Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StockX was hacked, exposing millions of customers’ data

techcrunch.com

Post reply on HN
Print view View original

11–20 of 108 posts

Re: StockX was hacked, exposing millions of customers’ data

#11

Post by cm2187 »

xwdv wrote: post #9
txcwpalpha wrote: post #7

> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted) This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators shoul…

Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware . You are probably not cracking the password in any reasonable time, period. And when you have a unique salt per user, that’s basically game over.

Usually the salt is stored along the login and password.

Re: StockX was hacked, exposing millions of customers’ data

#12

Post by rvz »

> ...The company “robbed their users of the chance to evaluate their exposure” by not informing customers of the breach when it happened...

StockX is valued at $1B and aside from their cataclysmic choice of using MD5 + salt as their way of hashing passwords (They obviously don't take security seriously) the company failed to inform their customers of this security breach as soon as it happened and left it very late for the customers to change their credentials. I would expect any unicorn valued company to have some form of incident-response system to immediately inform staff of the breach and to instantly reset all user credentials and to notify their users.

Instead they didn't inform their customers after the breach and now someone is calculating all those MD5 collisions and attacking all accounts with common passwords.

In the case of StockX handling this security breach, this is un-professionalism at its finest.

Re: StockX was hacked, exposing millions of customers’ data

#13

Post by xwdv »

cm2187 wrote: post #11
xwdv wrote: post #9

Earlier quoted context omitted.

Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware . You are probably not cracking the password in any reasonable time, period. And when you have a unique salt per user, that’s basically game over.

Usually the salt is stored along the login and password.

That’s not on the list of things stolen, so the passwords are safe. The salts were kept elsewhere, as they should be.

Re: StockX was hacked, exposing millions of customers’ data

#14

Post by txcwpalpha »

xwdv wrote: post #13
cm2187 wrote: post #11

Earlier quoted context omitted.

Usually the salt is stored along the login and password.

That’s not on the list of things stolen, so the passwords are safe. The salts were kept elsewhere, as they should be.

Do you have some insider information, or where are you getting this? If the hackers were able to steal all of the other login information, the salts were almost certainly stolen along with the hashes.

Re: StockX was hacked, exposing millions of customers’ data

#15

Post by txcwpalpha »

xwdv wrote: post #9
txcwpalpha wrote: post #7

> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted) This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators shoul…

Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware . You are probably not cracking the password in any reasonable time, period. And when you have a unique salt per user, that’s basically game over.

Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt, within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.

Re: StockX was hacked, exposing millions of customers’ data

#16

Post by cm2187 »

xwdv wrote: post #13
cm2187 wrote: post #11

Earlier quoted context omitted.

Usually the salt is stored along the login and password.

That’s not on the list of things stolen, so the passwords are safe. The salts were kept elsewhere, as they should be.

The article doesn't mention customer id and account creation date, though these records were almost certainly along the login and passwords also. It's general news article.

Re: StockX was hacked, exposing millions of customers’ data

#18

Post by youeseh »

hacker_9 wrote: post #2

> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…

Author might be a young intern writer.

Re: StockX was hacked, exposing millions of customers’ data

#19

Post by rolltiide »

bertil wrote: post #17

This is every day now, right? Is anyone tracking those regularly? Less the passwords (haveibeenpwd does that well) than the executives? Does anyone loose their job over this? What does the email asking the engineer who rung the alarm to get lost read like?

Well the reporting of the breaches is more strange than the fact they happened.

A platform like StockX should be a continual breach, because the information will let you make advantageous trades and time series against the customers.

Its pretty dumb to even announce a past tense on this as if it was a single event.

Re: StockX was hacked, exposing millions of customers’ data

#20

Post by maxdata »

I very nearly worked there in their engineering department, but once I got through the initial HR interview into the technical stuff, there were so many red flags that I got outta there as soon as I could.

A few higher level people who were all let go with me ended up going there, and having met up with them a few times, I've heard some absolute horror stories about everything ranging from dev workload, to security, to extremely unqualified devs being hired to fill seats.

I'm not surprised by this in the least, and frankly, I'm surprised it's not worse.

Post reply on HN