StockX was hacked, exposing millions of customers’ data
techcrunch.com
StockX was hacked, exposing millions of customers’ data
1–10 of 108 posts
Re: StockX was hacked, exposing millions of customers’ data
#2> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version.
The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen data is shoe sizes? MD5 hashing for passwords isn't ideal, especially combined with email addresses - that could lead to some email accounts being accessed if people use the same password for everything. The article seems to not really give much attention to this though, not clear if the author even realises this is the main problem.
Re: StockX was hacked, exposing millions of customers’ data
#3arent they a quicken family company?
Re: StockX was hacked, exposing millions of customers’ data
#4> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…
> The stolen data is shoe sizes?
StockX is a platform for trading shoes, among other things.
Re: StockX was hacked, exposing millions of customers’ data
#5> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…
Well, every data helps if you're trying some targeted hacking. If the username is LebronJames and the shoe size is 9, it's not the right Lebron...
Re: StockX was hacked, exposing millions of customers’ data
#6arent they a quicken family company?
Yep
Re: StockX was hacked, exposing millions of customers’ data
#7> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted)
This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators should have known better (sadly, despite this, an absurdly high number of companies still use MD5 for pass hashing).
These passwords, hashed with MD5, might as well be considered to have been stored in plaintext.
Re: StockX was hacked, exposing millions of customers’ data
#8> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…
We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak puts other companies at risk.
Re: StockX was hacked, exposing millions of customers’ data
#9> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted) This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators shoul…
Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware. You are probably not cracking the password in any reasonable time, period.
And when you have a unique salt per user, that’s basically game over.
Re: StockX was hacked, exposing millions of customers’ data
#10> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted) This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators shoul…
Given that data, doesn't their attempt to call this "system updates" constitute a violation of California's data breach notification laws? https://oag.ca.gov/privacy/databreach/reporting