EasyJet admits a cyber-attack has affected approximately nine million customers • Hacker News Board

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#141

Post by thephyber » Tue, May 19, 2020, 8:42 PM UTC

teekert wrote: post #105

morsch wrote: post #19

Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…

Exactly, just let my browser fill in the data. And we pray that Mozilla can keep it safe :)

I don't see how that helps more than marginally.

Doesn't PCI require a payment processor to keep some amount of the transaction data for a specific period of time?

Personally, I love tokenized transactions / specialized payment processors (eg Apple Pay, Stripe, PayPal) because they actively work to keep most of the data away from etailers (who are generally not specialists in securing their checkout flow). The problem is the payment processor transaction fees can be steep (2.x% for most commodity CC processors all the way up to 15% for Apple Pay), so etailers lose on the margins and avoid the more secure options.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#142

Post by thephyber » Tue, May 19, 2020, 8:45 PM UTC

Sosh101 wrote: post #103

leejo wrote: post #68

I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.

Doesn't a max length suggest that they are storing passwords rather than hashes?

Not guaranteed, but it suggests that their company processes aren't Password Manager friendly.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#143

Post by thephyber » Tue, May 19, 2020, 8:56 PM UTC

trickstra wrote: post #89

hannasanarion wrote: post #74

Earlier quoted context omitted.

How much you wanna bet they weren't salting passwords in the backend?

Every time I see passwords with a list of excluded characters, I assume their system breaks when processing such passwords in plaintext . Hashes wouldn't cause any problems.

It could also be because they had imperfect character escaping in the codebase at some previous point in time and didn't bother to migrate user credentials to work exclusively with the newer correctly-escaped code.

Fun fact: PHP used to escape some characters in some POSTed data by default before a specific version, then changed the default config:

> Prior to PHP 5.4.0, the PHP directive magic_quotes_gpc was on by default and it essentially ran addslashes() on all GET, POST and COOKIE data.[1]

I know for a fact some of users of a previous site I worked on had stored their password (hash) with one escaping mechanism, only to start failing authentication after that function was no longer used upon data input (all escaping should be done upon output for more perfect control of different security contexts eg. escaped HTML versus escaped SQL versus escaped JSON).

[1] https://www.php.net/manual/en/function.addslashes.php

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#144

Post by thephyber » Tue, May 19, 2020, 9:01 PM UTC

x86_64Ubuntu wrote: post #80

leejo wrote: post #76

Earlier quoted context omitted.

Possible, maybe not even hashed? Given the disallowed chars that's suggestive that the form used to be implemented as a GET, so it's possible passwords were in log files for a long time.

Is there a technical reason to use a GET for authentication? I've always seen it as a POST. If you use GET, won't your parameters be plainly visible in well, everything, unless they put them in the body and that's a whole nother can of worms.

No. GET params in the URL should not have security-sensitive data this wasn't always widely known. Even in HTTPS-everywhere world, there are still security implications.

Early versions of some PHP sites, for example, would pass around auth tokens (think the auth cookie) in a URL. This soon became an obvious problem when users copy-pasted their URLs into forum posts, non-HTTPS URLs were logged by proxies, and web server access logs became gold mines for maybe-still-active sessions.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#145

Post by nickff » Tue, May 19, 2020, 9:34 PM UTC

guptaneil wrote: post #128

laydn wrote: post #121

Earlier quoted context omitted.

Exactly. A lot of businesses MUST keep the data. Imagine EasyJet putting the burden of keeping all your transaction logs on you: "Passenger assumes responsibility of downloading this electronically signed package and keep it for 2 years" On a completely tangential note: How does your product work with pets?

Ha, that makes me wonder if we could have a future standardized protocol where your browser handles the responsibility of storing a signed package of data, and sending it back to the company when needed. Basically treat each package of data like a product that might need to be RMA'd if there's an issue. Obvious first question is what happens when you switch browsers/devices. Regarding pets: it'll depend on the size o…

The government wants many companies to keep certain data, to prevent fraud by the customers (and sometimes the businesses). Decentralizing the data makes such frauds (including tax fraud) more difficult to audit or detect, so it seems unlikely that governments will permit it.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#146

Post by ta17711771 » Tue, May 19, 2020, 10:02 PM UTC

jimkleiber wrote: post #23

morsch wrote: post #19

Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…

I built an app back in 2012 for emotional journaling and I tried to collect as little data as possible from the user because I didn’t want to have the burden and legal responsibility to guard all that deep data. Many people in SV told me I was crazy not to collect data. It does make it harder to develop the app with so much uncertainty about how people are using it, yet I felt much more free knowing I wasn’t one hack…

Why not ask them?

