Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Store hacked in India, passwords stored in plain text

engadget.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Microsoft Store hacked in India, passwords stored in plain text

#11

Post by CoffeeDregs »

yeahboats wrote: post #9

The store isn't actually run by microsoft, but rather Quasar Media. It tarnishes Microsoft's name, but it isn't their fault. http://www.theverge.com/2012/2/12/2793459/microsoft-store-in...

Was it the Microsoft store or not? If it was an MS store, then it's their fault. The store was branded with the MS brand in order to convey to consumers that the store could be trusted. That Microsoft contracted hosting/development out to a crappy firm is Microsoft's fault not the consumer-who-trusted-their-brand's fault. Users trusted that an Microsoft-branded domain would be kind. Fail.

Re: Microsoft Store hacked in India, passwords stored in plain text

#12

Post by kyberias »

hhjj wrote: post #8
latch wrote: post #5

Earlier quoted context omitted.

No, if you look at the characters in the UI. Still, clearly the answer is that's a hacker's computer. Just because its an India store doesn't mean the hacker is Indian.

Some engadget reader sent the content of the file with a screenshot. Maybe a hacker's computer not necessarily the hacker's computer. Just to be clear.

Yes that cleared it up, thanks.

Re: Microsoft Store hacked in India, passwords stored in plain text

#13

Post by tomfakes »

CoffeeDregs wrote: post #10

So I've worked in an ASP.net environment and I generally hated it, but ... The overall framework had a lot of features and examples abounded ( http://msdn.microsoft.com/en-us/library/ff648341.aspx)[2005] . It's very difficult to imagine a company > the many ASP.net examples in order to store passwords in plaintext. It's astounding to see that Microsoft itself did so... Seems that it says that examples don't actually…

A long time ago (10+ years), Microsoft cleaned up all of their sample code for security purposes to avoid people cut and pasting insecure code to stop exactly this type of boneheadedness.

Re: Microsoft Store hacked in India, passwords stored in plain text

#14

Post by haberman »

drivebyacct2 wrote: post #6
latch wrote: post #4

I love how the fields are prefixed with acronyms for the table name.

Curious, is there a good reason to do this ever?

They were probably using a C compiler from the 70s that puts all struct members in a global namespace.

Re: Microsoft Store hacked in India, passwords stored in plain text

#15

Post by est »

unhappyhippie wrote: post #2

Can someone explain why the screenshot contained text that looks Chinese.

according to the hacked page, it's obviously a Chinese Hacker

http://wpsauce.com/wp-content/uploads/2012/02/microsoftstore...

http://ps.s.blog.163.com/

http://ps.s.blog.163.com/blog/static/89878892201211132353615...

Note from the blog page

> 不解释，撸过~

actually means "No comment, fap fap fap"

Re: Microsoft Store hacked in India, passwords stored in plain text

#16

Post by jeswin »

Whenever you outsource make sure you watch the code very, very carefully. At least 90% of the people I meet (at least here in Bangalore) would store passwords in clear text and not know why this is a bad thing.

Microsoft fully deserves the blame here, for not asking basic questions. Besides, the rest of the code is likely to be smelly too if the entire team failed to notice the issue.

Re: Microsoft Store hacked in India, passwords stored in plain text

#17

Post by scragg »

drivebyacct2 wrote: post #6
latch wrote: post #4

I love how the fields are prefixed with acronyms for the table name.

Curious, is there a good reason to do this ever?

When you do a SELECT * and with a join or two, you get the chance of field name conflicts which can cause logic errors. You either have to alias the conflicting fields, specify each field you want on the select, or prefix field names so they never conflict.

Re: Microsoft Store hacked in India, passwords stored in plain text

#18

Post by cookiecaper »

drivebyacct2 wrote: post #6
latch wrote: post #4

I love how the fields are prefixed with acronyms for the table name.

Curious, is there a good reason to do this ever?

If you are using PHP without a framework and mysql_array_assoc, there can be collisions / inconsistencies / problems in joined columns that have the same name. I've run into it a few times. Most decent systems don't choke in that case, but there are cases where it's simply easier to prefix column names instead of writing AS everywhere. If you're working with really long SQL queries generally it can also help make things more explicit.

I don't do this usually but I have run into a couple of occasions where it would have helped out.

Re: Microsoft Store hacked in India, passwords stored in plain text

#20

Post by sriramk »

Disclaimer: I used to work for Microsoft

I think Microsoft needs to take a ton of heat for this one.

a) They outsource something running on a Microsoft domain, with the Microsoft logo, etc to an external entity, something customers wouldn't know about unless they read the ToU

b) That external entity wasn't held to even the most basic of security precautions - no MSFT online property would even be allowed to store passwords (that's the job for the LiveID guys) let alone do it in cleartext.

This is the sort of move for which people should get fired over.

Post reply on HN