Hacker News Reader

Comment by sersi | Hacker News Reader

> The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain access to almost half of the company's user base, or about 7 million accounts

I mean for the 14,000 accounts accessed with compromised login credentials, yes that's logical that it's their fault.

But what kind of feature would allow attackers to then get access to 7 million accounts from 14,000 compromised accounts? The article doesn't say and I can't imagine any feature that would allow that without being an egregious breach of security.

View on HN

When you are able to log in, you then see who are related to you as well. I believe the news sites use those inflated numbers to make it more dramatic.

> use those inflated numbers to make it [clear how serious it actually was].

They already release the 7 million people's data - to the same extent the hackers got it - to anyone who manages to upload a sufficiently similar genome. There's no additional data privacy concern in releasing it to hackers or Equifax or the FBI or 4chan or the Washington Post. 23andMe limit access to it for commercial reasons, not privacy ones.

But you only have one genome, so you will only ever see a very small subset of that 7 million (I’m assuming that’s how it works, I’ve never used the service). Now you have access to 7 million records at the same time, which is much more powerful in terms of what you can do with that data.

More powerful, but mostly you can do good things, like genealogical research, not bad things, like identity fraud or credit card theft (which you could do if you compromised the 7 million accounts individually).

It's better for the world that that kind of aggregate data is public where anyone can use it, rather than exploited by 23andMe or sold only through data brokers.

Ah, but then it's not like you get all of the data, just the names that are often fake anyway no? I mean I don't know anyone who used 23 and me under their real name.

>Ah, but then it's not like you get all of the data, just the names that are often fake anyway no?

I would bet that an overwhelming majority of 23 and me users do so under their real names.

I would bet that an overwhelming majority of HN users who use 23 and me do not do so under their real names.

You might be right but even my non-technical 50 years old friend who decided to use 23 and me with her sister to see if they shared the same father, did it with a fake name.

> But what kind of feature would allow attackers to then get access to 7 million accounts from 14,000 compromised accounts?

I've never used 23andme myself, but as I understand it they have a 'relative finder' which finds people with similar DNA https://customercare.23andme.com/hc/en-us/articles/221689668... - it even offers some features that purport to show which segments of your genes overlap.

They also provide a predicted-and-editable-and-shareable family tree feature https://customercare.23andme.com/hc/en-us/articles/360036068...

At one point, I believe users were opted into this by default (a review from 2008 says this was the case) although at present I believe they require an explicit opt-in. But of course you can't find your relatives without opting in.

And users might well have thought they were sharing their data only with a handful of relatives, whose identities had been confirmed by DNA testing.

>I mean for the 14,000 accounts accessed with compromised login credentials, yes that's logical that it's their fault.

The provider has a responsibility here as well - after all, a breach like this followed by the negative public fallout (and potential lawsuits) represents a risk to the business itself. There are things they could have done to mitigate this risk ... Like enforcing 2FA.

And they did mess up, and they know they messed up. Do you know how I know? Because they just started enforcing 2FA (and not in 2019) [1]

[1]https://blog.23andme.com/articles/enhanced-customer-security...

That is a huge amount of data you can get at. You do not even have to be a 'nefarious hacker'. Just open a legit account sub your DNA and you have access to a lot of data. The way this company has framed the narrative around this interesting as 'those terrible hackers did this to you users'. Isnt the math something like go back 7 generations and everyone is related to everyone.

Reply on news.ycombinator.com