Hackers raid eBay in historic breach, access 145 million records

"EBay spokeswoman Amanda Miller told Reuters late on Wednesday that those passwords were encrypted and that the company had no reason to believe the hackers had broken the code that scrambled them."

That seems to imply that eBay used a singular encryption key across its accounts. Surely not?

Re: Hackers raid eBay in historic breach, access 145 million records

#6

Post by panarky » Thu, May 22, 2014, 5:36 AM UTC

adventured wrote: post #5

"EBay spokeswoman Amanda Miller told Reuters late on Wednesday that those passwords were encrypted and that the company had no reason to believe the hackers had broken the code that scrambled them." That seems to imply that eBay used a singular encryption key across its accounts. Surely not?

Journalists and PR people don't know the difference between encryption and hashing.

eBay is steering media reports toward the password story.

Much more important and potentially damaging to eBay's reputation and revenue is that 145 million user records were stolen.

This could be much more damaging than the Target or Adobe breaches.

Re: Hackers raid eBay in historic breach, access 145 million records

#7

Post by ghshephard » Thu, May 22, 2014, 5:42 AM UTC

Here is what I get when I try and change my password:

  Page not available
  Ebay is asking its users to reset their passwords due 
  to the unauthorized access to our corporate information 
  network. This may result in a delay of service due to 
  the high traffic volume. We ask for your patience and 
  that you return to eBay soon.

I wouldn't think that "password changes" were really that heavy a function.

Edit - Finally got through. They are not letting you change your password directly, you either need to respond to an SMS or Email. Probably a (very) good idea if they are worried that someone has done a bulk theft of passwords.

Re: Hackers raid eBay in historic breach, access 145 million records

#8

Post by yeukhon » Thu, May 22, 2014, 5:46 AM UTC

ghshephard wrote: post #7

Here is what I get when I try and change my password: Page not available Ebay is asking its users to reset their passwords due to the unauthorized access to our corporate information network. This may result in a delay of service due to the high traffic volume. We ask for your patience and that you return to eBay soon. I wouldn't think that "password changes" were really that heavy a function. Edit - Finally got thro…

I changed it this morning and had no problem. Yeah I agree that's their intent to stop bad guys from changing passwords.

Re: Hackers raid eBay in historic breach, access 145 million records

#9

Post by digitalengineer » Thu, May 22, 2014, 5:47 AM UTC

"3 months ago"... And "eBay suggest users chanche their password"... Wait, what? I suggest a policy where important breaches in security are disclosed within a short timeframe.

Re: Hackers raid eBay in historic breach, access 145 million records

#10

Post by watson » Thu, May 22, 2014, 5:59 AM UTC

digitalengineer wrote: post #9

"3 months ago"... And "eBay suggest users chanche their password"... Wait, what? I suggest a policy where important breaches in security are disclosed within a short timeframe.

They didn't know about the breach until about two weeks ago [1], though that doesn't normally excuse that they waited two weeks to go public with the knowledge.

One reason to hold back this information is if going public would make their investigation harder OR if going public would increase the security risk (e.g. if the security hole used wasn't yet fixed and going public meant disclosing something about how the hackers got access). But according to what had been made public so far this doesn't seem to be the case.

[1] http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-u...