Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delta Dental says data breach exposed info of 7M people

bleepingcomputer.com

Post reply on HN
Print view View original

131–140 of 152 posts

Re: Delta Dental says data breach exposed info of 7M people

#131

Post by spunker540 »

8n4vidtmkvmk wrote: post #115
13of40 wrote: post #81

Earlier quoted context omitted.

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand. If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you…

I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.

They process so many transactions per second. It doesn’t seem too hard to try wrong ccv at a pace slow enough to avoid detection.

Re: Delta Dental says data breach exposed info of 7M people

#132

Post by neilv »

ngneer wrote: post #41
fatnoah wrote: post #11

Earlier quoted context omitted.

It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a screen to be able to see CC numbers for their own customers, and our response was a flat no. Any sensitive data was encrypted and sequestered, and security codes were absolutely not stored. In my current role at a startup, when a conflict between schedule/time or con…

Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?

> what is people's typical response and what is the dynamic?

Not the OP. One place, a few times when I was doing an integration with a large company, I discovered a grave security flaw in the customer's systems.

One time, had I done the integration despite the flaw, it would've required me to knowingly code some obviously 100% wrong use of cryptographic protocol.

When I started to tell the director to whom I reported, I felt an initial "oh no..." mixed with skepticism, from hints in their voice. So I explained, and answered their questions.

Then they seemed to switch from dread, to solving it. Instead of quietly taking the client's money, they halted integration, and put together a presentation for the customer, telling them how part of their security had a grave problem. (Possibly awkward, because it might've been a team internal to the customer who had made such a mistake on something so sensitive.)

I'd say that the dynamic in that case was what you'd like to imagine from engineers who'd risen in influence: acknowledging the problem, understanding and doing the right thing, when it had to be done, even when they wish it didn't.

Re: Delta Dental says data breach exposed info of 7M people

#133

Post by skibbityboop »

13of40 wrote: post #81
chefandy wrote: post #34

Earlier quoted context omitted.

> Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers This seems almost as reductive as suggesting my mechanic should keep her customers' key(k) in their cars(c) in her parking lot because instead of just acquiring c, now the thieves just need to acquiring c+k. If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authe…

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand. If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you…

> If you have a whole database of them, the trick is to try one code with a thousand cards

That still sounds like a crapshoot... Of those 1,000 cards, there might be 14 that have 982 as CSV, 9 that have 307, and none with 118. In other words, there's no guarantee whatsoever that any given CSV will be used in a batch of 1,000 or even 10,000 cards.

Re: Delta Dental says data breach exposed info of 7M people

#134

Post by droopyEyelids »

highwaylights wrote: post #5

Surely the data breaches we hear about are the tip of the iceberg? Just think of what needs to happen after a hack for you to hear about it: - someone at the company needs to be aware it has happened. - they need to accurately identify what was accessed. - they need to disclose that this has happened. - it needs to be visible enough that it gets picked up and talked about. Each step of that funnel must have some drop…

You're only looking at it from one end of the funnel.

On the other end you have security researchers who are active in the cybercrime underground markets, and have the same opportunity to buy stolen data as the criminals themselves.

So disclosure can come from the other end when it becomes apparent that a certain company's data is being sold, and I think almost all of it does get sold eventually, even if the initial hacker has a way to exploit it privately: After they've finished, they can make money selling the leftovers.

Re: Delta Dental says data breach exposed info of 7M people

#135

Post by neilv »

neilv wrote: post #132
ngneer wrote: post #41

Earlier quoted context omitted.

Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?

> what is people's typical response and what is the dynamic? Not the OP. One place, a few times when I was doing an integration with a large company, I discovered a grave security flaw in the customer's systems. One time, had I done the integration despite the flaw, it would've required me to knowingly code some obviously 100% wrong use of cryptographic protocol. When I started to tell the director to whom I reported…

I've also seen other dynamics, in which pointing out what should be showstopper problems didn't go as well.

