Given that the annual FileMaker Developer Conference is held at Marriott properties, this might be of interest if you've attended in the past four years:
Marriott Breach Exposes Data of Up to 500 Million Guests - The New York Times
I'm not entirely sure if it applies so I'd love it if anyone has more information!
Attendees may want to keep an eye to: https://haveibeenpwned.com/ Troy Hunt is a very good guy and provides a great (free) service there. It’s too soon for the Marriot breach to be there, but I expect he’ll find a way to add it eventually (depending on where the data ends up). When/if he adds it one will be able to see if their details were among the breach (by email address). He has commented on Twitter about the breach (@troyhunt).
No affiliation, just one (among many) whom I follow for security stuff.
Both the Wall Street Journal and CNBC have had extensive reports on this incident. Check out their respective websites at www.wsj.com and www.cnbc.com for these stories.
This started in 2014 at the Starwood properties (Sheraton, Westin, W Hotels, St. Regis, Aloft etc.) two years prior to Marriott's 2016 acquisition of Starwood and three years before that acquisition was final. Nevertheless, it is a troubling set of circumstances. The 2019 DevCon hotel is part of Gaylord Properties, another Marriott brand.
Steven H. Blackwell
Platinum Member Emeritus, FileMaker Business Alliance
Totally steve very troubling! It is being reported here in the UK that it is just Starwood and maybe even only their membership database. Clearly a danger when acquiring another hotel is their IT system is not up to speed.
I have been troubled by the security of hotels for many years. I well remember discovering from a contractor I was working with who showed me how to gain access to the main servers in my hotel using the the hotel tv network. It was complet unprotected once you got in. He was even able to change rates and comp bills. It could have been a cheap stay but I would not let him. I also gave the hotel a major bolloxing!
These days they have them a bit better sorted linking most things through wifi But they are easily sniffed and hacked And then are those plugs in the wall! I never use them!
Over here in the Europe I stick to my 4G & hardly if ever use the hotel WiFi!
That doesn’t help with your data being stolen from the hotel database, but it tells a story as to how unsafe their structures are!
Just recently I obtained, as a demonstration to a hotel IT guy, an entire list of devices and what they were using from my iPad from the public WiFi in the lounge! You can be sure it wasn’t like that when I left but they needed to spend over $20k to make it Totally right.
It Is also not just the hotel information that is at risk. Yours is as well. I could see many guest devices and could get the access to most easily if I had wanted to. That being illegal you can be sure I did not! It is however a salutary warning.
LOCK IT DOWN!
If you use 1Password as your password manager it's WatchTower utility (in the tool itself) will tell you if any of your email accounts have been hacked also.
Encrypted or not it is sill stored in the cloud to sync across machines. Different to the apple Keychain with is stored on your devices only
I expect however for android and windows it gives a higher level of surety against hacking. (and yes i did mean surety not security)
I wasn't talking about syncing 1Password items, Don, but I not sure I understood your reply.
This link might help: https://watchtower.1password.com/
Check out their literature. In order to sync it across devices, you share it on drop box or another similar platform
Noted security analyst Brian Krebs comments on this incident on his BLOG:
Steven H. Blackwell
Platinum Member Emeritus, FileMaker Business Alliance
FYI, 1Password does allow synchronization via Apple's iCloud. Also, Apple's Keychain can also be set up to sync with iCloud.
They also “joined” with Troy Hunt’s https://haveibeenpwned.com/ . “Joined” isn’t quite the right term — there’s now a collaboration there due to mutual respect of respective missions. Troy blogged about it and has been very transparent about the events leading up to the relationship.
Hmm. This looks like a pressure sale but I am not ready to decry the project because of that. The principle of testing it against known hacks is sound.
Why do I say it is a pressure sale? Well because the only thing it got right on the address I used was it was not in 1 password
1) it already has two factor authentication
2) it also has geographic tagging
3) it is machine secure [the email only works with specific machines]
4) it is no longer associated with the sites it mentions because it was removed from them because of hacking [oh and one of the sites was one of their sync partners erm,Drop box!]
5) finally I fed in a random name and it returned a similar result even though it was in fact not a FQMA [ it didn’t have @ sign or the top domain ie .com]
This does raise two important points though:
NEVER use the email password for other sites
and
NEVER use the same password for different sites associated with the same email
Apples keychain uses icloud as a pathway only no data need be stored in the iCloud. It is all stored on devices unless you specifically activate iCloud Keychain
Good article. Thanks Steven
Hi Don, thanks for sharing your experience with haveibeenpwnd. I have never seen that screen as I've not actually visited the site in a while. Good feedback.
