In-depth

Going, going, gone: What the eBay data breach means for the firm's security reputation

eBay's handling of its recent data breach leaves a lot to be desired, says Davey Winder

eBay sign

OPINION: If ever some advice of mine was both timely and much needed, then a piece of mine for IT Pro from 13 May entitled 'Why enterprises need a data breach response plan' has to be it.

The conclusion to that piece would certainly have provided eBay HQ with some food for thought, particularly in light of recent events.

It stated: "A proper response plan enables the enterprise to mitigate the breach, to minimise the damage done and reduce the potential reward to the bad guys. It may not be a win-win, but it's as close as you are realistically going to get." Sadly, eBay never came close; not by a country mile.

The breach itself appears to have gone undetected for two months, which is unacceptable for any enterprise, but when the business is as big as eBay it's unforgivable.

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

To make matters worse, it then took eBay a further two weeks from being made aware of the breach to disclose details about it. This is not uncommon, and as a rule of thumb the excuse for the delay will be so as 'not to hamper any investigation'.

This is all bad enough, but once that disclosure was made it was done through a blog post and media interviews. Users were not notified by email, and there were no messages even within the internal mailing system warning customers to change their passwords.

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

As my own investigation uncovered, the only mention of the breach on eBay, and the only advice to reset passwords, was to be found on the change password screen itself.

This is where users end up if they are already in the process of changing the password for whatever reason, which strikes me as particularly bizarre.

Then, when users did try and change their passwords, the system fell over. Aha, you may say, that's why they didn't warn folks, because eBay knew the servers would go down under the strain.

My response to that? eBay can afford to get extra resources in place, and in double-quick time, to ensure no such thing happened.

My attempt to change my password was met with a message telling me I'd succeeded, but then it wouldn't allow me to use it afterwards and told me I should go knit a jumper instead.

Well, maybe not in those exact words. It took a number of days before my password was successfully changed and my account was secured once more.

If eBay had any kind of half-decent breach response plan in place, and if it really cared about customer security (rather than the immediate bottom line), then it would have just reset every single password.

That would protect the accounts at risk and force all users to change when they next logged in.

 It also wouldn't hurt if, like so many other giants of the internet world, eBay had some form of two-factor authentication in place, but it hasn't. At least not in the UK, as far as I can tell.

And finally, as I must stop ranting or my head is going to blow, there's the small matter of the really poor 'strength meter' you get when changing your password. This is as broke as your average homeless guy.

Whoever was employed at eBay to manage security response quite obviously failed to manage anything other than striking a hammer blow to the company's reputation.

Stick a 20 random character string in there, comprising of four upper, four lower, four symbols, four numbers and two of anything you like, and you might think that would get a strong rating. But no, it's only medium, apparently.

On what planet? Oh, the same planet where a seven character string with one uppercase letter shows as being more secure than a 12 string combination of nine random lowercase letters and three random numbers, I guess.

eBay Australia even gave advice that a good and secure password might be $uperman1963 or bestjetpilot. Jeez! Ignore those strength meters, they are almost all as good as useless. Which is a coincidence, because so is the eBay breach response management team.

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

8 of the most secure web browsers
web browser

8 of the most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020