LinkedIn breach .. the multiplier effect


Last week's high profile theft of password for the business networking site LinkedIn has been a topic of many news articles and blogs in the computing and security area.  There was a particularly interesting discussion of the issue of developers not understanding the security implications of using fast hashing algorithms which are intended for high-speed, on the wire, integrity checking such as SHA, for secure storage of passwords.  The argument here is that password hashes should actually use more computationally demanding (i.e. slower) algorithms.  This would increase the cost to the attacker in conducting a brute force attack to identify the correct plain text to match the encrypted passwords in the stolen file(s).

The immediate countermeasure that was publicised through media and through social network 'word of mouth' was that people should change their LinkedIn password.  Of course this created the opportunity for phishing attackers (unrelated to those who stole the passwords in the first place) to try and lure users to their own facade sites to try and get the passwords from users.  In the midst of all this, LinkedIn also sent out an e-mail to users instructing them to change their password.  According to Cloudmark, over 4% of the users who received this legitimate e-mail thought that it was a potential phishing attack and ignored the advice to change their password (thus thinking they had avoided the phishing attack but remaining vulnerable to the attackers who stole the passwords in the first place).  Cloudmark make the point that this is partly due to the fact the LinkedIn have a track record of generating lots of e-mail notifications and therefore users get into the habit of ignoring these e-mails.  However, it is not necessarily true that just because the user ignored the e-mail (i.e. marked it as spam/phishing), that they also didn't go ahead and visit the LinkedIn site directly and change their password anyway.

The one piece of advice I haven't seen in all this coverage is a reminder to people to think about their other service subscriptions where they might have used the same credentials as those used for LinkedIn.  Given the plethora of online services that people use nowadays, and the difficulty of remembering different passwords for each of them, I wouldn't be surprised if many people use the same username/password combinations across many of them.  In these cases, users need to change their login password on those services too.  Otherwise they might experience a multiplier effect of attacks on their other online accounts as a result of the LinkedIn breach.

Comments

Post a Comment

Popular posts from this blog

Cloud Wedge - geek of the week

Image
CloudWedge: 'Geek of the Week' My colleague Yijun Yu recently wrote a opinion piece for The Conversation about how cloud computing could have made a difference to the search for Malayian Airlines MH370.  Essentially the question he poses is: why, in the age of global internet connectivity (including now onboard planes!), do we depend on the onboard flight data recorder for information about what happens on a plane? Of course there are numerous challenges with this - not least the cost of bandwidth for all the flight data (including cockpit audio) to be uploaded in real time and the security of the data.  Yijun's article addresses some aspects of the latter, and the former is not an insurmountable problem.  For example it should be possible to upload basic flight telemetry (e.g., GPS location, air speed, engine statistics and fuel data) without requiring significant bandwidth.  Indeed aero engine manufacturers such as Rolls-Royce deployed engine monitoring systems
Read more

Priming Code Club

Code Club Assembly Presentation from akbandara As part of my work with STEMnet, I recently signed up as a CodeClub volunteer at St. Bernadette's Catholic Primary School in Milton Keynes.  Working with Kate Clarke, the ICT leader at the school, I am going to be leading an after-school club that will introduce kids in Year 5 and Year 6 to the exciting world of programming.  CodeClub is a nationwide, volunteer driven, grass-roots movement to get kids learning about the fun that can be had programming computers, rather than simply using them. In order to give the kids some idea about what they might be letting themselves in for, last week I delivered the short presentation (embedded above) at the school.  I started out by getting the kids to identify different computers, and think about what a computer really does, i.e. follows a set of instructions to complete a task.  We then played with a neat little iPad game called 'Kodable' which allows the player to progr
Read more

Are we losing the Internet Security battle?

Image
I was recently invited by Heimdal Security to take part in an expert roundup, with the theme of "Is Internet Security a Losing Battle?".   The main thrust of my answer was to question our use of analogies of conflict in the context of Internet Security or cyber security.  As I said in my response: "... in this context the metaphors of conflict, such as ‘war’ and ‘battle’ are unhelpful because they suggest that internet security is the responsibility of the technologists who act our defensive force against attackers.   Instead, as has been argued by technology activists like Cory Doctorow  and others we might have more success by thinking of cyber security using the analogy of public health and communicable diseases.   By using this analogy, we make cyber security issues more relevant to people and spur them to gain a better understanding that, like diseases, any of us can be afflicted by a cyber security attack.  We can also adopt an analogous approach for han
Read more