Tag Archives: passwords

What Happens When All SSNs are Breached

Visit any news site or social media outlet and you are bound to see news of some new company getting breached. It is a lot of what we talk about these days. Whether it is passwords, credit card information, health information or social security numbers, if it is breached it is headline news. With the exception of those trying to scam the system and get a quick payday, it is getting to the point where most people outside of the information security industry just write it off and don’t give it much thought.

There is a difference between social security numbers or health information that distinguish them from passwords or credit card numbers. They are much harder to replace. Taking a quick look at passwords we can see that it is easy to change them. If my password gets breached, I create a new one. It is usually a simple process that takes very little time. This is especially true if using different passwords for different sites. Credit cards are also fairly simple to replace and come with zero liability. If my card gets breached and there are fraudulent charges I just report them and they are removed. The bank sends me a new credit card and if I am doing regular monitoring of my statements the biggest hassle is changing the credit card that is stored on the different sites.

With social security numbers it is much more difficult to replace them. While they were not meant to be used as identifiers in all of these systems, they unfortunately are. Countless numbers of sites store your social security number increasing the risk to it. Getting a new number can be very difficult, not just the process of getting the new number but also updating everyplace that has it.

What happens if all of the social security numbers get breached? With under 400 million people in the united states how long will it take with all of these breaches for all numbers to have been breached? I know, we could just create all of the numbers that fit the format of xxx-xx-xxxx, but I am talking number with other identifying information. If all of the numbers get breached, what do we do next? Is it still worth spending so much money trying to protect them in our systems? We can’t get people to encrypt them now, will they continue to do it when they are all in the public domain? Do we finally start moving to a new identifier, albeit probably too late? Maybe it is just a money ticket for identity monitoring and credit monitoring companies. Will the duty to protect this information be removed when it is public domain? As we have seen with other breaches, once something is in public domain, no matter how it got there, it is fair game. It raises an interesting situation when a finite set of data is at risk. Do you know what your company is doing to protect this type of information? Better yet, as a consumer, do you have any concern about your SSN being stolen? Chances are very good it is already out there somewhere.

1.2 Billion Passwords… Password Best Practices Again

There is a lot of talk about the recent discovery of what appears to be about 1.2 billion username and passwords stolen. I haven’t seen the list, so I can’t confirm that, but let’s assume it is accurate. Is this something we should be panicking about?

The first question is how many unique people does this actually effect? The chances that it effects 1.2 billion people seems pretty. I haven’t seen any statistics generated but we have to assume that those people that are connected to the internet have more than one user account. The breach says the credentials were pilfered from more than 450,000 sites. Of course that information is not being released, and we don’t need it to protect ourselves.

Practice Good Password Practices

With all the recent breach coverage we can’t help but to continue preaching good password practices. You may ask if it really matters with all the breaches that occur, or what control you really have. It is not like these passwords are stolen from you, the application that stores them is usually the culprit.

As those that create and rely on passwords, we do want to help take care of them as best we can. I can’t control what the developer is doing to protect the password on their end, so I have to assume the worst and do the best I can on my end. At some point, I think we will start to see people actually stop using applications that are not proactively protecting our data, but to do that we need applications that are transparent and show us they are doing things right to gain our business.

Choosing Strong Passwords
We should start off by choosing strong passwords. Unfortunately, a lot of critical applications still don’t support strong enough passwords, but if you can, try to have at least 15 characters in the password. When it comes to password strength it is the length that has the greatest effect. Remember, it is rare that someone is trying to guess Your password, rather they are running software tools to crack large swaths of passwords. I prefer to use pass phrases or sentences to create my password. This makes it easier to remember and more difficult to crack.

Changing Passwords Regularly
Changing your password to critical systems regularly can help avoid your password from being stolen by malicious users. Many corporate systems require password changes every 45-90 days for end users. You should follow that guideline too for personal applications, especially the ones that focus on financial artifacts (such as your bank accounts). Lets hope that a company that has been breached and lost passwords isn’t losing them day after day. We hope it was a one or two time thing. By changing our passwords regularly it increases the chance that the breached data is no longer valid by the time it gets used.

