Marriott hack hits 500M Starwood guests

https://www.bbc.co.uk/news/technology-46401890

by tooba • 8 years ago

408 293 8 years ago

bbc.co.uk

ourcat• 8 years ago

Note: This has affected Marriott's "Starwood" division.

Starwood's hotel brands include W Hotels, Sheraton, Le Méridien and Four Points by Sheraton. Marriott-branded hotels use a separate reservation system on a different network.

pgrote• 8 years ago

Odd. It looks like the intrusion could be the cause of the hurried merge.

https://www.wsj.com/articles/inside-the-marriott-starwood-lo...

According to the article the systems were merged 3 months ago.

"The company resolved one major issue involving elite-night credits earned from credit card spending just last week, more than three months after the integration. That problem left many members in limbo, unsure of how close they were to hitting elite-level thresholds before year’s end."

The intrusion was detected on Starwood's system in September according to the BBC article.

"On September 8, 2018, Marriott received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database. Marriott quickly engaged leading security experts to help determine what occurred. Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014. Marriott recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it. On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database."

sailfast• 8 years ago

This sounds more like Marriott having better monitoring and once the DBs got merged they figured out somebody had been in the Starwood network for four years.

bpp• 8 years ago

Assuming poor security practices is the new assumption of monetary debt from a merger. One wonders what it will take to get companies to take auditing potential acquisitions' security practices in greater depth.

Aloha2• 8 years ago

Merged isnt the right word - everyone was migrated to the legacy Marriott System.

tyingq3• 8 years ago

Starwood's reservation system is something called "Valhalla". There's some background info here: https://www.hospitalitynet.org/opinion/4078764.html and here: https://www.infoworld.com/article/2673726/operating-systems/...

trollied• 8 years ago

"It said some records also included encrypted payment card information, but it could not rule out the possibility that the encryption keys had also been stolen."

Oh dear.

nerdponx• 8 years ago

Is payment information not typically salted & hashed like a password?

londons_explore3• 8 years ago

Imagine you could make payments with a salted and hashed credit card number.

Except that doesn't really make anything better, because now an attacker could simply use that salted and hashed credit card number elsewhere to make payments too!

The real solution is to use something like OAuth for payments. You authorize a merchant to take ongoing payments from you, and the card issuer gives the merchant a token which is only useful for making payments from you to them, and can't be used to make payments to anyone else.

spydum• 8 years ago

Not if you need to reverse it to actually send to payment card processor.

raesene98• 8 years ago

Whilst you can't hash it like a password as you need to be able to transfer it onwards, modern systems make tokenisation possible, where you immediately pass the details to the card processor, don't store them at all, and get back a token that can be used for that transaction.

https://squareup.com/gb/townsquare/what-does-tokenization-ac...

flavor8• 8 years ago

~"We encrypt sensitive data at rest. And we store decryption keys on our user facing app servers so that apps can decrypt the data. Cool, right?"

londons_explore3• 8 years ago

Lets be honest, all reversible encryption schemes are some version of this...

no1youknowz• 8 years ago

Can anyone recommend solutions (for those that don't know). On how to have an encrypted database for sensitive information, i.e first name, last name, ip, geo data, etc and the encryption keys not be available to hackers when they have essentially gained root?

hiccuphippo• 8 years ago

Maybe keep the keys only in memory in each application? Pull them from some very well monitored service once at startup? Anyone who gained access to the server would have to check the program's memory to get them.

raesene98• 8 years ago

Depends on the use case :)

If you don't need to decrypt the data on the same system, you could always use asymmetric encrpytion, so encrypt with the "public" key and then keep the private key elsewhere.

If you require to be able to decrypt on the system in question then you need a key somewhere, so secure storage of the key is very important.

One option, often deployed in banks, is to store the key in a hardware security module (HSM) and then ensure that it's not available outside of that.

