Adobe hacked

Ironheart

In case you've been living under a rock, Adobe announced that nearly 3 million customer accounts have been compromised, including cc numbers. They are recommending changing your passwords and credit cards, as well as offering a free year of credit monitoring.

jonnyapple

My account was affected, which made me thankful I hadn't ever given them my credit card number.

NSXTypeR

This is excellent news, maybe Adobe will reconsider their subscription plan, since they care so much for their customer's personal information!

macsavageg4

And there is the rub with the monthly rent to use software model.

spraynpray

Thanks for the heads-up Ironheart, I've changed my details.

PB_PM

This isn't the first time that this has happened to Adobe. Just another reason to avoid their cloud based services.

[Deleted User]

You better avoid every cloud. Stay VFR (Visual Flight Rules, sorry could not resist).

kenadams

Anybody know who and what's been compromised? Only creativeCloud users or anyone who has done business over their webstores in the past?

PB_PM

Anyone who uses an Adobe signin.

JK1231

The hack went public when security researchers found Adobe source code on a crimeware site. This link will tell you everything that is publicly know about the incident at present:

https://krebsonsecurity.com/2013/10/adobe-to-announce-source-code-customer-data-breach/

BTW, the above source, although not Adobe, is from one of the leading industry researchers, and I can vouch for their integrity and reliability.

JK

haroldp

Their user passwords were taken, which tells me that a one way cipher which has been the 'prudent man' standard for at least the last 15 years was not being used, else they would not know the password. This is an issue for people who use the same password on multiple sites since most use an email address as a user id.

Since I never had a reason to give them a credit card, this particular is not a worry for me.

Even if ones site and firewall are breached, using asymmetric ciphers, user info should be stored encrypted and never be directly readable.

Adobe clearly cannot be trusted to run a cloud business, the point is not that they were breached, but that commonly accepted protocols for managing data even in the event you are breached were not followed.

They may be very good at imaging software but their data management is amateur hour.

Regards ... H

Ade

Their user passwords were taken, which tells me that a one way cipher which has been the 'prudent man' standard for at least the last 15 years was not being used, else they would not know the password.

Actually according to Adobe, the affected user passwords and credit card data were indeed "encrypted", and therefore they are "not aware of any specific increased risk" to users. It seems they are resetting user passwords out of abundance of caution.

We don't have any details on how exactly the passwords and credit card data were encrypted or hashed.

haroldp

Actually according to Adobe, the affected user passwords and credit card data were indeed "encrypted", and therefore they are "not aware of any specific increased risk" to users. It seems they are resetting user passwords out of abundance of caution.

We don't have any details on how exactly the passwords and credit card data were encrypted or hashed.

I was informed by Adobe to change my password at any site where I used the same password as on Adobe.

This hints strongly that they were held 'clear' someplace.

I of course have no specific knowledge as to Adobe's internal processes, nor should I.

Regards ... H

Ade

Again, the stolen passwords (and credit card numbers) were encrypted, according to Adobe:

"Our investigation currently indicates that the attackers accessed Adobe customer IDs and encrypted passwords on our systems. We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders."

http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html

All else is speculation. Adobe could be wrong, the encryption scheme could be weak, etc., etc., but at this moment the only factual data point we have is Adobe's statement that the stolen passwords were encrypted.

Ironheart

Once you have the encrypted password, a dictionary attack would take very little time to "crack" the passwords for people that use dictionary words, names, or variations of these. Even complex passwords of short length (8 characters or less) can be cracked in a matter of hours. This is the reason Adobe is recommending a change.