Going, going, gone: What the eBay data breach means for the firm's security reputation

eBay's handling of its recent data breach leaves a lot to be desired, says Davey Winder

eBay sign

OPINION: If ever some advice of mine was both timely and much needed, then a piece of mine for IT Pro from 13 May entitled 'Why enterprises need a data breach response plan' has to be it.

The conclusion to that piece would certainly have provided eBay HQ with some food for thought, particularly in light of recent events.

It stated: "A proper response plan enables the enterprise to mitigate the breach, to minimise the damage done and reduce the potential reward to the bad guys. It may not be a win-win, but it's as close as you are realistically going to get." Sadly, eBay never came close; not by a country mile.

The breach itself appears to have gone undetected for two months, which is unacceptable for any enterprise, but when the business is as big as eBay it's unforgivable.

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

To make matters worse, it then took eBay a further two weeks from being made aware of the breach to disclose details about it. This is not uncommon, and as a rule of thumb the excuse for the delay will be so as 'not to hamper any investigation'.

This is all bad enough, but once that disclosure was made it was done through a blog post and media interviews. Users were not notified by email, and there were no messages even within the internal mailing system warning customers to change their passwords.

Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.

As my own investigation uncovered, the only mention of the breach on eBay, and the only advice to reset passwords, was to be found on the change password screen itself.

This is where users end up if they are already in the process of changing the password for whatever reason, which strikes me as particularly bizarre.

Then, when users did try and change their passwords, the system fell over. Aha, you may say, that's why they didn't warn folks, because eBay knew the servers would go down under the strain.

My response to that? eBay can afford to get extra resources in place, and in double-quick time, to ensure no such thing happened.

My attempt to change my password was met with a message telling me I'd succeeded, but then it wouldn't allow me to use it afterwards and told me I should go knit a jumper instead.

Well, maybe not in those exact words. It took a number of days before my password was successfully changed and my account was secured once more.

If eBay had any kind of half-decent breach response plan in place, and if it really cared about customer security (rather than the immediate bottom line), then it would have just reset every single password.

That would protect the accounts at risk and force all users to change when they next logged in.

 It also wouldn't hurt if, like so many other giants of the internet world, eBay had some form of two-factor authentication in place, but it hasn't. At least not in the UK, as far as I can tell.

And finally, as I must stop ranting or my head is going to blow, there's the small matter of the really poor 'strength meter' you get when changing your password. This is as broke as your average homeless guy.

Whoever was employed at eBay to manage security response quite obviously failed to manage anything other than striking a hammer blow to the company's reputation.

Stick a 20 random character string in there, comprising of four upper, four lower, four symbols, four numbers and two of anything you like, and you might think that would get a strong rating. But no, it's only medium, apparently.

On what planet? Oh, the same planet where a seven character string with one uppercase letter shows as being more secure than a 12 string combination of nine random lowercase letters and three random numbers, I guess.

eBay Australia even gave advice that a good and secure password might be $uperman1963 or bestjetpilot. Jeez! Ignore those strength meters, they are almost all as good as useless. Which is a coincidence, because so is the eBay breach response management team.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Most Popular

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021