There's a load of tradeoffs to using HSMs but they can be useful where symmetric encrpytion is needed.

jen20• 8 years ago

I’m not sure there is a one-size-fits-all right solution here - but having a system where decryption keys should not be extractable by software alone (e.g. an HSM, a service such as AWS KMS or the equivalents in other clouds) sounds like it would have been an improvement in this case (though with no post-mortem it’s hard to know exactly what went wrong).

Assuming a layered system, something like Vault transit encryption (perhaps with the master key in an HSM) should keep decryption keys away from front-end machines, though as ever, once you have root and can access the memory of a machine where the encryption keys are stored, most bets are off.

bkanber3• 8 years ago

Well, it's still tough. The question is always "gained root to what", cause at some point somebody needs a key.

Envelope encryption is a good scheme. Under envelope encryption you have a master key and per-row or per-unit keys. You store the per-unit keys encrypted with the master key, and the master key is stored offsite.

For example on an AWS environment, you would use AWS KMS with IAM authentication to handle the master key crypt for the individual keys, and the encrypted versions of the individual keys are stored in a database that you own.

You encrypt your data with the individual keys (eg, one key per user, or one key per DB row, or one key per namespace, whatever), but the individual keys are decryptable only by KMS.

Under this scheme an attacker must both be able to get ahold of the encrypted individual keys, and be able to decrypt them with the master key.

Of course this leaves you very vulnerable if the master key is acquired, but KMS does not allow you to read the master key at all, you have to use the AWS API to make encryption/decryption requests. So the vulnerability is less about how secure the key is and more about how secure your IAM setup and instances are.

slv772• 8 years ago

This was solve by banks a long time ago with hardware security modules (https://en.m.wikipedia.org/wiki/Hardware_security_module). HSMs make it impossible to extract encryption keys from the device and turn a digital security problem into a physical security problem which banks knew how to manage. Are your encryption keys secure? Yes they are right there.

Amazon and Azure offer these in the cloud.

jaxtellerSoA• 8 years ago

hackers when they have essentially gained root?

You are already fucked at this point. I would focus my attention on prevent hackers from 1) gaining any unauthorized access. 2) from doing any sort of privilege escalation from a restricted account/service.

CGamesPlay• 8 years ago

Have a server responsible solely for decryption and audit access to it. The server doesn’t issue keys, it literally does the decryption. AWS KMS can do this for you.

The gist is you create an encryption key for your row, encrypt it using your encryption service, and store it next to your actual payload. To decrypt, ask the service to decrypt the key which you use to decrypt the payload. If your database gets popped, your decryption server hopefully didnt because you hardened it specifically.

cabaalis• 8 years ago

It's been several years since I dealt with PCI, but the app I was on the team for handled $1B+ annually. Here's just a few points that I remember.

Physically separate the key storage from the data storage. Different servers, different user auth mechanism. Make them compromise both systems.

Unique keys per client.

Use key-encrypting keys, periodically replace them.

PCI environment must be totally self contained and not mixed with standard working environment. If an employee is phished, their credentials for email/etc should not gain access to the env.

Don't allow developers to deploy or even read from prod db. Have a separate deployment team, all access to prod database audited via production tickets.

davidgh• 8 years ago

Segmentation can help. For example, you can use envelope encryption[1] that keeps your keys on an isolated, dedicated key management server that prevents even the admin from exporting the master keys. Therefore, decryption of the data keys must be performed on the key management server.

It’s still not perfect because an attacker can potentially send requests to the key management server, but they shouldn’t be able to walk away with they keys to perform decryption outside of the system.

You then set up monitoring to watch how many decryption operations are being performed per minute or hour and alert admins when it steps outside of normal useage patterns.

It’s not perfect but can help you to 1) catch an attacker early and 2) have some type of estimate of the size of the breach when discovered. A very patient attacker may not trigger an alarm of decryption operations but in that case he’s got to work much slower, which limits the scope of the attack while they hopefully trigger something else that exposes them.

