31–40 of 41 posts
Earlier quoted context omitted.
They didn't require 2FA. That's the only arguably poor security I see. Is there something beyond that they should have done?
Encryption at rest.
The bad guys obtained user passwords from breaches at other sites where some 23andMe users had accounts and had used the same email and password as their 23andMe account. They logged into those 23andMe accounts and obtained data that those accounts had access to.
Earlier quoted context omitted.
What would you suggest? Storing data on the blockchain where costs per GB are tens of orders of magnitude higher?
No, storing multiple copies on _encrypted_ data with private keys in possession of the owners of data, not companies processing / storing it. That way you could leave those files on an HTTP server and it would be safe. The driver for centralised storage of DNA and other data is the business model based on resale of the data in raw or processed form.
Are there any reports of anyone actually harmed by this, or is it all tiresome righteous indignation?
Are you saying you'd be ok a company leaking not just your sequenced DNA (and the avalanche of things that says about you), but who you're related to, by DNA?
Isn’t that what all of these “I did my DNA and you’re my dad!” and “Ancestry.com cold crime DNA break” stories prove?
You DNA leaked, change your DNA ASAP.
Earlier quoted context omitted.
If the customer loses the key to the encrypted data, then it's useless to everyone , including bad actors. This is not what happened here. 23&Me exercised poor security. I deal with financial data for my job, (like, transactional data, for most Americans), and I would consider that less sensitive than DNA data. We lock that transactional data up so tight it'd make your head spin. If it's data about an individual, in…
They didn't require 2FA. That's the only arguably poor security I see. Is there something beyond that they should have done?
What looks "normal" depends on the org, but 23&Me knows what it is (or should, since it's a fundamental of running their business).
Just as a made up example, they may know that 85% of users don't use VPNs, and typically have an IP address that geolocates within 100 miles of their mailing address (which 23&Me has on file). Users might also typically log in very infrequently between 12-4am (localized to their IP/mailing address). And when they do log in, 90% of the time it's to see the new content you just sent a marketing email about, with short session lengths as well.
A user who logs in through an IP that geolocates well outside of their mailing address and methodically steps through every possibly thing you can click on at 3:15AM, is probably a bad actor who gained access through credential stuffing attacks.
Off the shelf tools can automatically detect all of that kind of behavior, and more. They can look at the collective traffic patterns and see a bunch of users logging in from the same pool of IPs, or the same VPN, or around the same time, or using the site in the same way as others bearing similar attributes. They can stop wide spread coordinated attacks from botnets.
The same tools can automatically detect and alert when credential stuffing attacks are happening, locking down accounts and requiring their passwords to be reset.
Given the scale at which 23&Me operated, it's impossible that they weren't aware of these tools.
Investing in the right tools is just one of many things they could have done. Even with those kinds of tools, you need to assume they're not enough (even if they are), so you encrypt everything at rest. Every decryption gets audited, and audit logs get fed into the same monitoring tools used to alert and stop abnormal behavior.
It all sounds overkill, but remember: they lost 91% of their valuation. All it took was the wrong people getting in, and it tanked their entire business.
Earlier quoted context omitted.
Encryption at rest.
What makes you think they didn’t have that? The bad guys obtained user passwords from breaches at other sites where some 23andMe users had accounts and had used the same email and password as their 23andMe account. They logged into those 23andMe accounts and obtained data that those accounts had access to.
Where is the wall to wall 24x7 coverage of this? I guess if it's not a company that is competing for eyeballs and clicks then it's not a big deal...
It was already extensively covered when it was new. It probably died down because when you strip the sensationalism from the stories it comes down to this. 1. Bad guys took leaked emails and passwords that were leaked from other sites and tried them on 23andMe. 2. 14000 of those people in those leaks from other sites had 23andMe accounts and used the same email and password at 23andMe. 3. That gave the bad guys acces…
Thanks for clearing that up.
I'm into cyber security as a hobby....and one thing has always confused me regarding these breaches. Lots of these things are sold on the dark web and they might release snippet samples to get a buyer but my understanding is that unlike the old days of hacking....they normally don't release the entire stolen content unless they really believe in totally free data, or they have some massive gripe with the company. Nor…