way.

Internet connectivity to the Citrix servers and the Sunrise Clinical Manager (SCM) software was a convenience rather than a necessity, increasing risk, the report added: “Network connectivity was maintained for the use of administrative tools and custom applications, but there was no necessity to do so.”

Worse, the company that operates the patient record database had been warned of vulnerabilities following a penetration-test audit. The report said Integrated Health Information Systems (IHiS) was advised of security holes in 2017, including weak admin passwords and insufficient network segregation.

“Unfortunately, the remediation process undertaken by IHiS was mismanaged and inadequate, and a number of vulnerabilities remained at the time of the Cyber Attack,” the report said.

The attack’s timeline also revealed that IHiS dragged its feet reporting the breach of its network security:

  • Probably through phishing attacks, an attacker first gained access to front-end workstations in August 2017, and by June 2018, had access to Citrix servers with SCM database connections, and had compromised “a large number” of user and admin accounts.
  • From May 2018, the attacker was unsuccessfully trying to log into the database.
  • Although admins began spotting malicious connections on 11 June 2018 and saw further attempts on 12, 13, and 26 June, the attacker was able to log into the database on 27 June and begin exfiltrating data.
  • A week later, on July 4, IHiS admins identified the suspicious queries against the database, and blocked the attacks.

The matter wasn’t escalated to the Cyber Security Agency of Singapore, SingHealth’s senior management, the Ministry of Health, nor the Ministry of Health Holdings until July 10, 2018, and it took until July 20 for before the cyber-raid was announced to the public.

The report is critical of IHiS staff training, saying it lacked the “awareness, training and resources” to respond to the attack, and as a result, they missed opportunities to prevent the data exfiltration.

Recommendations in the report include an enhanced security structure, better endpoint security and forensic capability, better staff awareness, enhanced security testing (including periodical red team exercises), tighter controls on administrative accounts, and better incident response planning. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/11/singapore_health_hack/

  • 11/01/2019
  • adm

Cyber-insurance shock: Zurich refuses to foot NotPetya ransomware clean-up bill – and claims it’s ‘an act of war’

US snack food giant Mondelez is suing its insurance company for $100m after its claim for cleaning up a massive NotPetya ransomware infection was rejected – for being “an act of war” and therefore not covered under its policy.

Zurich American Insurance Company has refused to pay out on a Mondelez policy that explicitly stated it covered “all risks of physical loss or damage” as well as “physical loss or damage to electronic data, programs, or software, including loss or damage caused by the malicious introduction of a machine code or instruction.”

The claim stems from the 2017 NotPetya cyberattack: a Windows-based piece of ransomware that encrypted a hard drive’s file system table and prevented the system from booting. The code then demanded that a Bitcoin payment be made to regain access. Mondelez says it lost 1,700 servers and 24,000 laptops as a result of the malware.

Security experts – and the UK government – have pinned the blame for NotPetya on Russian hackers trying to damage the Ukrainian government, but the Russian government has formally denied any responsibility.

Insurance companies would probably have to shell out over $80bn as a result of the attack, warned one survey – more than 2012’s Hurricane Sandy. Shipping giant Maersk said it had lost $300m as a result of the ransomware; FedEx said it has lost the same.

So, it’s a no from us

After reviewing Mondelez’s $100m claim, Zurich did what all insurance companies do and investigated with an eye to reducing the payout.

But despite offering an initial payment of $10m, the company then rejected the claim altogether claiming an exclusion for “hostile or warlike action in time of peace or war” by a “government or sovereign power.”

In effect, it argued that the losses had been suffered through a Russian government hostile action – an act of war.

That is a very unusual position to take – Mondelez called it “unprecedented” in court papers – since the insurance company will be obliged to prove that it was in fact the Russian government that had carried out the attack as a hostile action. It is notoriously difficult to pin cyberattacks on specific groups, governments or organizations.

