TalkTalk cyber-attack: Website hit by 'significant' breach | Hacker News Reader

TalkTalk cyber-attack: Website hit by 'significant' breach

bbc.co.uk

41 pointssjclemmy24 comments

First, the level of technical incompetence is staggering:

* Two significant breaches in 7 months * Bank/CC and personal details stored unencrypted * Pssswords stored in cleartext * "We have taken all necessary measures to secure the website." That's what they said last time.

Second, the response is laughable:

* Two days since the breach was discovered, and customers still haven't been notified. * No mention of the breach on the talktalk.co.uk home page. * The site in question [1] says it is offline due to an attack, but doesn't like to the relevant help page [2]

[1] https://myaccount.talktalk.co.uk/ [2] http://help2.talktalk.co.uk/oct22incident

The number of sites that have flaws like you mentioned (encrypted data and clear text passwords) is worrying.

Is there not a independent third part that can audit sites for this kind of incompetence and rank or award compliant sites so consumers can factor this in when choosing services?

There's this site which acts as a 'wall of shame' for blatant violations of storing passwords in plaintext - http://plaintextoffenders.com/

Not sure if it's actually effective at getting things done but certainly is a nice reminder for the consumer to be careful.

Yes, PCI QSAs. All they can do, and all the ICO can do, is fine you. A typical fine might be £10k-£100k. For these large businesses, they see it as being more cost effective to be cavalier about security and pay off the authorities. See amazon's credit card handling, for instance.

Like most things in life, it's a two tier system.

>> We have taken all necessary measures to secure the website

It is probably wrong to read too much into the wording. But it is jarring when a company of this size presents their website as if it is external to the rest of their operations.

Yes, it sounds hilarious to me, but I think it says more about the technical knowledge of the population they are trying to communicate with than TalkTalk's own technical knowledge.

This work doesn't provide a direct audit for websites but it does measure software security at organizations.

https://www.bsimm.com

"Password stored in cleartext" - wait, what?! Where have you seen a reference to that?

From the help page:

"TalkTalk will also NEVER

Send you emails asking you to provide your full password. We will only ever ask for two digits from it to protect your security."

AFAIK, you can't verify two randomly selected characters to a hashed password. My bank is also guilty of this.

Edit: direct evidence from TalkTalk: https://twitter.com/TalkTalkCare/status/514417284560191488?r...

You can achieve this by hashing all the possible combinations that you could ask for with a salt and store those.

Paul Moore's findings from one year ago: https://paul.reviews/value-security-avoid-talktalk/

Someone on the radio just said it was an SQL injection. Can it get any more comical?

Meanwhile TalkTalk & Met Police PR machines are in full flow talking up exotic claims of cyberjihadiism to deflect responsibility.

They have now, apparently, received a ransom demand: https://news.ycombinator.com/item?id=10438175

I added a link in that thread, but I'll post it here also as this is currently front-page and may be of use to readers:

Pastebin message reported to be from the hackers [1] contains Islamic State references/language and some samples of the data breach.

[1] http://pastebin.com/HHT4BxJA

"TalkTalk's speedy decision to warn all of its customers that their vital data is at risk suggests that this one is very serious indeed."

Not all its customers obviously. I left Talktalk a month ago as a customer but I could still login to my account online to download and settle my final bills. I'm pretty sure they still store my bank account and credit card info on their end and they didn't warn me about the attack...

Some current customers I know also haven't been told. Emailing millions of people at once takes some amount of planning/notification/staggering or I'm told you can fall foul of anti-spam measures.

LastPass faced similar notification delay issues when they recently suffered a breach.

Companies as large as TalkTalk should have a process in place for contacting their customers in exactly these kind of situations. They shouldn't be waiting until an event occurs and then going, "oh right, er, how do we tell everyone?"

... but you know, that's expensive. Shareholders don't care about money being wasted on security and precautions. After all, you only really need to wear seatbelts if you crash.

Also, as a customer on my parents behalf, I've not received any communications either.

Yep indeed, a coworker told me he wasn't contacted either even though he's still a customer. Calling 4 millions of customers isn't an option either

Yes - I am a customer and they haven't contacted me.

My Dad is a customer too, he's not been notified either.

Do CEOs/directors of companies get hit but these data breaches, do we need to start insisting their personal/banking data is stored the same as customers so they get impacted? Too many companies just don't take security seriously enough.

"I'm a customer myself of Talk Talk, I've been a victim of this attack."

- TalkTalk chief executive Dido Harding

I was briefly a customer about 4 years ago - I wonder if my details are in the cache.

Reply on news.ycombinator.com