We’ve, um, changed our password policy, says CafePress amid reports of 23m pwned accounts

Twee T-shirts ‘n’ merch purveyor CafePress had 23 million user records swiped – reportedly back in February – and this morning triggered a mass password reset, calling it a change in internal policy.

Details of the security breach emerged when infosec researcher Troy Hunt’s Have I Been Pwned service – which lists websites known to have been hacked, allowing people to check if their information has been stolen – began firing out emails to affected people in the small hours of this morning.

According to HIBP, a grand total of 23,205,290 CafePress customers’ data was swiped by miscreants, including email addresses, names, phone numbers, and physical addresses.

We have asked CafePress to explain itself and will update this article if the company responds. There was no indication on its UK or US websites at the time of writing to indicate that the firm had acknowledged any breach.

[…]

Musing on the 77 per cent of email addresses from the breach having been seen in previous HIBP reports, Woodward said that factoid “brings me to a problem that isn’t being discussed that much, and which this kind of breach does highlight: the use of email as the user name. It’s clearly meant to make life easier for users, but the trouble is once hackers know an email has been used as a username in one place it is instantly useful for mounting credential-stuffing attacks elsewhere.”

“I wonder,” he told The Register, “if we shouldn’t be using unique usernames and passwords for each site. However, it would mean that it becomes doubly difficult to keep track of your credentials, especially if you’re using different strong passwords for each site, which I hope they are. But all users need do is start using a password manager, which I really wish they would.”

Source: We’ve, um, changed our password policy, says CafePress amid reports of 23m pwned accounts • The Register

You Can’t Trust Companies to Tell the Truth About Data Breaches

Last week, online sneaker-trading platform StockX asked its users to reset their passwords due to “recently completed system updates on the StockX platform.” In actuality, the company suffered a large data breach back in May, and only finally came clean about it when pressed by reporters who had access to some of the leaked data.

In other words, StockX lied. And while it disclosed details on the breach in the end, there’s still no explanation for why it took StockX so long to figure out what happened, nor why the company felt the need to muddy the situation with its suspicious password-reset email last week.

While most companies are fairly responsible about security disclosures, there’s no question that plenty would prefer if information about massive security breaches affecting them never hit the public eye. And even when companies have to disclose the details of a breach, they can get cagey—as we saw with Capital One’s recent problems.

Source: You Can’t Trust Companies to Tell the Truth About Data Breaches

Sadly it’s partially understandable, considering the lawsuit shotguns brought to bear on companies following disclosure.

Having said that, many of the disclosures are the results of really really stupid mistakes, such as storing credentials in plain text and not securing AWS buckets.

Amazon Squeezes Sellers That Offer Better Prices on Walmart

Amazon constantly scans rivals’ prices to see if they’re lower. When it discovers a product is cheaper on, say, Walmart.com, Amazon alerts the company selling the item and then makes the product harder to find and buy on its own marketplace — effectively penalizing the merchant. In many cases, the merchant opts to raise the price on the rival site rather than risk losing sales on Amazon.

Pricing alerts reviewed by Bloomberg show Amazon doesn’t explicitly tell sellers to raise prices on other sites, and the goal may be to push them to lower their prices on Amazon. But in interviews, merchants say they’re so hemmed in by rising costs levied by Amazon and reliant on sales on its marketplace, that they’re more likely to raise their prices elsewhere.

Antitrust experts say the Amazon policy is likely to attract scrutiny from Congress and the Federal Trade Commission, which recently took over jurisdiction of the Seattle-based company. So far, criticism of Amazon’s market power has centered on whether it mines merchants’ sales data to launch competing products and then uses its dominance to make the original product harder to find on its marketplace. Harming consumers by prompting merchants to raise prices on other sites more neatly fits the traditional definition of antitrust behavior in the U.S.

“Monopolization charges are always about business conduct that causes harm in a market,” said Jennifer Rie, an analyst at Bloomberg Intelligence who specializes in antitrust litigation. “It could end up being considered illegal conduct because people who prefer to shop on Walmart end up having to pay a higher price.”

[…]

Online merchants typically sell their products on multiple websites, including Amazon, EBay Inc. and Walmart Inc., which also removes products with “highly uncompetitive” prices compared with those on other sites. But merchants often generate most of their revenue on Amazon, which now accounts for almost 40% of online sales in the U.S., according to EMarketer.

Merchants have long complained that Amazon wields outsize influence over their businesses. Besides paying higher fees, many now have to buy advertising to stand out on the increasingly cluttered site. Some report giving Amazon 40% or more of each transaction, up from 20% a few years ago.

[…]

Amazon began sending the price alerts in 2017, and merchants say they have increased in frequency amid an intensifying price war between Amazon and Walmart. Merchants receive the alerts via a web platform they use to manage their Amazon businesses. The alerts show the product, the price on Amazon and the price found elsewhere on the web. They don’t name the competing site with a lower price; the merchants must find that themselves.

A typical pricing alert reads: “One or more of your offers is currently ineligible for being a featured offer on the product detail page because those items are priced higher on Amazon than at other retailers.”

In plain English, that means merchants lose the prominent “buy now” button that simplifies shopping on Amazon. With that icon missing, shoppers can still buy the products, but it’s a more tedious and unfamiliar process, which can hurt sales

[…]

“Amazon is in control of the price, not the merchant,” said Boyce, who runs Avenue 7 Media.

Molson Hart, who sells toys online through his company Viahart, typifies the challenge. Hart says more than 98% of his $4 million in 2018 sales came from Amazon even though he also sells his products on EBay, Walmart and his own website. He was trying to sell a toy stuffed tiger for $150 on Amazon. Hart designs, manufactures, imports, stores and ships the item to customers; Amazon would get $40 for listing some photographs on its website, handling the payment and charging Hart to advertise the product on the site.

Hart said he could sell the product for about $40 less on his own website, but won’t since that would jeopardize his sales on Amazon due to its pricing enforcement, he said. “If we sell our products for less on channels outside Amazon and Amazon detects this, our products will not appear as prominently in search,” he wrote in a recent article on Medium. Hart has since lowered the price of the tigers on Amazon and is now selling them at a loss.

Amazon used to require that merchants offer their best prices on Amazon as terms for selling on the site, but the agreement attracted the attention of regulators bent on ensuring competition. Amazon removed the requirement for sellers in Europe in 2013 following investigations and quietly removed the requirement without explanation for U.S. sellers in March shortly after Democratic presidential hopeful Senator Elizabeth Warren announced a goal of breaking up Amazon and other big tech companies.

[…]

Michael Kades, a former FTC attorney who now researches antitrust issues at the Washington Center for Equitable Growth, says the price alerts will almost certainly draw the government’s attention. “If regulators can prove that this conduct is causing merchants to raise prices on other platforms,” he said, “Amazon loses the argument that their policies are all about giving everyone lower prices.”

Source: Amazon Squeezes Sellers That Offer Better Prices on Walmart – Bloomberg

As I say in my talk, Break it Up! monopolistic behaviour is a lot more than just pricing – just this sort of anti-competitive pressure on third parties is one of the more maffia style sort

Monzo online bank stored bank card codes in log files as plain text

Trendy online-only Brit bank Monzo is telling hundreds of thousands of its customers to pick a new PIN – after it discovered it was storing their codes as plain-text in log files.

As a result, 480,000 folks, a fifth of the bank’s customers, now have to go to a cash machine, and reset their PINs.

The bank said the numbers, normally tightly secured with extremely limited access, had accidentally been kept in an encrypted-at-rest log file. The content of those logs were, however, accessible to roughly 100 Monzo engineers who normally would not have the clearance nor any need to see customer PINs.

The PINs were logged for punters who had used the “card number reminder” and “cancel a standing order” features.

To hear Monzo tell it, the misconfigured logs, along with the PINs, were discovered on Friday evening. By Saturday morning, the UK bank updated its mobile app so that no new PINs were sent to the log collector. On Monday, the last of the logged data had been deleted.

Source: PIN the blame on us, says Monzo in mondo security blunder: Bank card codes stored in log files as plain text • The Register

It’s 2019 – and you can completely pwn a Qualcomm-powered Android over the air

It is possible to thoroughly hijack a nearby vulnerable Qualcomm-based Android phone, tablet, or similar gadget, via Wi-Fi, we learned on Monday. This likely affects millions of Android devices.

Specifically, the following two security holes, dubbed Qualpwn and found by Tencent’s Blade Team, can be leveraged one after the other to potentially take over a handheld:

CVE-2019-10540 […] could be exploited by nearby miscreants over the air to silently squirt spyware into your phone to snoop on its wireless communications.

CVE-2019-10538: This vulnerability can be exploited by malicious code running within the Wi-Fi controller to overwrite parts of the Linux kernel running the device’s main Android operating system, paving the way for a full device compromise.

Source: It’s 2019 – and you can completely pwn a Qualcomm-powered Android over the air • The Register