I followed Troy some years ago and liked his point of view on many security topics (I follow Krebs, Schneier, and many others as well). My first visit to haveIbeenpwnd (HIBP) was well prior to any affiliation with 1Password. Troy had blogged about password managers more than once, but didn't push any particular one, sharing what he liked about ones he had explored and settled on for his own use. He often laments services which have a password policy which don't allow their use (pasting not allowed, short string limit, limited character set, etc.).
On my first (and primary) visit to the site I entered a few of my email accounts and got two hits for services for which I was aware I was included in a breach, and one of which I was not aware. About a year later I received an email from the HIBP site saying one of my email addresses was included in a new breach; a breach for which the affected service had not notified me (they did a few weeks later). I changed the password there, of course.
Since then I have only been a passive user, i.e. don't visit there and simply have a couple of my email addresses registered there for monitoring. No new emails of late. Depending how far back the Starwood issue goes (age of data), I may be in that one, as I used to be a Platinum member there. I don't recall any web service associated with my experience there, but they had my email address, so it may turn up.
Troy was very transparent about the process to "affiliate" with 1Password; he expressed concerns about misinterpretation and so fourth. He has been very transparent about how he accepted sponsorship (in lieu of ads) on his blog to help offset costs there as well.
All this being said, I appreciate what Troy has built (and the significant cost associated), but had I met that page (your inserted image) on my first visit, especially without knowing much about Troy Hunt, it may have given me pause as well.
BTW: I don't use 1Password or any password manager. I use unique, long passwords with good entropy, and have my own encrypted method for storing them when my memory needs a jumpstart. Also, 2FA often doesn't work for me unless a service uses email for for it. Those which force the use of mobile or landline phone use for an SMS or voice PIN don't work for those of us who are always traveling overseas, swapping SIMs, and so on unless they'll send to an international number. Thankfully, at least apps are getting better about sending a one-time-use password to an email address (admittedly less secure). Most of my banks are worthless in this area, so no 2FA, just very strong passwords.
Cheers
EDIT: I had read this on Troy's site so I guess I had seen that screen you posted. I guess I wasn't triggered then because I wasn't seeing it as you did, on my first visit, but within a blog. Mozilla added HIBP into Firefox as well.
This is a nice read that some may enjoy. It shows how some companies are becoming proactive in guiding users to use better passwords. Those in the tech community (in any sector) are often more savvy and vigilant about good password "hygiene" (as compared to the general population), but Web services need to take a more committed role with securing data and helping users to make good choices for login credentials.
It's a two-way street, for sure, but the onus lies primarily on the service provider vis-a-vis data collection and storage methods: use bcrypt + salt + key stretching; collect only data absolutely necessary to the service provided; purge data which isn't needed beyond the current service experience (eg. how long does Starwood need to store your passport data beyond your visit?); be mindful of what data are stored in plain text vs encrypted; use one-way encryption for sensitive data where practical, etc...
I just use 1P from my Mac so no syncing.
WatchTower has told me many times when a login was compromised.
1P Mac doesn't force you to sync anything or store anything in the cloud.
(I don't)
And, I was only mentioning it as yet another tool to consider.
--
As the T-Shirt Says: "There Is No Cloud. It's Just Someone Else's Computer."
In at least one news story I read, the thieves supposedly got the encryption keys also.
So, isn't the elephant in the room that companies store encryption keys with the encrypted data? To wit, what good does it do if a company encrypts credit card data if the keys to decrypt that data are also there for the taking?
For a large Web service we built in the past, for which security was a very high priority, we designed as much separation into the services as possible. Certain logins, encryptions, decryptions, etc. required a handoff to a segregated service. It adds a performance hit, so the team has to constantly work to keep things tight elsewhere across the system, but adding 300-500ms or so (sometimes a bit more) isn't noticeable to most users if you load pages quickly and give the impression that they're stuff is already delivered. This way, if your system is breached, the miscreants don't get vital parts that must fit together... or at least not as easily.
Most large banks do this type of thing for user login and certain transfer technologies; externalize the authentication and in our case, the encryption/decryption services.
Edited for clarity.
Good points all!
Yes, I do the same thing for my clients as well. When we have SOAP/REST services call other services, we have each service on a separate VM, as one separation idea. Externalizing the encryption/decryption is also something I do via a locked-down service. The point is, which I think is what you're getting at as well, is that with encryption/decryption externalization, the keys aren't "there" to take in the first place. Security 101. Most companies don't do it.
