OVH hack prompts calls for tigher system admin security controls

Web hosting firm confirms European database breach.

The multi-stage cyber attack carried out against web hosting giant OVH has prompted calls for firms to tighten up security access to privileged accounts.

The French firm confirmed this week that an email account belonging to one of its system administrators was breached by hackers, allowing them to gain access to its European customer database.

We were not paranoid enough so now we're switching to a higher level of paranoia.

The hackers also acquired access to the firm's installation server system in Canada.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

In a post on the company's web forum, OVH said the European database contains the names, addresses, telephone numbers and encrypted passwords of its customers, but no credit card information.

The company said it would take a lot of "technical means" for hackers to recover the "salted" passwords, but as a precaution it is encouraging its customers to reset them anyway.

The database breach resulted from the hackers using the system admin's email account to gain access to another employee's internal VPN, which in turn allowed them to take control of the person who handles the firm's internal back office systems.

The hack has prompted an overhaul of OVH's internal security policies, the post confirmed, including the introduction of automatically generated passwords for employees and the creation of a new VPN with highly restricted access.

"Consulting internal emails is now only possible from the office/VPN," the post continued.  "All those who have critical access now have three verification levels: IP source, password, [and a] staff USB security token," it added.

OVH said it has filed a criminal complaint about the incident to the judicial authorities.

Advertisement - Article continues below

"In the coming months the back office will be under PCI-DSS, which will allow us to ensure the incident related to a specific hack on specific individuals will have no impact on our databases," it said.

"In short, we were not paranoid enough so now we're switching to a higher level of paranoia. The aim is to guarantee and protect your data in the case of industrial espionage that would target people working at OVH."

Sol Cates, chief security officer at database encryption vendor Vormetric, said system admins are a common target for hackers because it makes delving deeper into the company's IT infrastructure much easier.

"By taking over the access rights of someone already on the system, hackers are able to easily circumvent the traditional perimeter defences that would have once foiled their efforts, and gain access to the corporate network," Cates explained.

Advertisement
Advertisement - Article continues below

"It's time to limit what impact these accounts have within our walls, to reduce exposure to data, detect activity, while allowing them to continue to perform their expected functions. 

"A layered approach, where data is firewalled' with sophisticated encryption and buffered by security intelligence capable of detecting this type of malicious and anomalous behaviour, is essential," Cates added.

Featured Resources

Digital Risk Report 2020

A global view into the impact of digital transformation on risk and security management

Download now

6 ways your business could suffer if you don’t backup Office 365

Office 365 makes it easy to lose valuable data regularly, unpredictably, unintentionally, and for good

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now

8 digital best practices for IT professionals

Don't leave anything to chance when going digital

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/policy-legislation/data-protection/354814/google-to-shift-uk-user-data-to-the-us-post-brexit
data protection

Google to shift UK user data to the US post-Brexit

20 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

10 Feb 2020