Going, going, gone: What the eBay data breach means for the firm's security reputation

eBay's handling of its recent data breach leaves a lot to be desired, says Davey Winder

eBay sign

OPINION: If ever some advice of mine was both timely and much needed, then a piece of mine for IT Pro from 13 May entitled 'Why enterprises need a data breach response plan' has to be it.

The conclusion to that piece would certainly have provided eBay HQ with some food for thought, particularly in light of recent events.

Advertisement - Article continues below

It stated: "A proper response plan enables the enterprise to mitigate the breach, to minimise the damage done and reduce the potential reward to the bad guys. It may not be a win-win, but it's as close as you are realistically going to get." Sadly, eBay never came close; not by a country mile.

The breach itself appears to have gone undetected for two months, which is unacceptable for any enterprise, but when the business is as big as eBay it's unforgivable.

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

To make matters worse, it then took eBay a further two weeks from being made aware of the breach to disclose details about it. This is not uncommon, and as a rule of thumb the excuse for the delay will be so as 'not to hamper any investigation'.

Advertisement - Article continues below

This is all bad enough, but once that disclosure was made it was done through a blog post and media interviews. Users were not notified by email, and there were no messages even within the internal mailing system warning customers to change their passwords.

Advertisement - Article continues below

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

As my own investigation uncovered, the only mention of the breach on eBay, and the only advice to reset passwords, was to be found on the change password screen itself.

This is where users end up if they are already in the process of changing the password for whatever reason, which strikes me as particularly bizarre.

Then, when users did try and change their passwords, the system fell over. Aha, you may say, that's why they didn't warn folks, because eBay knew the servers would go down under the strain.

My response to that? eBay can afford to get extra resources in place, and in double-quick time, to ensure no such thing happened.

My attempt to change my password was met with a message telling me I'd succeeded, but then it wouldn't allow me to use it afterwards and told me I should go knit a jumper instead.

Advertisement - Article continues below

Well, maybe not in those exact words. It took a number of days before my password was successfully changed and my account was secured once more.

If eBay had any kind of half-decent breach response plan in place, and if it really cared about customer security (rather than the immediate bottom line), then it would have just reset every single password.

That would protect the accounts at risk and force all users to change when they next logged in.

 It also wouldn't hurt if, like so many other giants of the internet world, eBay had some form of two-factor authentication in place, but it hasn't. At least not in the UK, as far as I can tell.

And finally, as I must stop ranting or my head is going to blow, there's the small matter of the really poor 'strength meter' you get when changing your password. This is as broke as your average homeless guy.

Advertisement - Article continues below

Whoever was employed at eBay to manage security response quite obviously failed to manage anything other than striking a hammer blow to the company's reputation.

Stick a 20 random character string in there, comprising of four upper, four lower, four symbols, four numbers and two of anything you like, and you might think that would get a strong rating. But no, it's only medium, apparently.

On what planet? Oh, the same planet where a seven character string with one uppercase letter shows as being more secure than a 12 string combination of nine random lowercase letters and three random numbers, I guess.

eBay Australia even gave advice that a good and secure password might be $uperman1963 or bestjetpilot. Jeez! Ignore those strength meters, they are almost all as good as useless. Which is a coincidence, because so is the eBay breach response management team.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now



University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

The road to recovery

30 Jun 2020