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#147

Post by jimkleiber » Tue, May 19, 2020, 10:39 PM UTC

ta17711771 wrote: post #146

jimkleiber wrote: post #23

Earlier quoted context omitted.

I built an app back in 2012 for emotional journaling and I tried to collect as little data as possible from the user because I didn’t want to have the burden and legal responsibility to guard all that deep data. Many people in SV told me I was crazy not to collect data. It does make it harder to develop the app with so much uncertainty about how people are using it, yet I felt much more free knowing I wasn’t one hack…

Why not ask them?

I'm not sure to which part you're referring...ask them what?

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#148

Post by ShinTakuya » Tue, May 19, 2020, 11:34 PM UTC

zwp wrote: post #120

ShinTakuya wrote: post #85

Earlier quoted context omitted.

No, https encrypts the URL as well (although the domain itself can be leaked via DNS). But in most respects query params are no different to the body security wise. The main difference is that if you bookmark it, you may end up storing your sensitive data in your bookmarks.

Query params often end in stuff like web server (WAF, load-balancer, reverse proxy, ...) access logs and they might get accidentally exposed. They shouldn't get exposed of course, but they do. [EDIT: redacted an example of some random dude's access log] If you search for "password" in there you will likely see a new Mirai bot variant [1] bouncing credentials off the server looking for weblogin.cgi on vulnerable Zyxel…

Yeah that's a fair point. So the security is worse in that sense, so many ways to leak it. It'd be insanity to put sensitive info in the query params either way. It's just not the appropriate place for them.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#149

Post by zwaps » Tue, May 19, 2020, 11:38 PM UTC

jorams wrote: post #50

dmos62 wrote: post #33

Earlier quoted context omitted.

Partner had trouble doing an online check-in with EasyJet. Some kind of error. Arrived at the airport to be told that even though she has the ticket, she does not have a place. There were ~5 people with her in the same situation. 4 other people did not show up for the flight, so some of them got a seat after all. My partner did not, spent the night in the airport. Took about a year and loads of calling to get a compe…

Overbooking is actually incredibly common. Every flight has some number of passengers not show up. Airlines prefer to compensate one or two people for the fact that they didn't get a seat, instead of leaving some number of seats empty. Getting compensated should be practically instant though, and definitely not take a year, so something went terribly wrong there.

This is common. I literally had to take Icelandair (another really terrible budget airline) to court because their engines don't work (really old planes)

Not only did their system have me logged in another flight in another continent (!), they flat out denied I had a claim even though I had to stay put more than 24h, a good amount of that in the plane.

After getting sued, they tried to backhand contact me (not my lawyer) to pay compensation. Court made them pay.

This is all calculated.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#150

Post by hazmazlaz » Wed, May 20, 2020, 12:39 AM UTC

laydn wrote: post #121

guptaneil wrote: post #118

Earlier quoted context omitted.

This is how I’m building my startup[1]. All data stays with the customer and we actively don’t want it, because that’s how I wish all my products worked. I suspect you will see more startups who treat data more respectfully in the future, as the next wave of founders have experienced the consequences of unrestricted data collection. Having said that, I also think a large part of the problem is that treating data like…

Exactly. A lot of businesses MUST keep the data. Imagine EasyJet putting the burden of keeping all your transaction logs on you: "Passenger assumes responsibility of downloading this electronically signed package and keep it for 2 years" On a completely tangential note: How does your product work with pets?

But wait, isn't this exactly how MOST businesses operate today? I certainly can't go to my local dry cleaners and request the transaction data for something that happened 2 years ago, much less any sort of metadata about that transaction (3 shirts, one blue two white, no starch). The normal principle most businesses adhere to is a strictly limited time period of "memory" of any particular transaction or interaction, after which it is solely the customer's responsibility to keep records.