Don’t Reuse Passwords
It is recommended to not use the same password on multiple sites. I understand that this is a pain point because it is difficult to remember that many passwords. Try a password manager, a piece of software to store all your passwords securely, to help solve that problem. The issue with re-using passwords is that many sites allow you to use the same username, or just your email address as the user name. Once your data has been stolen from one application, an attacker may try that password on another site where you use those same credentials. This also includes not using similar passwords. Using passwords like Summer2014 and Fall2014 are not a good idea because if these are identified, it is simple to figure out the pattern and guess the next password in line. This is critical if you do change your password regularly, and an older password got breached.

2 Factor Authentication
If a site offers 2-factor authentication, enable it. Two factor authentication means that the site will prompt you for your username and password and then a secondary piece of information. For example, my bank will send me a token via email that I have to enter. This token is different every time I log in. Many sites are starting to support tools like Google Authenticator, which is an app that runs on your mobile device and provides that 2nd piece of authentication. If you are using sites that do not support 2 factor authentication, write to them and request it. Remember, they are storing your data, you want it protected.

Validate the Hype

When news like this breaks, we often have a tendency to really overreact thinking that it is the end of the world. Credentials got stolen, we are not disputing that, but lets step back and think about what that means. Keep in mind that in this announcement, applications or companies were not named. At this point, it is possible the credentials are for meaningless sites that are not that big of a deal. Due to the nature of the accounts being used to send spam I am guessing many are probably email accounts, but that is just a guess. What has happened in the past can’t really be changed. We change our passwords, we monitor our accounts (like we should be anyway) and we continue reaping the benefits that these applications provide us.

Stay safe, and keep your eyes open.

Ebay Password Breach

Ebay announced today that the had usernames, encrypted passwords, phone numbers, email address, physical address and date of birth stolen during a recent breach.  The key here is encrypted passwords, which hopefully means strong security.  That is just an assumption though.  It is not uncommon by any stretch to see a large company suffering from a breach that includes user credentials.  We often overlook the idea that credentials are actually very valuable.  We spend so much time focusing on social security numbers, credit card numbers, and HIPAA data that we forget about the basics.   Those keys that protect the rest of all of that data.

Ebay believes that no other data (financial, etc) was accessed during the breach.  This is the good news.   The bad news is we now need to change our passwords again.  Look on the bright side, if we used fingerprints as our access we would only change our password a few thousand times before we had to start using toes.  There are a lot of different passwords we can come up with.  I know it is obvious, but if you haven’t stopped reading this post to go change your Ebay password, stop for a moment and go do that.

Managing our passwords can be difficult and we may often feel helpless as the end user because not only do we not have any control of how a company or service stores our passwords, we don’t have any insight into how they do it.  Previously people have mentioned advertising on the site how the password is protected.  It is an interesting idea.  The question is: does it make you more or less of a target?   There are a lot of factors that go into that determination.

If you advertise that you use bcrypt with 10,000 iterations, is good or bad?   Will the bad guys just turn around looking for that easier score or will they accept that challenge.  Now advertise that you are just storing passwords using MD5 with no salt.   The difference between the two is like seeing a wireless network with and without a password.  Of course, the problem we also have is whether or not the description provided would mean anything to the average user.  My mom, even my wife, wouldn’t have any idea what MD5 or bcrypt meant or which one may be more secure.  It is server side, so do users care?   I am not really sure.    I don’t think advertising the details would really help the problem, maybe just satisfy those techies that want to debate over whether the company was following best practices.

Spread the word when you see that a site has been breached.  Let your friends and co-workers know so they too can take the appropriate steps to protect them selves.  We can’t fix a companies vulnerabilities, but we can all respond accordingly to calm the wave of destruction.