If Zurich does succeed in arguing in case in court and wins, it would have an immediate impact, causing all large companies to review their policies and most likely creating a new market in cyberattack insurance almost overnight. The case, lodged in Illinois court (2018-L-011008) is being watched keenly as a result. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/11/notpetya_insurance_claim/

  • 11/01/2019
  • adm

Dozens of .gov HTTPS certs expire, websites offline, FBI on ice, IT security slows… Yup, it’s day 20 of Trump’s govt shutdown

The IT impact of the ongoing partial US federal government shutdown has begun to show up in the form of degraded computer security. According to internet services biz Netcraft, more than 80 TLS certificates used on .gov websites have expired and have not been renewed.

That’s caused a bunch of HTTPS-protected .gov sites to become inaccessible or throw up browser errors. Some websites, such as NIST.gov, have been scaled back due to the funding freeze.

Not all of those aforementioned TLS certificates have lapsed since the budget impasse became apparent on December 22, 2018. For example a US Justice Department website sports a TLS certificate from web registrar Go Daddy that expired on December 17, 2018.

But other websites sport more recently lapsed certs like NASA’s Rocket Test website, which expired on January 5, 2019. The Lawrence Berkeley Lab website, expired on 8 January 2019.

Due to the expired certificates, would-be visitors may find it difficult to access to affected websites or may be kept away entirely by scary browser warning messages.

In theory, Netcraft observes, support for HTTP Strict Transport Security (HSTS) in modern browsers should prevent users from visiting websites with invalid certs. But because many government websites fail to implement HSTS correctly, visitors to these misconfigured sites will still be able to bypass warnings, raising the possibility of man-in-the-middle attacks.

The partial government shutdown arises from President Trump’s insistence that Congress pass a national budget that includes $5.7 billion for the border wall he previously said would be paid for by Mexico. The Democrats now in control of the US House of Representatives have rejected Trump’s plan and there’s no evident interest in a compromise at the moment. As a result, federal government employees are expected to continue working without pay, or are being barred from work if deemed non-essential.

eagle_nebula

FYI: NASA eggheads can’t fix a knackered Hubble space ‘scope camera – thanks to Trump’s govt shutdown

READ MORE

With government agencies limiting operations, including the Departments of Agriculture, Commerce, Health and Human Services, Homeland Security, Housing and Urban Development, the Interior, Justice, State, Transportation, and the Treasury, not to mention the Environmental Protection Agency, official inattention is magnifying security risks.

As the funding freeze loomed last month, DHS issued shutdown guidance saying it’s expected only 2,008 of its 3,531 employees in the recently formed Cybersecurity and Infrastructure Security Agency (CISA) would be active in the absence of funding. That means a lot of IT security work will be left undone. While a skeleton staff remains active at NIST to keep the national vulnerability database and time servers running, the majority of employees were sent home and its website pared back, somewhat hampering security research.

On Thursday, the FBI Agents Association, a group that represents almost 13,000 active duty FBI Special Agents, sent a petition to the White House and Congressional leaders warning of the impact of the shutdown on the national law enforcement agency.

Noting that FBI workers will not be paid on Friday, January 11, as they should be, the petition asks for elected leaders to fund agency operations “before financial insecurity compromises national security.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/11/government_shutdown_security/

  • 11/01/2019
  • adm

Reddit Alerts Users to Possible Account Breaches

User lockouts, combined with requirements for new passwords, indicate an attack on accounts at the popular social media platform.

Popular social media platform Reddit has notified users that some of them have been locked out of their accounts because of suspicious activity. It was most likely the users’ own fault, the company said, but engineers were working to fix the problem.

The blog post, authored by “Sporkicide,” read, in part:

A large group of accounts were locked down due to a security concern. By “security concern,” we mean unusual activity that did not correspond to the account’s normal behavior that may indicate unauthorized access.

It went on to say that weak passwords used on multiple accounts made account takeover and misuse much easier.

Some security experts noted that the reported activity fit the profile of a specific attack. In an emailed statement to Dark Reading, Jarrod Overson, director of engineering at Shape Security, wrote, “Whenever there is a massive account takeover wave unrelated to a system compromise, it is very likely it is due to a credential stuffing attack.” He explained that credential stuffing involves using automated tools to use usernames and passwords stolen from one site to try to gain access to another.

