Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

8/9/2019
01:30 PM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

State Farm Insurance Notifies Users About a Breach but Doesn't Panic

State Farm Insurance has filed a notice of data breach that involved customer accounts, seemingly to meet California regulations.

State Farm Insurance has filed a notice of data breach that involved customer accounts, seemingly to meet California regulations. The letter is concise in its description of what went on, yet transparent. State Farm said in the letter (describing what information was involved): "During the attempted access, the bad actors received confirmation of a valid user name and password for your account. No sensitive personal information was viewable. After a review of your online account, we have also confirmed that no fraudulent activity occurred."

That says to the account holder exactly what needs to be said about what went on. It has no buzzwordiness to it, which would make things far more opaque. It tells you the downside, but outlines all the main points of the entire situation.

They go on to tell the account holder how they are responding by saying, "What We Are Doing: To defend against the attack, we reset your password in an effort to prevent additional attempts by the bad actor." Simple, correct and illustrative.

They also tell the account holder to mend their evil ways, lest bad actors take advantage of their habits. They note in the letter: "If you use the same password for other online accounts, reset those, too. While it is often easier to return to a previous password that is easy to remember, a bad actor may have already obtained your user ID and password and may use it to access your online accounts with State Farm or other companies. By creating a new and unique password for each online account, you can reduce that risk." Bravo. Sensible, and true. Password reuse is endemic, and a vulnerability.

Adam Laub, chief marketing officer at STEALTHbits Technologies, commented on the recommendations that State Farm made in the letter.

He told Security Now, "As already implied, unique username and password combinations are indeed the number one way to mitigate the effectiveness of credential stuffing attacks. However, the burden of creating and maintaining these unique combinations falls on the shoulders of the proverbial "weakest link" (i.e., the end user). It may be time for organizations to take matters into their own hands though. If end users can't or won't comply with the guidance being provided to keep their accounts safe, perhaps proactive analysis of user account passwords and forced remediation when they're determined to be vulnerable to password guessing attacks may be the only way to address this particular attack vector. The fear for businesses is obviously end user pushback, but with stiffening regulations and fines, the cost of end user frustration would appear to be minimal in comparison with non-compliance."

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14300
PUBLISHED: 2020-07-13
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in th...
CVE-2020-14298
PUBLISHED: 2020-07-13
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the co...
CVE-2020-15050
PUBLISHED: 2020-07-13
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.
CVE-2020-10987
PUBLISHED: 2020-07-13
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
CVE-2020-10988
PUBLISHED: 2020-07-13
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.