1: https://devender.me/2016/07/13/envelope-encryption/

sofaofthedamned• 8 years ago

One tool is to only get access to this data from the Web FE via an API. This API is then monitored for spikes in usage, so if a given FE is suddenly requesting a lot more than normal it gets flagged. It doesn't stop targeted attacks, but does show the big ones - another reason why security needs to be multi layered.

guitarbill3• 8 years ago

Something not widely used are canary tokens: https://blog.thinkst.com/p/canarytokensorg-quick-free-detect...

The general idea is to insert some kind of bogus information into a system, with no links to other systems, and then trigger a notification if someone accesses it.

sbov2• 8 years ago

Keep in mind they've been compromised for 4 years. For that time duration it's not just about protecting data at rest, it's also about protecting data as it is processed inside your systems.

tyingq3• 8 years ago

Curious if it matters much that the keys were stolen too. How long to brute force a 16 digit number? With a known subset of 4 digit leaders, and being able to cull the list first for ones with good luhn checksums.

Edit: Ugh. Yes. My mind was apparently elsewhere. Keyspace would drive the time needed.

Though it is a relatively short list of known plaintext. especially if you focus on the bin ranges for say the three most popular banks in the US.

But, only interesting if Marriot was using some encryption with a small keyspace.

ryanlol12• 8 years ago

Are you really suggesting that bruting cc #s would be a viable method of committing fraud?

If yes, how much would you expect the bruteforcer to earn per successful attempt?

bradleyjg• 8 years ago

I don’t follow. Why is it the size or structure of what’s being encrypted that matters for brute force time rather than the key space of the encryption algorithm.

Password hashing is different because there is no key space.

raesene98• 8 years ago

To construct a valid card identity you need more than just a 16-digit number that passes the luhn check.

At the very least you'll need cardholder name and expiry to match up, and hopefully you'll need CVV/CVC as well.

Of course I really hope the Marriott weren't storing CVV in a reversibly encrypted format.

ryanlol12• 8 years ago

How is that the "Oh dear."? Do you work for a bank?

That seems like the least interesting bit of information here for individuals.

It's really bizarre to me that people here seem to consider their credit card numbers more sensitive than their travel history or even contact information.

raesene98• 8 years ago

well possibly not. If the attackers got the keys to decrypt payment details that means that victims, in addition to the identity theft risks, may also face fraudulent transactions on those cards as a risk.

Jach• 8 years ago

Why is it bizarre? Most people wouldn't consider their comings-and-goings to be worthy of any privacy protections, though some people have non-criminal reasons to want to protect that privacy. Contact information likewise is generally public information, some people may have non-publicized means of contacting them though that they want to keep private.

Generally people's level of care will correlate to what nefarious purposes the data can be used for. There aren't that many such purposes with the data exposed here until you consider the passport number (probably something more secure than a SSN for most Americans?), payment info, or login info. The purposes I can think of for the other data are reliant on the metadata that so-and-so was at that location at that time, when I might have believed something else.

Oras• 8 years ago

and according to the article: "It said an internal investigation found an attacker had been able to access the Starwood network since 2014." 4 years of access, surely the attacker didn't manage to get hold of these keys

codedokode2• 8 years ago

Card information has no value because it is very easy to reissue a card. Things like name or phone number, or address, cannot be changed so easily and have much higher value.

closeparen12• 8 years ago

Things like name, phone number, and address are not secret. They are published in the phone book.

jstarfish• 8 years ago

Card information is literally cash money. It's volatile and subject to being rendered defunct, but it still has a lot of value if you can buy a bunch of prepaid gift cards with them before it's deactivated.

koboll• 8 years ago

"We deeply regret this incident happened," the company said in a statement.