Overson noted, “Accounts that have built up credibility on services like Reddit are extremely valuable for criminals. They can use those accounts to push malicious content, to exploit other users, and coordinate masses of accounts can make content appear to go viral legitimately.”

In the blog post notifying users of the issue, Reddit recommended that users use strong passwords unique to each service they frequent, and enable two-factor authentication whenever possible.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/reddit-alerts-users-to-possible-account-breaches/d/d-id/1333631?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 11/01/2019
  • adm

DNS Hijacking Campaign Targets Organizations Globally

A group believed to be operating out of Iran has manipulated DNS records belonging to dozens of firms in an apparent cyber espionage campaign, FireEye says.

Attackers believed to be working out of Iran have manipulated the DNS records of dozens of organizations around the globe to intercept and record their network traffic in what appears to be a large and growing espionage campaign.

Among those affected are commercial entities, government organizations, Internet infrastructure providers, and telecommunications firms in North America, North Africa, and the Middle East.

FireEye, which has been tracking the threat for the last several months, this week described the DNS hijacking campaign as notable for its almost unprecedented scale.

In a report yesterday, the security vendor said that it has so far not been able to attribute the attacks to any particular threat group. However, available evidence — including IP addresses and the machines used to intercept, record, and forward network traffic — suggest the attacker is based in Iran. Some of the organizations that the group has targeted so far, including governments in the Middle East, are also entities that would be of interest to the Iranian government, according to FireEye.

“The implications are tricky,” says Ben Read, senior manager for cyber espionage analysis at FireEye. “Malicious actors could have access to sensitive data, they can intercept email, without having anything on your internal network,” he says.

Last November, Cisco’s Talos group had reported on a campaign it called DNSpionage, which is aimed at organizations in Lebanon and the United Arab Emirates. In a report, Talos described the activity as involving the use of fake job websites to drop malware on systems within target organizations. Attackers were also attempting to redirect DNS traffic belonging to several government and private domains in the country in an apparent information-gathering effort, Talos noted.

The campaign that FireEye reported on appears to be a continuation and expansion of the same one that Talos described last November.

Read says FireEye has so far not been able to determine how exactly the attackers are gaining access to the DNS records. But it is possible they are using multiple techniques to get initial access to them.

The attackers have manipulated DNS records in at least three different ways. In some cases, the attackers have altered the “DNS A” records that are used for mapping domain names to IP addresses, so traffic bound for one domain gets redirected through one controlled by the attackers.

The second method the attackers have used is to alter DNS NS records and point a victim organization’s nameserver record to an attacker-controlled domain. In addition, the attackers have also employed a DNS Redirector “operations box” that is designed to respond with an attacker-controlled IP address to DNS requests for victim domains, FireEye said in its report this week.

If the domain name is not part of the targeted zone, the requested IP is returned to the user, FireEye said.

After the attackers alter the DNS records, they have used fraudulent Let’s Encrypt certificates to ensure that any traffic that is being rerouted remains encrypted in order not to arouse suspicion, Read notes.

Kris Beevers, CEO of NS1, says the hijacking attacks of the sort that FireEye reported are easy to pull off. Often, all that a bad actor has to do in order to manipulate a DNS record is to take over the login credentials to the DNS provider and registrars.

“They can also use BGP hijacking or [take] over the DNS resolver that a specific target user is using and [by] man-in-the-middling,” Beevers says.

Attacks like these highlight the need for organizations to use strong authentication to protect access to the domain’s administration panel, Read says.

Organizations should also make it a practice to monitor authorized DNS activity logs for unexpected changes and enable DNSSEC to verify the authenticity of information received from authoritative DNS servers, Beevers says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/dns-hijacking-campaign-targets-organizations-globally/d/d-id/1333634?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 11/01/2019
  • adm

New Software Side-Channel Attack Raises Risk for Captured Crypto

The new attack hits operating systems, not chips, and may give criminals the keys to a company’s cryptography.

