Technology

59691 readers

1991 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

827

23andMe tells victims it's their fault that their data was breached | TechCrunch (techcrunch.com)

submitted 11 months ago by [email protected] to c/[email protected]

277 comments fedilink hide all child comments

Hope this isn't a repeated submission. Funny how they're trying to deflect blame after they tried to change the EULA post breach.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 4 points 11 months ago (1 children)

From what I'm seeing, the hackers used the weak password accounts to access a larger vulnerability once they were behind the curtain. The company I work for deals with sensitive proprietary data daily and we are keenly aware that individuals should never have an opportunity to access the information if any other user. Things like single-user quarantining of data blocks are a minimum for security. Users log in and live on their own private island floating in a void. On top of that use behavior tracking to detect access patterns that attempt to exit the void and revoke credentials. That is also not even remotely mentioning that you have a single point of access entering thousands of accounts. That on it's own should be throwing enough red flags to pull down the webserver for a few minutes to hours. There is a lot they could have done.

[–] [email protected] 4 points 11 months ago* (last edited 11 months ago)

It wasn't exploiting a vulnerability, they gained access to other peoples data because the site has a deliberate feature to share your data with your relatives if both have allowed that. That's why the term used is "scraped", they copied what the site showed.
When someone logs in to a Facebook account, it's not a vulnerability that they can now see all of the info their friends have set to "friends only", essentially.

Also they used a botnet so the login attempts weren't suspicious enough to do anything about - they weren't brute forcing a single user multiple times, but each trying once with the correct password.