This is peak non-apology apology.

duxup2• 8 years ago

Well I'm sure they regret it... it's very inconvenient for them.

dopamean2• 8 years ago

Why on earth would they hold onto passport numbers? The amount of data companies hold onto is ridiculous. It can't all be necessary.

dagw• 8 years ago

Lots of countries legally require that hotels collect and store passport details of foreign guests.

dopamean2• 8 years ago

Right but then after the guest checks out why would they hold on to them for longer than a few days?

willvarfar2• 8 years ago

In many countries hotels are required by law to keep passport numbers of foreign guests.

In the US there is, apparently, no federal law; however, it is often part of state law: https://travel.stackexchange.com/questions/76012/laws-requir...

In many more countries hotels do it despite it not being required; they just do it to assist law enforcement agencies.

And doubtless they like to keep the data themselves as an effective way to track and mine guests across multiple visits.

lsiunsuex3• 8 years ago

It's like you need to keep a running diary of every single service you've used / every single place you've been so when something happens like this, maybe you can find out if you actually used that service or visited that place.

I think I stayed at a Starwood 2 years ago in PA? But I don't remember if it was a Starwood or some other Marriott brand.

qrbLPHiKpiux2• 8 years ago

I have a domain I use with Fastmail that when I use a service or website, if I need to register an email it's always:

service or websiteName @ mydomain.com

Doesn't cover all, but at least it's something...

noja2• 8 years ago

Combined with a unique string, or just the bare name?

guitarbill3• 8 years ago

This was one of the unexpected perks of moving to FastMail, which has been an awesome experience so far. I'd highly recommend it.

You can do something similar in Gmail with `name+label@gmail.com`, but a shocking number of sites ban valid characters from email addresses (intentionally?). That and a lot of clients have super annoying alias settings, so replying to such an email is a royal pain.

laumars4• 8 years ago

This is why I do my upmost to avoid entering payment details on as many sites as I can.

Unique passwords (and usernames too if that is an option) are easy to manage via lastpass et al. Unique email addresses are harder but you might be able to fudge something using the "+ label" feature. But the real challenge is payment details. I'd be quite happy using Paypal everywhere if that were possible as then I'd only need to worry about Paypal getting hacked.

What I really don't like is shopping sites that require me to enter my payment details (or worse: require me to save payment details). I avoid those places in almost all cases.

noxToken• 8 years ago

What I really don't like is shopping sites that require me to enter my payment details

Would this soften the blow if they used an indirect payment system like PayPal instead of directly entering card information? Otherwise how else could you shop online?

(or worse: require me to save payment details)

Sites actually do this?

e1g2• 8 years ago

I use privacy.com to generate a unique credit cards for most purchases/services. These cards are by restricted to the same merchant, and can have a max limit added. It's the same idea as generating unique passwords with 1Password et al.

matwood2• 8 years ago

Does it really matter at this point? It's safe to assume all your data has been compromised. Given the state level IRS hacks that have happened in quite a few states, the OPM hack, and the hundreds of business hacks no one is safe anymore. Everyone should operate under the assumption their information is known and do things like freeze their credit and keep an eye out for the data being used.

lsiunsuex3• 8 years ago

Sure it does. Just because they "apologized" doesn't mean it should be acceptable or dismissable.

These breaches keep happening and these companies continue to be not held accountable or not punished in anyway, except for bad press for 2-3 days until everyone forgets and it's on to the next security breach.

You want me to shop at your store or use your services, you want me to join your mailing list or give you my address, CC and phone # - I expect at the least, for that information to be kept secure.

pavel_lishin• 8 years ago

My toilet backing up and spewing sewage on the floor doesn't give my guests an excuse to spit on my floors.

gammateam• 8 years ago

www.haveibeenpwned.com will help you with that

also using unique passwords as well as aliasing your email address such as gammateam+starwood@gmail.com helps you isolate which breach comes from where. the spam emails you get will start having the alias on it

keehun• 8 years ago

Here's a link to the official Marriott release, FWIW: http://news.marriott.com/2018/11/marriott-announces-starwood...

noja2• 8 years ago

"We cannot find any evidence that the stolen information has been misused" - says every company ever, as if that means anything.