A new side-channel attack that bypasses specific chips for a hardware-agnostic, operating system-based approach, has been published by a team of researchers. The attack — with a serious security punch but no sexy name — takes advantage of a fundamental feature of modern operating systems to gain access to data that programmers and users assume will be hidden.

The attack, published in a paper titled “Page Cache Attacks,” is effective against Windows and Linux — and possibly other operating systems. Furthermore, it doesn’t rely on obscure or malformed instructions to the hardware: It is based on simple system calls available to relatively low authority user accounts through the operating system.

One of the researchers who found the new vulnerability is Alex Ionescu, vice president of ADR strategy at CrowdStrike. He explains the ingredients required for a successful attack on a cache: “If you have the ability to a) force things into the cache and then, b) measure or check that they’re in the cache, and then c) potentially force evict them out of the cache, then you have something interesting.” The group of academic and industry researchers who found the new vulnerability realized that caches don’t just live in hardware; as Ionescu says, “Caches are everywhere in life.”

The power of this new vulnerability is that it can examine and then exfiltrate data across an entire page of the cache, and data that is there for a number of milliseconds. Since the attacking data-check itself takes only milliseconds, there’s enough time to do things like read a number of keystrokes or the clear-text response to a query involving cryptographic keys.

After looking at the potential impact of the vulnerability, Craig Young, computer security researcher for Tripwire’s VERT (Vulnerability and Exposure Research Team), wrote in an email to Dark Reading, “The team has demonstrated how a fundamental concept in modern OS architecture can be abused to create covert data channels between isolated processes, log keystroke timings, spy on random number generators, and generally leak information from other processes as an unprivileged user.”

Noting that the vulnerability is based on a legitimate system call in the affected operating systems, Young wrote, “This problem stems from overly permissive operating system designs giving unprivileged processes too much access to certain cache-related system calls.”

That basis in system calls means that the vulnerability could be used by a different class of criminal than those that could potentially use something like Meltdown or Spectre. “The others required a lot of sophistication and knowledge and were not for the faint of heart,” Mounir Hahad, head of Juniper Threat Labs at Juniper Networks, says. “This one is simpler and not hardware dependent, so it could be used by a lot of day-to-day criminals. This one doesn’t need a state actor; this one can be pulled off by regular criminals.”

The ease of using the attack and the data it provides is increased by application developers who take shortcuts. The paper notes examples of PHP frameworks that use the PHP function “microtime” as the pseudo-random seed for their cryptographic operations. Since the attack can capture the microtime return and the call to the cryptographic generator, an attacker could learn the basis for the encryption, making decryption much easier.

Ionescu says that mitigation is possible, but it requires both operating system vendors and application developers to look at their code, acknowledge that a vulnerability exists, and patch for it. And Hahad notes that these patches are both good news and bad news for the enterprise.

“Given how people patch their OSes, it will be a long time before the patches are all applied,” he says. “On the other hand, there’s not much an administrator can do aside from the patch. It’s not like there’s something I can do proactively to prevent someone from exploiting it. You just have to wait for the patch to come out and apply it as quickly as possible.”

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities-and-threats/new-software-side-channel-attack-raises-risk-for-captured-crypto/d/d-id/1333635?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 11/01/2019
  • adm

Update now! Microsoft and Adobe’s January 2019 Patch Tuesday is here

After a busy sequence of updates in October, November, and December, the new year’s first Patch Tuesday promises a lighter workload.

All told, there are 49 patches with CVEs, two advisories affecting Adobe and the Windows 10 servicing stack updates (see below), with a modest seven rated ‘critical’.

In a welcome change from recent months, there are no zero-day flaws although one, a Remote Code Execution (RCE) flaw in the Jet database engine (CVE-2019-0579), has been publicly disclosed thus earning it an ‘important’ rating.

Interestingly, Jet is responsible for 11 CVEs, winning it the award for being this month’s most patched component, ahead of the OS kernel, SharePoint, and Office on four each.

