Subscribers of UK-based MoDaCo, a forum specialising in smartphone news and reviews, have been unpleasantly surprised by notifications that the site and their account have been compromised. IT security experts from AlienVault and ESET commented below.
Javvad Malik, Security Advocate at AlienVault:
“This unfortunately highlights how poor the threat detection and breach monitoring capabilities of most companies are. It appears as if the breach occurred in January 2016, a full eight months ago. Being attacked or being a victim of a successful breach is an unfortunate event that can’t always be prevented. But knowing that you’ve been breached is just as important in order to respond in a timely manner.”
Mark James, IT Security Specialist at ESET:
“People are receiving reports from one of the many breach notification sites that MoDaCo has suffered a breach of over 875 thousand accounts. With data that includes email & IP addresses, passwords and usernames, nothing out of the ordinary there. To be honest data breaches happen all the time, this particular one is causing a bit of a storm on their own forums as the users would like to have received notification from the owners first not through a third party site. Looking through the forum posts many of the users have not used the site for a while and were looking for means to delete their accounts. The problems of course are that when we create usernames and passwords on sites that reflect our current interests if we then move on or stop using those sites it’s sometimes difficult or almost impossible to delete those redundant accounts. This breach apparently happened in January 2016 (that needs to be confirmed officially) but at least the passwords were stored as salted MD5 hashes and not in plaintext.”
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