I give it 24 hours.

raisedbyninjas• 8 years ago

The only logical conclusion is the data must have been stolen as an academic exercise.

bduerst2• 8 years ago

How lucky Marriott is, to have some good Samaritans to stress-test their security without the intention to misuse their user data.

ken2• 8 years ago

The NYTimes article about this incident says:

“Usually when stolen data doesn’t appear, it’s a state actor collecting it for intelligence purposes,” said James A. Lewis, a cybersecurity expert at the Center for Strategic Studies in Washington.

YetAnotherNick• 8 years ago

Not to downplay it but my email shows 3 breaches in haveibeenpwned.com, and I haven't had any problem till now, apart from probably more emails in spam folder.

geggam• 8 years ago

Privacy is dead. Long live... ?

brootstrap• 8 years ago

Getting constantly hacked from all angles. FB AMZN GOOG AAPL are always listening to us thru devices. Mega corps build systems that leave sensitive data exposed to the public web. I'm curious to see what actually caused this hack. I wonder if they used mongo db with default settings lol.

Latteland• 8 years ago

I think the vast majority of these hacks come from some random office working clicking on a doc in an email and opening it up in a microsoft app, on microsoft windows. we've never really blocked that up yet. I don't see it coming because someone hacked the backend of apple, google or amazon. who knows about facebook.

code4tee• 8 years ago

That’s quite a lot of gasoline being thrown on the whole train wreck that is the Starwood integration.

Aloha2• 8 years ago

I wouldnt call it a wreck, probably 80% of members transitioned without any real problem. For some though, its been awful.

TekMol5• 8 years ago

    It said some records also included encrypted payment
    card information, but it could not rule out the
    possibility that the encryption keys had also been
    stolen.

Why did the world end up with a pull-system for payments? Why do I have to give out my credit card number and enable the other side to pull arbitrary amounts as often as they like?

This is one of several things crypto currencies got right. You pay by pushing money to the other side.

ryanlol12• 8 years ago

Why do you care if your credit card number is compromised?

TekMol5• 8 years ago

Because last time that happened it was a big hassle.

I had to:

    * Do a phone call
    * Fill out paperwork
    * Wait for a new card to arrive
    * Go through all services I use the card for and change it

14• 8 years ago

I don't understand your question are you serious? Even if my money is completely protected from fraud, if I have to spend one second dealing with some the problems from such fraud and the stress it could cause I would never want my credit card numbers compromised.

mikestew3• 8 years ago

Why are you asking what you think are rhetorical questions? Because the fix is not trouble-free on my end. I assume that you’ve never had the experience if you’re asking.

Waterluvian2• 8 years ago

I don't think crypto currencies really deserve much credit for this. It kind of already exists.

I have authorized bank withdrawals for paying some bills. This is the "pull" and I don't really feel all that comfortable with it. I once had an irritating issue where an no-longer-authorized withdrawal didn't stop properly.

But I also have scheduled payments, the "push" method, where my bank account will routinely send a configured amount of money to a configured account/company at a configured interval. I like this because of the control and responsibility it gives me.

Something I wish Canadian banks had was a better API for allowing me to say, "instead of paying $x each month, query the bill and pay the exact sum as long as it doesn't exceed $y".

TekMol5• 8 years ago

I did not say it was invented by crypto currencies.

Banks have not managed to implement a payment process for exommerce yet. You have to log in, fill out a form, do some kind of verification, wait for a day or more... yuck! That's fine for big transfers that only occur rarely. For a quick online payment it sucks. That's why nobody is using it for this use case.

pjc50• 8 years ago

The short answer is that credit cards were invented over 40 years ago, to operate in an offline and indeed paper-based system (hence the embossed digits for use in mechanical duplicators). For a more modern system look at contactless.

