9M Australians affected by Optus data breach
optus.com.au
optus.com.au
There was a court-enforced order requiring them to apply security updates to their production systems. That was in response to a previous breach.
You see, until a judge made them do it… they weren’t patching anything. They would just build systems and walk away. For some software systems they had every major and minor version deployed, like a museum of software history.
They had operating system versions in production that were in my university text books… in the late 1990s.
Their interpretation of the court order was to update only production systems. Non-production on the same network was not to be touched.
And by “update” they meant simply running the system update tool, which does precisely nothing on software that has passed its end-of-extended-support before some of the IT staff on the payroll were born.
They also fired their entire IT staff recently and replaced them with a low-cost Indian outsourcer.
Most of the above is a matter of public record. I wish I could tell you all about things that are still under NDA.
The equivalent of what I was describing in terms of a web experience would be having to use a dialup modem to sign up for an account via Netscape Navigator 4. With a login secured using SSL… version 1.0.
I wish I was exaggerating, but their systems literally date back to that era and have comparable limitations in terms of supported network protocols.
When I left, the mobile division had its customers split between three different systems; GSMIS, Focus and Arbor. The poor customer service reps would have no idea which one any given user was in when the phone rang. The only way to figure it out was to ask the person for their phone number, then type that number into each backend and see which one returned a result.
the 100,000’s of open management ports is pretty lol
Unsurprisingly, you're were absolutely correct.
"An early investigation suggests hackers were able to breach Optus through a test network"
'Human error' emerges as factor in Optus hack affecting millions of Australians https://www.abc.net.au/news/2022-09-23/optus-hack-likely-res...
Umm...no. Most people do NOT publicise that information to the public.
Agreed. Until a CEO goes to jail for something like this, it'll continue to become a "pay the fine and move on" situation.
https://finance.yahoo.com/news/optus-appoints-ex-nsw-premier...
For international readers, Gladys Berejiklian was the Premier of the state of New South Wales, and resigned as Premier once it became public that she and her boyfriend were being investigated by the Independent Commission Against Corruption. Optus is the job she accepted while the corruption investigation continued.
https://au.finance.yahoo.com/news/gladys-berejiklian-resigns...
[1] https://www.legislation.gov.au/Details/F2017L00399 (Section 6.4)
Geez, ID document numbers is such a big thing. Now hackers can basically call most institution and impersonate victims. this is quite huge
Yes it’s pushing the problem somewhere else, but at least I’m not giving copies of my ID to every little shit of a business.
Some more information here (not my preferred source, but oh well): https://www.news.com.au/technology/online/hacking/up-to-9-mi...
It seems around 2.8m have had 'all' data stolen (including ID, address, etc), and around 7m 'just' names, DoB and numbers/e-mail addresses.
Apparently Optus is working on sending personalised details to customers.
What a monumental stuff up.
It is interesting that compared to identity theft announcements from many US corporations they are direct, apologize and state the authorities they are working with. I imagine there's less fear of the legal consequences of not having a tight response as the culture isn't as litigious.
There are significant penalties for not disclosing within this time period, which is why I think we are seeing this reported before Optus has a clearer plan of how to deal with it.
As a customer of Optus and cyber security trained professional, I'm very frustrated, to say the least.
Sounds like the biggest fail was your insurer handing over those details based only on your name and address. How did that work? "Hi, I'm Dave Smith from 101 Easy Street South Sydney, can you tell me my DOB and email please?" Why would the insurer give a customer their own personal details? They are supposed to ask the caller to state those details in order to proceed with account access.
My coworker got hit by massive targeted identity theft which started with their SIM, provided by Optus. The attackers were able to successfully port my coworker’s Optus number and then hacked their Optus email which had everything in it. It took them months to undo the damage, and more trouble was always around the corner usually while they were sleeping or the service being hit didn’t have support staff online. Do Optus even have any security checks at all for preventing fraud?
Lessons: if the service doesn’t support MFA, don’t use it; don’t put all your service eggs in one basket; don’t assume that your phone number is safe, and act accordingly.
Optus needs to pay for this and I don’t just mean dollars. Comfortable people with responsibilities they didn’t failed to keep need to see gaol time, or at the very least lose their jobs and not be allowed to walk back into the revolving door for a long time. This is outrageous.
No, just your identity is. If you're Australian, you or someone you know will be in this. What a total fuck up.
- the notification being finding a link to their quietly released press release on HN this afternoon? Thanks Optus!