The seven critical-rated vulnerabilities are all RCEs, including CVE-2019-0547 in the Windows DHCP Client for all versions of Windows 10 1803, which given the delay to 1809 (October 2018 update), many will still be running.

CVE-2019-0550 and CVE-2019-0551 are RCEs affecting Windows Hyper-V, while CVE-2019-0565 is a memory corruption flaw in the Edge browser.

Rounding these out are three memory corruption flaws in the Chakra Scripting Engine, CVE-2019-0539, CVE-2019-0568, and CVE-2019-0567.

An interesting lower-priority flaw is CVE-2019-0622, an elevation of privilege (EoP) bug affecting the Android Skype app that reports last week said could allow someone with physical access to bypass Android’s screen lock, giving access to photos and contacts.

As an aside for anyone still running Windows 10 1703 (April 2017’s Creators Update), Microsoft recommends that users first apply servicing stack updates (SSU), the part of Windows responsible for updating.

Exchange

If there’s a curiosity this month it might be CVE-2019-0586, which Microsoft rates as important rather than critical despite the slightly alarming fact that the company’s assessment goes on to state:

Exploitation of the vulnerability requires that a specially crafted email be sent to a vulnerable Exchange server.

At least one expert has pointed out that because Exchange is a messaging server this might not be much of a barrier assuming the attackers know how to craft the right exploit.

If you use Exchange, definitely put this high on your test and deploy list.

Adobe

Adobe updates in Patch Tuesday correspond to last week’s APSB19-01 (a non-security update for Flash) and APSB19-02 (Acrobat/Reader) which addressed CVE-2018-16011 and CVE-2018-1618, both critical flaws.

A welcome surprise is that there are no new Flash vulnerabilities this month. At the rate Adobe has been issuing urgent fixes in recent months the shrinking population of people using the software were surely due a break.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/WVVNi9Dxun8/

  • 10/01/2019
  • adm

Facebook violated tough new cybersecurity law, says Vietnam

Back in June, when Vietnam passed a new cybersecurity law giving its government sweeping powers to monitor online activity, Amnesty International called it a “devastating blow for freedom of expression,” leaving “no safe place for people to speak freely” in Vietnam:

The law would give sweeping new powers to the Vietnamese authorities, allowing them to force technology companies to hand over potentially vast amounts of data, including personal information, and to censor users’ posts.

At the same time, internet giants such as Google, Facebook and Twitter warned that provisions for data localization, controls on content that affect free speech, and local office requirements would harm the country’s economic development.

The draconian law took effect on the first day of the new year, and less than 10 days later, the government began flexing its new legal muscle. On Tuesday, Vietnam threatened Facebook, claiming that it’s violated the new law by not removing what it says is anti-government content.

According to a report published on Wednesday by state-controlled media Vietnam News, the Ministry of Information and Communications (MIC) on Tuesday held a press conference in which it accused Facebook of allowing personal accounts to post “slanderous content, anti-government sentiment and libel and defamation of individuals, organisations and State agencies.”

From the report:

Facebook had not reportedly responded to a request to remove fanpages provoking activities against the State at the request of authorities.

Vietnam News quoted the MIC as saying that the content had been found to “seriously violate Vietnam’s Law on cybersecurity and government regulations on the management, provision and use of internet services.”

The MIC reportedly claimed that the government had sent emails repeatedly asking Facebook to remove “distorted and misleading content,” but the platform “delayed” removal of the content, saying it didn’t violate its community standards. The MIC also said that Facebook refused to give the communist country’s security agencies the data it sought for “fraudulent accounts.”

Facebook put out a statement saying that it has a “clear process” for governments to report illegal content and that it reviews all such reports:

We review all these requests against our terms of service and local law. We are transparent about the content restrictions we make in accordance with local law in our Transparency Report.

According to Facebook’s most recent transparency report, which covers the first half of 2018, it received 12 requests for data from Vietnam. It only handed over the data for two of those requests.

The government is also considering taxing Facebook for its advertising revenue, saying that the country’s losing money due to foreign businesses such as Facebook not paying taxes. The report cited a market research company as saying that $235 million was spent on advertising on Facebook in Vietnam last year, but that Facebook was ignoring its tax obligations to the country.

