Risk
12/16/2010
11:20 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Reputation Can't Be Delegated

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.I first became aware of the Walgreens breach about a week ago, when the company sent a notice to me, a "valued customer:"

Dear Valued Customer,

We recently became aware of unauthorized access to an email list of customers who receive special offers and newsletters from us. As a result, it is possible you may have received some spam email messages asking you to go to another site and enter personal data. We are sorry this has taken place and for any inconvenience to you.

We want to assure you that the only information that was obtained was your email address. Your prescription information, account and any other personally identifiable information were not at risk because such data is not contained in the email system, and no access was gained to Walgreens consumer data systems.

Although Walgreens, best I can find out, has yet to validate whether the breach was on its own systems, or those of an outsourced service provider, the breach is most likely related to a very similar breach that affected McDonalds. From Darkreading:

McDonald's said a database containing customer email addresses, birth date information, and phone numbers was compromised when its third-party database firm was discovered to have been hacked. McDonald's was contacted by Arc Worldwide, a firm that handles McDonald's marketing and other promotions, that customer information from some of its websites and promotions had been breached via a hack of a firm that handled the database of McDonald's customer emails. Silverpop reportedly was the breached firm in question, but the companies won't confirm or deny the relationship on the record.

Obviously these stolen e-mails can be sold to spammers and they can be used as part of phishing attacks. Fortunately, for Walgreens customers, it looks like only e-mail addresses were stolen. McDonald's customers apparently had much more information gathered about them.

Software security firm Veracode's CTO, Chris Wysopal had this to say about the breaches in the same Darkreading article:

"The supply-chain risk we are seeing as the increasing specialization of services has companies outsourcing more and even has outsourcers outsourcing. This 'Russian doll' effect means that the biggest doll suffers if any of the smaller dolls has a breach. Outsourcing contracts should require security due diligence on the outsourcer, and subcontracting should trigger more due diligence that passes up the chain."

Great advice. Because the security of your partners - especially if they are handling customer data - is crucial. And it needs to be vetted and contractually enforced. It's not a new problem, but it is an important one.

You can outsource services, and you can even outsource security, but you can never outsource your reputation.

Brian Krebs first broke the news that e-Mail marketers were being targeted. Excellent background is available here.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4077
Published: 2015-09-03
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allows local users to read arbitrary kernel memory via a 0x22608C ioctl call.

CVE-2015-5189
Published: 2015-09-03
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

CVE-2015-5190
Published: 2015-09-03
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.

CVE-2015-5735
Published: 2015-09-03
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allows local users to write to arbitrary memory locations via a 0x226108 ioctl call.

CVE-2015-5736
Published: 2015-09-03
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.