- cyberattack is the word to use to encourage speculation that a nation-state was behind the breach, that there was no way to defend against this and to avoid saying "data breach"
- here "customer information" means current and former Optus customers' personal information
The story HAS to be that if you, as an exec in power, know your company has deficient safety protocols regarding its care of toxic material, the breach of which is known to cause serious damage and harms, AND you do nothing: hello personal prosection, reaching right through the corporate veil.
Until we set this kind of legal precedent for the egregious disregard for the integrity of private and personal data, this is just going to keep happening.
The way that is implemented SHOULD be mostly unhackable, with everything server side being encrypted and inaccessible without user action and communication with MCs backend.
Still, this is not a good look for trust. Should we now go to Australian customers and say "and now you authenticate via the Optus app, it's super secure" while they immediately think of this hack?
Well, I tried to complain... for you see after going through multiple pages/steps in the UI, when it came time to review and submit, after you press submit you are told that they can't receive complaints online at this time.
So I wrote in the web feedback form instead. At least that went through. As will, I hope, my screenshots of the process to the ombudsman.
In nearly all these microservice components, the UI has an outdated copyright year in the footer. 2016 in the feedback app, 2017 in a preference update component. The year sits right underneath a lock symbol and some text telling you how secure they are.
This tells me a number of things. Either no one has smoke-tested that component for 6 years, or picked up that the year was off, or it has been picked up and left in backlog because of other priorities leaving me to ask what else could be in the aged backlog, but really telling me they don't have the resources to do or to take software or UX seriously.
You forgot to add case isn't significant. Still, even such small passwords can be secure if managed right. It's been that way for many years, and I don't recall seeing anything about it being broken, so I guess it must be work ok. I doubt the ombudsman would care.
On the other hand, every 10 or 20 logins, after logging in it doesn't display the internet banking home page. Instead it displays the home pages CSS stylesheet. That behaviour has also been there for years. I don't know how you even do that.
Also if they aren’t able to accept other characters, I wonder what happens when you try?
I’ve worked “across” core payments(not banking) systems with the card schemes, westpac, St George etc. So I would say I’ve seen how bad things can get but your bank sounds like something next level.
How do you don't know they aren't hashed? Any what does that mean? Does it mean that are using DIGEST to avoid sending plain text over the https transport, or they aren't using key expansion for storage?
And does it matter? If someone gets into their internal systems leaked plain text passwords will be the least of their problems. Total deposits are $500 billion.
> I wonder what happens when you try?
Most people try, because they don't believe the restrictions. The answer is nothing out of the ordinary, of course. As I said, as far as I know it's never been broken. Which is kinda surprising, because their web site has more bugs than most. But it appears they've got that part right.
By the way, 6 alpha-numeric characters makes for about 1 billion combinations. The odds of guessing in it a few random goes are virtually nil, and then you are locked out and have prove your identify by via a third channel. Providing they police the max tries well, it's pretty secure.
> your bank sounds like something next level.
All the large banks hopeless. They are an absolutely nightmare to deal with on every level. This bank has been prosecuted by the Federal Government for AML violations - but again most of them have been prosecuted for grievous unethical behaviour. That doesn't make them insecure.
The OP is wrong about SMS 2 factor - they do support other methods, and insist on it once certain circumstances. The banks do protect themselves. In Australia, the history has been if they are forced to make up their customers losses. It takes years of investigations, and a lot of suffering in the mean time on the victims part. But the precedent is well established - karma is a real thing here, and the banks behave accordingly.
As for MFA, the only Australian bank that seems to do it right is Macquarie (who let you remove SMS 2FA and replace it with a decent authenticator app). A handful will issue physical tokens on request (eg HSBC).
Macquarie have unpersoned me before (cancelled all of my accounts with no explaination or notice, on a Friday afternoon). I've heard of it happening to others too. As such, I make it my mission whenever dealing with large scale finance in business to refuse to deal with them.
I'm in no way affiliated, but an example is https://www.equifax.com.au/lp/protect-your-identity
AUD$15 per month to tell you if your details are leaked or used to create an account in your name.
Okay so this was half the country.
I cant honestly understand how anyone thinks KYC laws make sense if anyone can make a bank account as anyone else, and it all looks like legitimate money or the human is getting framed while the criminal just rotates IDs.
regarding angles and selfies, most of those just require you to go through the motions not for it to be accurate or withstand [human] scrutiny.
Not even a copy of the document is required, and it doesn't have to be sighted by anyone. From memory, you don't even have to supply the expiry date on the document (and driver's license numbers remain static).
