EasyJet was the one hacked, the customers got their information stolen from the hack but were not themselves hacked.
The guardian has a much better title: https://www.theguardian.com/business/2020/may/19/easyjet-cyb...
EasyJet admits a cyber-attack has affected approximately nine million customers
81–90 of 164 posts
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#82If EasyJets systems are anything like their customer service, their in-flight food, their baggage handling or their scheduling, this is not surprising.
[deleted]
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#83Earlier quoted context omitted.
Possible, maybe not even hashed? Given the disallowed chars that's suggestive that the form used to be implemented as a GET, so it's possible passwords were in log files for a long time.
Is there a technical reason to use a GET for authentication? I've always seen it as a POST. If you use GET, won't your parameters be plainly visible in well, everything, unless they put them in the body and that's a whole nother can of worms.
I have definitely seen some sites using GET for authentication, they tend to be ones that have been around for a long time and haven't been fixed. Can't remember the last time I saw this though.
I'm not sure when easyJet first started using online accounts, but "you can't use some URI query reserved chars" does seem like a strong indicator there used to be a GET involved.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#84What I don't see in this article, is how can I (as an EasyJet customer) check if my data was breached?
haveibeenpwned.com ?
While I strongly recommend HIBP, the EasyJet hack is not yet loaded into their site. https://haveibeenpwned.com/PwnedWebsites
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#85Earlier quoted context omitted.
Possible, maybe not even hashed? Given the disallowed chars that's suggestive that the form used to be implemented as a GET, so it's possible passwords were in log files for a long time.
Is there a technical reason to use a GET for authentication? I've always seen it as a POST. If you use GET, won't your parameters be plainly visible in well, everything, unless they put them in the body and that's a whole nother can of worms.
No, https encrypts the URL as well (although the domain itself can be leaked via DNS). But in most respects query params are no different to the body security wise. The main difference is that if you bookmark it, you may end up storing your sensitive data in your bookmarks.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#86The number one reason I do not keep CC info, and why I don't fill out details wherever I can. I don't trust your security.
good luck buying a plane ticket from easyjet without giving them your CC info
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#87So I just went to easyjet.com and logged in and they don’t prompt to update my password. I wonder if failure to invalidate all accounts is their technical ignorance or if my account was simply not hacked? I assume the ignorance of course.
Since January.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#88But they didn't reveal any details about it. They just told it was a highly sophisticated cyberattack. Guess?
https://www.shodan.io/search?query=mongodb
Oh look, EasyJet huh? I wonder what's in there?
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#89I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
How much you wanna bet they weren't salting passwords in the backend?
Every time I see passwords with a list of excluded characters, I assume their system breaks when processing such passwords in plaintext. Hashes wouldn't cause any problems.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#90I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
Still better than my bank (one of Spain's biggest) that requires your password to be 8 (not less, not more) digits.