MyHeritage Says 92M User Accounts Have Been Compromised | Hacker News Reader

MyHeritage Says 92M User Accounts Have Been Compromised

blog.myheritage.com

63 pointsghgr30 comments

It will be an interesting day when millions of people have their detailed genetic profiles compromised. I'm not entirely sure how much useful data is gathered by these DNA test sites today, but I can easily imagine a future where data from human samples is a prime target for hackers. Perhaps more valuable than login credentials.

Forgot your password? Submit your DNA fingerprint to prove your identity.

Definitely better and definitely scarier than the current "security question" technique.

That's not better. You leave DNA everywhere you go, in the form of skin flakes and hair.

>Definitely better

You can change a security question. You can't change your DNA.

Biometrics are usernames, not passwords.

I thought you could "replace" your DNA with a bone marrow transplant? I am most definitely not a scientist.

You could replace the DNA of your bone marrow that way, and maybe the DNA of any blood cells that happen to be made by that bone marrow, but most of your body will still have the old DNA.

Perhaps they could even clone people against their will. Talk about "identity theft!"

I'm a huge privacy advocate, but honestly, I wouldn't care about this as much as using my genetic material against me (e.g. for job or insurance screening). A person is not their DNA.

I'm surprised that they have so many accounts, but they were good at building partnerships. For instance, a few years ago when 23andme decided they didn't want to deal with users' family trees any longer (a popular feature, considering most people were interested in genetic genealogy data derived from 23andme tests) they pushed people to join MyHeritage (http://blog.kittycooper.com/2015/01/myheritage-is-now-doing-...).

From the "Steps we've taken" it sounds like they haven't forced a password reset on compromised accounts. I can understand from a business perspective that would be a harsh way for affect people to find out they were in the breach but it seems reckless to keep compromised hashes in the system.

They have, got an email from them a week ago or so saying emails and encrypted passwords had leaked and that all passwords are annulled.

They did force a reset, I had to set a new password when I logged in last week.

MyHeritage has a totally scammy auto-renewal system.

Can't say I'm surprised given their crappy anti-user auto-renewal system that they dumped everyone's data. Ugh...

Google "my heritage auto renewal" for the background.

Wonder how many bank accounts are being hacked right now with mother's maiden name as the 'secret' account reset question

I assume no more than usual, as genealogical and DNA information were not leaked.

TL:DR - email addresses and password hashes leaked for users registered until 2017-10-26, affecting 92m accounts.

No password reset, no mention of usage of salts, no mention of hash algorithm used, (edit: originally said no 2FA, but 2FA was added, thanks bbarn), no auditing to confirm that other systems were not leaked ("we have no reason to believe those systems have been compromised"), internal investigation has been fruitless so far (for two and a half weeks).

https://blog.myheritage.com/2018/06/new-myheritage-adds-two-...

Noted and edited, thanks

It's somewhat amusing to hear of people buying dashcams after they've had a crash.

That's all I can think of when I see companies scramble to secure their sites after they've been compromised.

> no mention of usage of salts

They wrote "MyHeritage does not store user passwords, but rather a one-way hash of each password, in which the hash key differs for each customer". I believe "different hash key for each customer" means either nonce or salt.

It's ambiguous, I read it as the hashes being different for each customer out of a mistaken assumption that no two customers have the same password. A salt isn't really a "key" for a hash function, because it isn't going to tell you by itself what the original unhashed value is, and neither will it by itself give you the final hash.

But a salt is a key in the same sense as a MAC key (such as HMAC key).

Forgive my ignorance on the subject but why would there only be usernames and passwords in this file? Is it customary to store other details in separate tables and have different access rights between the 2 tables?

Or did the perpetrators just pull login details as it’s the only useful information?

"Is it customary to store other details in separate tables"

It's quite common to store just what's needed for logins in it's own table.

> Is it customary to store other details in separate tables and have different access rights between the 2 tables?

There's more to that sentence. Outside of enterprise corporations, I've never actually seen an application database user with permissions to the user credentials table but not the rest of the tables in the database related to that application.

Agreed, if the data are from a database table, it's likely that all the tables in the database were exposed. Depends on the method of intrusion, e.g. did they get access to a database backup, access to the live database, access to something a developer carelessly left unprotected in EC2, etc.

Also their statement "We have no reason to believe that any other MyHeritage systems were compromised" is a fancy way of saying "we have no idea what happened" and equivalent in my mind to "We have no reason to believe that any other MyHeritage systems were not compromised.

If my recent projects are anything to go by where they pushed for a microservices architecture, authentication and user information beyond usernames / passwords / permissions are two separate domains, and thus stored in separate systems (and databases).

According to the Security Now podcast the information was/is separate.

"The good news is there are apparently three entirely separate databases. There is the user login account database. There is the financial credit card charging-people-for-the-service database. And also, separate from either of those two, is the genealogy we've-got-your-DNA-that-you-uploaded-to-us database."

https://www.grc.com/sn/sn-667.htm

Wow, MyHeritage putting up numbers!

Who care about CyberSecurity?

Reply on news.ycombinator.com