One of the first things I see happening, is criminals using this to obtain burner numbers not traceable to them.
They are required to verify that information.
They shouldn't have been storing that though.
Should only have existed for the period of the verification request on signup - a single form post.
"Importantly, no financial information or passwords have been accessed. The information which has been exposed is your name, date of birth, email, and the number of the ID document you provided such as drivers licence or passport number. No copies of photo IDs have been affected.
It is also important to know that Optus’ network and Optus services including mobile and home Wi-Fi aren’t affected, and no passwords were compromised, so our services remain safe to use and operate as per normal."
Effectively saying, dont change your password. Hackers dont need it.
I hated their mandatory text messages that couldn't be blocked, such as upcoming bill reminders. Spam my email as much as you want, but stay out of my text messages!
No idea how accurate this is just yet though.
They claim to have started notifying people today (Saturday), with customers with most amount of info leaked being prioritised. Supposedly if you've had ID information stolen, you'll know today. Fingers crossed.
I left them 2 years ago but they keep my details in a database accessible to the internet? Why? Details leaked are name, email, phone, DOB, home address, drivers license number.
About 4 years ago I emailed them complaining that their marketing team were using my date of birth to send me "birthday deals" on my birthday. Something I never opted in for. I found it creepy because the only reason they knew my DOB was from a sign-up security verification process. So back then they were sharing security details from customer signups to their marketing team for use in promotional material. No respect or care for user's data.
I wonder if a class action can be brought against Optus.
I'm starting to worry about the general public's understanding of the ramifications of this. When it first broke, I was pretty upset, and my partner (well educated, and with me long enough to understand some things about breaches) thought my concerns and anger at optus was excessive. It's only after I explained to her in some detail a few scenarios of what could happen with the information, that she asked questions about what we should be doing.
I think we'll be seeing fallout from this for years to come.
What could happen?
In my case the home address is old, not my current one, so I dodged a bullet there. That leaves name, DOB and drivers license number. How can those 3 things alone be used?
Email and phone were taken, but nobody can use those if verification is needed. And I can easily change those details in the various places they are used.
I'm quietly confident that because my home address is my old address, and therefore not associated with my drivers license, I'm in better shape than millions of others in this breach.
I'm still angry about it! The email from Optus was tone deaf. They worded it like they are the victims, downplayed the importance, and even ended with "warm regards".
For the other stuff (address, name, DoB)...what are the things nearly everyone asks when you ring to make account changes, to verify you are you..
I'd be careful with the home address too (although you should be ok). I moved around a bit a few years ago, and lost track of where I'd updated my address. It was usually as simple as 'I think my most recent address with you is X, can you please update it to Y', and as long as the other stuff checked out, no questions were asked.
And yeah, I had to laugh about that press release :/
Still no email this side. No news is good news, right?
But most of all, if you’ve worked anywhere even remotely resembling a professional organisation in the last 10 years then it should be obvious just how bad things are inside Optus for this to have even happened. Something is deeply wrong there. This kind of breach should have thousands of things standing in the way of it being possible
That said, Optus knows they don't get in any real trouble for this sort of thing so they can only benefit from appearing to respond rapidly and transparently. (Which is a better PR move than being proactive)
https://www.optus.com.au/about/media-centre/media-releases/2...
> Optus appoints Gladys Berejiklian to its Executive Team in a new role as Managing Director, Enterprise, Business and Institutional
Thsts... amusing.
For comparison, visit https://www.telia.ee/en and you're prompted for your smart card or associated Smart ID (which is mobile app you can bootstrap from your smart card).
No more need to do a 100 point check (and then hold that information indefinitely), it's been done.
Even if you don't like the Estonian system it's high time to get serious about digital identity and stop pretending that knowing your DoB etc (or social security number in US) is a secure mechanism of proving identity.
Aside: Highly recommend Estonia's e-residency program. Great place to run a company. Future focused.
Our laws protecting us from the government are way too weak for systems like this to take off. Also we keep hiring contractors who do a fairly poor job building the things in the first place.
Indeed. Remember when the police got into the contact tracing apps?
Australia could not even design a proper national broadband network.
Haven’t actually received any communication about the breach from them yet either.
Seems like a complete screw up. They couldn’t even notify their customers before everyone found out on the news.
I wouldn’t trust Vodafone to organise a piss up in a brewery… maybe Telstra are better (hah!)
Probably because there is no law saying you need to delete the data in X days.