In-depth

Going, going, gone: What the eBay data breach means for the firm's security reputation

eBay's handling of its recent data breach leaves a lot to be desired, says Davey Winder

eBay sign

OPINION: If ever some advice of mine was both timely and much needed, then a piece of mine for IT Pro from 13 May entitled 'Why enterprises need a data breach response plan' has to be it.

The conclusion to that piece would certainly have provided eBay HQ with some food for thought, particularly in light of recent events.

It stated: "A proper response plan enables the enterprise to mitigate the breach, to minimise the damage done and reduce the potential reward to the bad guys. It may not be a win-win, but it's as close as you are realistically going to get." Sadly, eBay never came close; not by a country mile.

The breach itself appears to have gone undetected for two months, which is unacceptable for any enterprise, but when the business is as big as eBay it's unforgivable.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

To make matters worse, it then took eBay a further two weeks from being made aware of the breach to disclose details about it. This is not uncommon, and as a rule of thumb the excuse for the delay will be so as 'not to hamper any investigation'.

This is all bad enough, but once that disclosure was made it was done through a blog post and media interviews. Users were not notified by email, and there were no messages even within the internal mailing system warning customers to change their passwords.

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

As my own investigation uncovered, the only mention of the breach on eBay, and the only advice to reset passwords, was to be found on the change password screen itself.

This is where users end up if they are already in the process of changing the password for whatever reason, which strikes me as particularly bizarre.

Advertisement - Article continues below

Then, when users did try and change their passwords, the system fell over. Aha, you may say, that's why they didn't warn folks, because eBay knew the servers would go down under the strain.

My response to that? eBay can afford to get extra resources in place, and in double-quick time, to ensure no such thing happened.

My attempt to change my password was met with a message telling me I'd succeeded, but then it wouldn't allow me to use it afterwards and told me I should go knit a jumper instead.

Well, maybe not in those exact words. It took a number of days before my password was successfully changed and my account was secured once more.

Advertisement
Advertisement - Article continues below

If eBay had any kind of half-decent breach response plan in place, and if it really cared about customer security (rather than the immediate bottom line), then it would have just reset every single password.

That would protect the accounts at risk and force all users to change when they next logged in.

Advertisement - Article continues below

 It also wouldn't hurt if, like so many other giants of the internet world, eBay had some form of two-factor authentication in place, but it hasn't. At least not in the UK, as far as I can tell.

And finally, as I must stop ranting or my head is going to blow, there's the small matter of the really poor 'strength meter' you get when changing your password. This is as broke as your average homeless guy.

Whoever was employed at eBay to manage security response quite obviously failed to manage anything other than striking a hammer blow to the company's reputation.

Stick a 20 random character string in there, comprising of four upper, four lower, four symbols, four numbers and two of anything you like, and you might think that would get a strong rating. But no, it's only medium, apparently.

On what planet? Oh, the same planet where a seven character string with one uppercase letter shows as being more secure than a 12 string combination of nine random lowercase letters and three random numbers, I guess.

eBay Australia even gave advice that a good and secure password might be $uperman1963 or bestjetpilot. Jeez! Ignore those strength meters, they are almost all as good as useless. Which is a coincidence, because so is the eBay breach response management team.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/operating-systems/microsoft-windows/354526/memes-and-viking-funerals-the-internet-reacts-to-the
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020