It's a sad commentary on current security methods, but the latest data breaches count (all records) is:
11,566,817,282 records (billions) exposed.
Privacy Rights Clearinghouse | Data Breaches
From these data, a partial listing ordered by most records exposed to least shows (doesn't include latest Marriott hack):
(the list goes on and on...)
---
Thanks for your excellent reply.
Thanks for that clarification.
Good morning, self! ⬇︎
...
...
I love it! "What information was involved: EVERYTHING!" Haha
Did I mention separation???
To Quora's credit, they state they discovered the breach on Friday, and I was notified on Monday (U.S. time, it's Tuesday where I am now). I'm not active on Quora (incomplete profile, etc.), just reading some topics fed to me by email based on interests. Time to change another password.
FWIW, for anyone who is interested, I attached the current (as of yesterday) Privacy Rights database of hacks CSV.
I've done some pre-processing on the CSV I initially downloaded which kept it from importing into MySQL (removing high-order garbage characters, for example).
Once I imported these data into MySQL, I run six different UPDATE statements to put a zero in for blank fields, remove commas in others, etc.
I believe the expected platform for these data is Excel or other spreadsheet so, in my experience, a little work is needed for database import and usage.
So, here's the thing. Love it or loathe it, this is the kind of thing that in UK/EU could end up getting you a really rather large fine....
The sooner the US gets serious about penalties for data loss the better... (IMHO obvs)
Totally agree! Well put, J.
Yup. A lot on Twitter today as well.
In their email and blog post at least the Quora team owned it, seemed pretty transparent, and notified users very quickly. Of course they're experienced in Web issues, unlike many hotel chains or others who are not a tech-specific company working in Silicon Valley/Alley. Of course Yahoo! are right smack in the middle and handled their breach(es) poorly.
In the Minecraft (TechnicPack) breach, they disclose that passwords were salted and hashed using the bcypt algorithm with a cost (work factor, iterations or stretching) of 13. Very strong. 10-15 is considered very strong. Too many skip adding the cost. We use 12-15.
However, they (TechnicPack) also state that the salt was compromised with the database. Quora used a salt unique to each user, but I suspect it was something like a record ID or join date/timestamp. They haven't shared the algorithm used yet that I've seen.
In any of these examples, if part(s) of these elements were stored outside the database, it would be a good step stronger. Even just storing salts and peppers outside on a segregated service has advantages in a database breach.
Good points.
Salting often overcomes reverse engineering via rainbow tables, but "GCM" techniques for symmetric encryption like AES 256 look like a good improvement and I've updated my micro-service AES methods to use it.
I really agree with jrenfrew here: until there is a serious financial cost ($ penalty), companies will continue being lazy and then offering meek Mea culpas ("our bad...").
11 Billion records exposed? Ridiculous.
Agreed. Although there remain discussions (arguments?) over whether 256 key size is actually an improvement over 128 when implementing GCM. There are some particulars to implementing GCM that should be carefully managed so as not to negate the advantages. And, of course, use case is always a factor with encryption. There's hashing (for passwords, yay bcrypt! ), encryption for documents and messaging, etc.; and then trade-offs for performance vs. risk management. It's never cut and dry. Oh, and don't forget the initialization vector for GCM is a 12 byte random byte-array, not 16. I've been reading up on this for a new project lately.
At least the initialization vector is not a "secret", just random.
What language are you using?
We use Java and C/C++. Some cryptanalysis sometimes in Python. Java does very well with document handling; handles services well, fast (all stuff you know very well). This side of things (the pure programming) is not my wheelhouse, but I'm lucky to have a friend and colleague who eats, drinks, and sleeps the programming. I guide the structure and outline the concerns, probable mitigations, some light lifting; he does the heavy lifting in those languages. I'm comfortable in other areas: HTML 5, CSS, JS, PHP, MySQL; some crypto stuff, some python, U/X, etc. I'm a poser, he's the real deal in terms of pure programming.
Cool....Sounds like you have a good team thing going there.
They Operate in Europe they will likely catch it in the neck from every Country. All 28 should by now have adopted there GDPR regulations. Depends on the data loss but they could be looking at millions.
Hi Tom,
From what I have read so far is the breech involved its Starwood Hotels Brand.
How to protect yourself after Marriott's Starwood data breach
https://www.cnbc.com/2018/11/30/passports-compromised-in-the-marriott-breach-could-lead-to-fraud.html
Marriott International announced Friday that hackers had accessed the reservation database for its Starwood Hotels brand, compromising data for 500 million guests.
Mike