In response to the Tumbler and Myspace breach news, security experts from InfoArmor, Lastline and Balabit commented below.
Andrew Komarov, Chief Intelligence Officer, InfoArmor:
We have access to the stolen information, and can confirm that Tumblr’s database is hashed, using its own algorithm, and all the passwords with salt. That’s why without it – it is impossible to decrypt it. To do so would be long-term brute forcing of an unknown hash type with no salt. Previously, some cybercriminals claimed to name it the “Dropbox” database, but it was not confirmed, and it created some confusion in the security community
The lessons from these most recent hacks are the same as those for many of the others. In this case, the number of passwords stolen is huge. The organizations themselves need to invest in newer technologies to protect against the increasing complexity of attacks.It’s good that they salted the passwords. That wasn’t enough. Multi-factor authentication will make it much more difficult for any stolen passwords to be used. For individuals, the advice is: don’t ever use the same passwords across multiple accounts, do change them on a regular basis, and definitely consider licensing a password manager Just a little bit of paranoia can go a long way in protecting your passwords and your identity.
István Szabó, PhD, Product Manager, syslog-ng, Balabit:
“Passwords are the most traditional way of protecting accounts. These breaches show the inherent weakness of over-relying on passwords as the only means of protecting accounts and sensitive information. Anyone who has the credentials will be granted access if ever the credentials used are stolen from the legitimate user.
“Organisations need to think about deploying additional tools that can substantially increase information security without further constraining the business and hindering legitimate users. Monitoring activities and using user behavior analytics on the collected data set, and especially monitoring the activities of privileged users whose accounts enable access to very critical information, is a promising new approach. User behavior analytics can help detect, alert and block access an organization’s date automatically, if an attacker attempts to use the stolen credentials.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.