Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/29/2018
05:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Dell Forces Password Reset for Online Customers Following Data Breach

Move prompts questions about scope of intrusion and strength of company's password hashing.

Dell has reset passwords for all customers of its online store following a data breach in which the names, email addresses, and hashed passwords belonging to an unknown number of people may have been exposed.

In an advisory this week, the computer maker said it had detected unauthorized activity on its network Nov. 9 involving an attempt to steal customer data. While there's no conclusive evidence the attackers succeeded, it is possible that at least some information was removed from the Dell network, according to the company.

To mitigate risk, the vendor has implemented a mandatory password reset for all registered Dell.com users. Next time these users attempt to login to their Dell accounts, they will be prompted to change their passwords. The hardware maker is also asking users to reset passwords on any other accounts protected by the same password they had used for Dell.com.

On a newly established customer update website, Dell described the incident and the password reset as primarily impacting customers of Dell.com, Dell.com, Premier, Global Portal, and support.dell.com.

The attackers do not appear to have targeted credit card and other sensitive customer information. The incident did not impact any of Dell products or services either, the hardware maker said.

Dell's statement provided no information on how many users of its online site might have been impacted by the incident. But based on Dell's actions, the number could be quite large, says Ilia Kolochenko, CEO of High-Tech Bridge.

"Usually, a mass password reset is a hallmark of a data breach impacting all customers," Kolochenko says. "If it's not the case, it should be clearly explained and emphasized." Leaving customers in the dark about any breach involving personal data is never a good idea, he says.

The mass password reset could also be an indication that Dell is not fully confident about the resilience of the hashed passwords against brute-force cracking attempts.

Typically, password hashing should make passwords unusable to criminals. But a lot depends on the strength of the algorithm that is used for the hashing, says Jarrod Overson, director of engineering at Shape Security. "Without details, it's safer to err on the side of caution, which, in this case, is that the hashes were generated with an algorithm that is quickly crackable, like MD5," Overson says. With such hashing, a hacker could use a free, open source tool like Hashcat to automate the testing of common or generated passwords, he says.

Ideally, organizations should consider storing password hashes generated by an algorithm such as bcrypt, which is generally considered to be very resistant to brute-force hacking, Overson notes.

Email account data and passwords have become increasingly hot commodities in underground markets. Because many users tend to use the same password across multiple accounts, attackers have been increasingly using breached username and password pairs to try and break into as many accounts as they can.

Credential-stuffing attacks, where criminals automatically enter large volumes of leaked credentials into e-commerce and other websites, have become increasingly common in recent years. In fact, underground chatter related to compromised accounts increased 150% year over year on Black Friday and Cyber Monday, according to new holiday shopping season cyberthreat stats from Cyberint. Chatter about attack tools, predominantly for credential stuffing, increased 20%, according to the vendor.

The trend has focused growing attention on the need for strong password and user authentication measures. Hashing and encryption are increasingly seen as basic steps to ensuring password integrity in the event of a data breach.

Since Dell has said the passwords for Dell.com users were hashed, it is likely the company is merely being extra careful in resetting them anway.

"It's a matter of how sophisticated their hashing technique was and how unusable the passwords could be for cybercriminals," says George Wrenn, CEO and founder of CyberSaint. "Regardless, the fact that Dell pushed for a password reset would ideally block that risk. It is clear that Dell is aggressively dealing with the incident."  

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .