Categories: SecurityWorkspace

Password Reuse Risk After LivingSocial Breach

The LivingSocial database breach that potentially leaked the user names and passwords of more than 70 million users could seriously impact the subscribers, if they reused their passwords on other sites.

This is the stark warning from security experts this week.

Password Vulnerability

On 27 April, the deal-finding service alerted its users that criminals had breached the company’s security and taken some customers’ user names and passwords, as well as names, email addresses and dates of birth for some users. The passwords were stored as hashed values, although using SHA-1, a weaker hashing algorithm. This raises the possibility that some passwords could be deciphered.

LivingSocial forced every user to change their password, but previous data breaches have shown that a majority of people reuse passwords across sites, threatening their accounts on other Web services and even their employer’s network.

“For enterprises, it’s important to consider the possibility that some of your employees may have used the same password on LivingSocial that they use to access their work email and VPN accounts,” Tom Cross, director of security research at network-protection provider Lancope said in a statement sent to eWEEK.

“IT security teams should be proactively hunting for weak passwords in their networks, and they should assess the capabilities that they have for identifying compromised accounts,” Cross’ statement said.

Weak passwords and the reuse of user credentials across sites have been identified as the most serious issues for customers following breaches. In June 2012, social-networking site LinkedIn notified its users that online thieves had stolen more than 6 million passwords, raising the possibility that decrypted passwords could be used against corporate systems.

In July, an analysis of a password file containing approximately 500,000 Yahoo Voices accounts found that 59 percent of subscribers who had accounts on another compromised service had reused their passwords.

In many cases, the strength of passwords becomes irrelevant because some firms have failed to encrypt their password file, a security misstep that allows attackers to have ready access to the entire password database.

Urgent Changes

“If you use LivingSocial it’s critical that you change your password immediately,” Ross Barrett, senior manager of security engineering for vulnerability management firm Rapid7, said in a statement sent to eWEEK. “And if you, like many people do, use the same password for other online accounts, change those ASAP. Once the passwords are uncovered, hackers will turn to popular sites like Facebook, LinkedIn, Gmail and so on.”

The costs of breaches can quickly build up, not just for companies, but for customers. In an analysis of the 2012 Utah Department of Health breach, analyst firm Javelin Strategy & Research found that the loss of 780,000 user records – including about 280,000 Social Security numbers – would likely add up to more than $400 million (£257m) in fraud and another $100 million (£64m) in costs. The state agency, however, will likely pay less than $10 million (£6m), unless additional fines are levied.

In the LivingSocial breach, the online thieves apparently did not get access to users’ credit-card numbers or transactions, the company stated. “We are working with internal and external forensic security teams to investigate the nature of the incident and to further improve our security systems, and we are working with law enforcement to investigate this incident,” the company said in an online statement.

How well do you know data security? Take our quiz!

Originally published on eWeek.

Robert Lemos

Robert Lemos covers cyber security for TechWeekEurope and eWeek

Recent Posts

TikTok ‘Halts E-Commerce Expansion Plans’

TikTok reportedly scraps plans to expand TikTok Shop livestream commerce in Europe and US after…

7 hours ago

European Parliament Passes Landmark Tech Regulations

European Parliament votes to adopt Digital Markets Act and Digital Services Act, but campaigners warn…

8 hours ago

Indian Economic Police Raid Offices Of Smartphone Maker Vivo

Indian economic crime agency Enforcement Directorate raids dozens of locations across India belonging to China's…

10 hours ago

French Music Service Deezer Slumps On Market Debut

Spotify and Apple Music competitor Deezer falls below opening price after long-delayed IPO in Paris…

10 hours ago

Foxconn Expects Stronger Sales In Spite Of Economic Gloom

iPhone manufacturer Foxconn revises full-year expectations upward amidst strong consumer and data centre demand, bucking…

11 hours ago

Samsung ‘To See Profits Jump’ On Data Centre Demand

Industry analysts expect Samsung's profits to jump 15 percent for the second quarter as strong…

12 hours ago