eBay seems to be coping with the hack of its user database. Weeks on from the announcement that its user database had been breached and we’re seeing millions of users change their passwords after receiving notifications from the online auction giant.
If you missed the news, around 145 million eBay users had their email addresses and encrypted passwords stolen when one of eBay’s databases was breached.
We now know that hackers were able to gain access to the user database by compromising three corporate eBay employees and using their credentials to access the eBay network. eBay has also told us that it believes there was no customer data compromised initially, but gives little more information than that.
We can speculate that the attack was most likely perpetrated through a targeted attack in email or a spear phishing attack. If this is right, the corporate employees of eBay who had their credentials compromised would have been sent a link in an email that tricked them into giving away their user details. We don’t yet know if those credentials were eBay’s website username and passwords or if they were network or corporate credentials.
Spear phishing and targeted attacks have become the de facto attack vector for anyone hacker trying to compromise an enterprise. Attackers know that most organizations have been lulled into a false sense of security regarding spear phishing – thinking that their existing legacy anti-spam and anti-virus systems protect them from spear phishing. While it would be true to say the majority of Secure Email Gateway vendors have started to build in protections for spear phishing; we also know that all the recent major and most public breaches have successfully snuck past major security vendors.
This week brings another personal data compromise. Office, a UK shoe retailer has admitted that its website has been compromised to the extent that customer personal data has been stolen. Office is asking all its customers to change their passwords.
Office and eBay are both quick to point out that no “financial information” was stolen. While this seems to be the case, stealing personal data, as in the Office hack, may give the attackers enough information to allow them to steal your identity. Once you lose that, you risk losing that key financial information.
The CIOs and CISOs I talk to are generally worried; none of them want to be the next big breach. They all understand the risks associated with spear phishing and are all trying to educate their users, but many worry constantly about those few users who still click the link in the email, or enter their user credentials in mystery websites.
Protecting against this human risk is a much tougher task, and until we solve that, these big breaches will continue. It’s why new security technology to counter spear phishing like our Targeted Threat Protection service must be combined with effective user monitoring and education if we are to successfully counter this growing threat to our organizations.