Dell announces security breach
zdnet.com
Dell announces security breach
1–10 of 29 posts
Re: Dell announces security breach
#2It's insane that companies are allowed to say "yes there was a security hole, but no we don't have logs, therefore nothing was stolen, so stop asking."
Their refusal to give the number of exposed accoundlts makes it seem like it's pretty bad.
Re: Dell announces security breach
#3From https://www.dell.com/customerupdate
What is a “hashed password”? Hashing is a cryptographic security mechanism, similar to encryption, that scrambles customers’ passwords into an unreadable format. Dell ‘hashes’ all Dell.com customer account passwords prior to storing them in our database using a hashing algorithm that has been tested and validated by an expert third-party firm. This security measure limits the risk of customers’ passwords being revealed if a hashed version of their password were to ever be taken.
Re: Dell announces security breach
#4Dell's been an open book for years.
One piece of spam I've got on a brand new email account was ~1 day after ordering a brand new XPS. It was a fake tracking code email about my dell order with correct details like laptop, account name, price. I contacted dell and only managed to find out my order wasn't even in the post yet. They weren't interested in anything.
And I also never got any more than that specific 1 piece of spam.
Re: Dell announces security breach
#5Dell's been an open book for years. One piece of spam I've got on a brand new email account was ~1 day after ordering a brand new XPS. It was a fake tracking code email about my dell order with correct details like laptop, account name, price. I contacted dell and only managed to find out my order wasn't even in the post yet. They weren't interested in anything. And I also never got any more than that specific 1 piec…
What makes you think Dell didn't send it? I get that the tracking code was fake but what else? (Example: direct link to a phishing site.)
Re: Dell announces security breach
#6Dell redirected the vulnerability press release link to a Christmas Deals page. Heh.
Re: Dell announces security breach
#7From https://www.dell.com/customerupdate What is a “hashed password”? Hashing is a cryptographic security mechanism, similar to encryption, that scrambles customers’ passwords into an unreadable format. Dell ‘hashes’ all Dell.com customer account passwords prior to storing them in our database using a hashing algorithm that has been tested and validated by an expert third-party firm. This security measure limits the…
They've provided some pretty reasonable information.
Not just, your account details are safe.
Re: Dell announces security breach
#8From https://www.dell.com/customerupdate What is a “hashed password”? Hashing is a cryptographic security mechanism, similar to encryption, that scrambles customers’ passwords into an unreadable format. Dell ‘hashes’ all Dell.com customer account passwords prior to storing them in our database using a hashing algorithm that has been tested and validated by an expert third-party firm. This security measure limits the…
Bleh. Maybe it's too much to hope for a company like that to give any specifics but that's pretty empty by itself. I mean, great, they didn't use plain text(!), but "MD5 with no salt" would fit that blurb just fine too. I really hope Dell was properly using an adaptive hash, but usually when companies do a good job there they want to tout it because it does in some small way show they care somewhat despite the breach. Even if it should be the norm saying "we used bcrypt with 65k+ rounds" or whatever is legitimately reasonable to put in there.
Re: Dell announces security breach
#9If software development was a true profession, then I firmly believe that many developers would be struck off for extreme negligence or incompetence.
I’ve found and reported serious security vulnerabilities to many companies that I’ve worked with, and become very disillusioned with some of the responses. Companies that operate in fields which materially affect people's lives (such as healthcare, finance and telecoms) will deploy software that is so badly designed that there is often no need to break any technical aspect to get access to private and sensitive data.
Yet, when I report a breach, the same people who deployed software with broken (or sometimes no) authorisation models, access control, etc, are suddenly competent enough to investigate their own failure. Invariably, they always have perfect logging and reporting that could not possibly have been evaded and which proves that no breach occurred or data was exfiltrated before the vulnerability was reported.
If another professional, say an engineer, lawyer, or doctor, had demonstrated the incompetence or negligence in their field that I’ve seen some software developers display (sometimes wilfully - “It’s a feature”), they would never be allowed to work again. Software is now so important that I believe that some of the developers and technical leaders that I have dealt with in resolving security vulnerabilities should never again be allowed to work with software that interacts with personal or sensitive data (or, more generally, with software that could affect human life, safety, or privacy).
Re: Dell announces security breach
#10If software development was a true profession, then I firmly believe that many developers would be struck off for extreme negligence or incompetence. I’ve found and reported serious security vulnerabilities to many companies that I’ve worked with, and become very disillusioned with some of the responses. Companies that operate in fields which materially affect people's lives (such as healthcare, finance and telecoms)…
I agree emphatically, and it’s why I’m a member of the BCS (British Computing Society). It’s absurd that we have people building essential public infrastructure with close to no repercussions when their failure screws people over.