I assume that the most common in business as a whole is a variation on: someone doesn't want to hear about it, because (put broadly) acknowledging it would conflict with business goals or their individual goals. Example conflicts: don't get a sale, slip the schedule, fail to meet some individual OKR/KPI, or expose an earlier mistake of the individual.

Also, the dynamic doesn't have to come down to conflicts between plausibly rational motivations (for business or self). Egos and irrational cognition are also parts of our collective human situation, and an individual's particular traits (or a personal challenge they're going through) can sometimes lead to that taking over decisions. It happens, and we should try to realize when that's the cause (rather than just an attempt at cover for some rational motive they don't want to state), so that we can try to get to rational decision-making.

A different thing, or a complication: There are also be dynamics in which an 'ambitious' person in an org, not naturally involved in the situation, uses the situation to grandstand or hit a rival. And obviously this can affect the dynamics for people who are involved (e.g., person A would normally do the aligned thing for the company, but it's more complicated now that B will twist that to gun for their job). Fortunately, I don't immediately recall seeing an egregious example first-hand, but have heard of it.

Re: Delta Dental says data breach exposed info of 7M people

#136

Post by 93po »

lovecg wrote: post #47
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

They won’t and it won’t be.

Hey come on, when Target had their data breach in 2015 due to massive negligence and incompetence, the largest data breach ever to date, they had to pay about 1.6% of their average net income at the time in penalties. I imagine Delta will pay less than that since, you know, it isn't as bad.

Re: Delta Dental says data breach exposed info of 7M people

#137

Post by chefandy »

spunker540 wrote: post #131
8n4vidtmkvmk wrote: post #115

Earlier quoted context omitted.

I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.

They process so many transactions per second. It doesn’t seem too hard to try wrong ccv at a pace slow enough to avoid detection.

I would need to hear that from someone who actually works in a CC company fraud department because I don't think it's that straightforward. I've had MC transactions declined on a card I use for everyday purchases at two stores in my neighborhood. I don't think reasoning about their transaction monitoring like someone might monitor network traffic is a good analog-- they're specifically looking for patterns in small-scale, localized events without many data points. They don't have to connect the events to stymie the fraudster's efforts.

Re: Delta Dental says data breach exposed info of 7M people

#138

Post by chefandy »

13of40 wrote: post #81
chefandy wrote: post #34

Earlier quoted context omitted.

> Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers This seems almost as reductive as suggesting my mechanic should keep her customers' key(k) in their cars(c) in her parking lot because instead of just acquiring c, now the thieves just need to acquiring c+k. If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authe…

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand. If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you…

Their fraud detection algorithms are specifically looking for small, localized, per-transaction events with few data points as well as overall patterns-- I doubt it would be that straightforward. It might not mean you'd be targeted, but on a per-transaction basis, I there's a good chance you'd get blocked for any individual attempt even if you got a match.

Re: Delta Dental says data breach exposed info of 7M people

#139

Post by eli »

gowld wrote: post #101
__derek__ wrote: post #60

Earlier quoted context omitted.

The title is borderline click-bait: I have had Delta Dental insurance at every employer, so I clicked through to read more, but I've never lived in California or been employed by a California company.

Did the title say your info was leaked?

"Delta Dental" is actually 39 different affiliated companies sharing a brand. Of those 38 seem to be unaffected.

Re: Delta Dental says data breach exposed info of 7M people

#140

Post by calfuris »

quacker wrote: post #129
callalex wrote: post #75

Earlier quoted context omitted.

They are, and that is not what Delta “insurance” covers.

I’m not sure why you say this. Maybe I don’t understand what you mean. I have Delta Dental through my employer’s benefits and it covers all the types of operations that I’d expect: preventive, endodontic, periodontic, orthodontic, prosthodontic, etc. If I need a root canal, it’s covered by Delta Dental (up to a point, given the deductible). If I chip a tooth, and get an inlay or onlay, that is covered. Is this not in…

Where I live, Delta offers a plan that essentially provides a set price list for various procedures as long as you are in network. Perhaps the person you're replying to has run into that plan and didn't realize that they also have more conventional plans.
Post reply on HN