Vietnam News said that authorities are still gathering evidence of Facebook’s “infringements.”

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/jNklLQJSxGc/

  • 10/01/2019
  • adm

You can’t delete Facebook from some Androids and people aren’t happy

The #DeleteFacebook movement may be growing, but many Samsung users are having a tough time scraping the social network’s preinstalled software from their phones.

Bloomberg reports that the Facebook software that comes installed on some Samsung phones cannot be deleted. Instead, it can only be disabled. Devices affected include flagship models such as the Galaxy 9, for which users pay high prices.

Some users were irritated that the app couldn’t be truly deleted, even in its disabled state:

Pre-installed software has long been a feature on both mobile and desktop platforms. For years, many PCs have shipped with ‘bloatware’ – trial versions of apps including antivirus tools that users see the first time they start their machine. However, PC users have the power to delete those apps.

While it’s true that you can’t delete Facebook’s preinstalled software from some Samsung units, the problem isn’t as severe as you might think. The preinstalled software isn’t the full-blown app. Instead, it’s a ‘stub’ application called the Facebook App Manager that simply prompts you to update it to the full version of the Facebook app.

The stub app is installed as system software, making it hard for regular users to delete. It isn’t the only system software that Android users can find on their phones. Applications from Google, which produces Android, also regularly crop up in the system space on Android phones.

Disabling the Facebook app makes it act as though it has been deleted. This means that as far as anyone knows, the disabled stub version won’t secretly send your data to Facebook.

Having said that, users could be forgiven for distrusting Facebook’s interaction with software on their phones. The Onavo VPN that it purchased in 2013 was found to have been phoning home from users’ devices and telling it what software people were using, even when it was turned off. More recently, third-party apps have been caught sending app usage data to Facebook’s servers without users’ permission.

There are reportedly some complex options available to delete stub system apps without gaining root access to the phone. These include package disablers and Android Debug Bridge (ADB) programs that let you communicate with the phone via a command line interface. This is technical stuff, though, and not something that the average consumer should tackle. One wrong step with an erroneous command and you could damage your Android operating system.

For the majority, the best option may simply be to take a deep breath, disable the app, and ignore the fact that companies are making money preinstalling stub apps on a device that you already paid for.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xxl_Q1H21P8/

  • 10/01/2019
  • adm

Reddit locks out users with poor password hygiene after spotting ‘unusual activity’

Some Redditors have been locked out of their accounts over a mysterious security problem that the internet forum’s admins have blamed on people reusing old passwords.

Precisely what has happened, or whether Reddit itself has suffered a hack or data breach, is not yet known, only that the website described it as a “security concern”.

However, a thread posted by Reddit admin Sporkicide squarely blamed the all-encompassing forum’s users for bad password hygiene.

The most common explanation for this is the use of very simple passwords or the reuse of credentials across multiple websites or services. If another site is compromised and those lists of usernames and passwords become available, it’s very likely that they will be tried against other popular sites to see if they work and this means that any account where you use the same credential combination is then at risk.

Credential-stuffing attacks are where compromised usernames and passwords harvested by hackers from one site are tried on other sites to see whether they work. One easy way of avoiding this is to not reuse login credentials across different websites.

Thumbs down frownining emoticon

While Zuck squirmed, Reddit revealed it found and killed 944 Russian troll factory accounts

READ MORE

“Over the next few hours, affected accounts will be allowed to reset their passwords to be unlocked and restored. This will take the form of either a notification to the account (yes, you’ll be able to log in to get it) and/or an email to any support ticket you’ve already sent in,” continued Sporkicide’s post.

Another possible reason for an enforced password reset could be a compromise of users’ login credentials from the site operator. There is no evidence in the public domain either way, however.

Reddit is owned by American magazine publishing house Condé Nast. In August last year the site suffered a confirmed data breach after hackers worked around staffers’ SMS two-factor authentication protections. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/10/reddit_password_reset/

  • 10/01/2019
  • adm