FWIW I think the "one shot push" model of cryptocurrencies has some serious limitations which I think should be addressed by an "invoice" system - e.g. you can easily pay the wrong person, or even an address which doesn't exist and is owned by nobody! Not to mention dumb errors such as swapping the payment and tip fields. It would be better if the payee crafted a cryptogram for "please pay me (authenticated address) the sum of X", and the payer was simply generating an approval of that.

TekMol5• 8 years ago

    It would be better if the payee crafted a cryptogram
    for "please pay me (authenticated address) the sum of X"

Are you talking about offline? Because on a website I would expect the payer to simply copy&paste the address.

I would also expect a link type to evolve that browsers understand. Something like "payto:1fs8e...?amount=0.01&coin=btc" to pay 0.01 bitcoin to 1fs8e... Similar to the "mailto:user@host?subject=...&body=..." link type.

An when we talk about offline (paying for a restaurant or something) - isn't there a visual link type already? I am not a user of crypto. But I think I have seen barcodes or something used for this.

r1ch• 8 years ago

For Bitcoin, BIP 70 was proposed (and quite widely implemented) to take care of a lot of these issues. I assume many other cash-style cryptocurrencies have something similar these days.

https://github.com/bitcoin/bips/blob/master/bip-0070.mediawi...

drexlspivey• 8 years ago

Addresses contain a 4 byte checksum so it's very unlikely to typo in a valid address. Also the lightning network (2nd layer over bitcoin) works exclusively by invoicing as you described.

PunchTornado2• 8 years ago

I guess without GDPR there wouldn't have been a push for these companies to notify of breaches so early. We could have found out about it next year.

Also given the potential penalties, probably companies will now start to invest more in proper IT systems.

ramblerman• 8 years ago

Was that part of GDPR?

I know they have to hold the minimum amount of information needed, and inform you clearly what they know.

But weren't they always required to announce a breach?

robin_reala2• 8 years ago

GDPR has a specific 72 hour time limit on breach announcements: https://ico.org.uk/for-organisations/guide-to-the-general-da...

In this case, they discovered the breach on September 8, 2018, and announced it on 30th November, 2018. That’s 1,464 hours, a little bit more than 72.

pbhjpbhj• 8 years ago

AFAICT companies can still hold all your information /if you consent/ but can't withold service if you don't consent unless they can prove that information is required for provision of the service. So, can they show passport number is required in my jurisdiction, if not then I can have a room without providing it.

tgtweak2• 8 years ago

In addition to this, as per GDPR, the personal information (name, passport, address, email, phone) should have been encrypted in the database, just as the payment details were. This would have reduced the effect of unauthorized database access.

I'm guessing this was not done either, even for EU guests.

aaaaaaaaaab• 8 years ago

I hope they at least hashed the credit card numbers ( ͡° ͜ʖ ͡°)

tgtweak2• 8 years ago

Wishful thinking, they encrypted them so they could conveniently be recovered.

sneak5• 8 years ago

I find this to be justification in carrying a fake ID and issuing a credit card from my corporate line of credit in that cover name for use when renting hotel rooms.

Every time a private organization demands your government ID to do business, assume that this will happen eventually. Airlines and hotels immediately come to mind, but I am sure there are lots of others. I'm not sure that air travel with a fake ID is viable due to Secure Flight, however. Also, as rental car insurance interfaces (potentially) with a police report/government ID, I am not sure I will rent cars in the future.

When it comes to places you regularly or habitually sleep, this could mean direct physical danger to you, depending on circumstance.

Protect yourself.

SketchySeaBeast4• 8 years ago

When it comes to places you regularly or habitually sleep, this could mean direct physical danger to you, depending on circumstance.

Sorry, what are you saying here? That the online identity thieves will come to your house?

sneak5• 8 years ago

That people looking to extort, blackmail, or kidnap you or your family can now tail you from the hotels you usually/habitually frequent during conferences you consistently attend. It lets them predict your future location so that physical surveillance or ambush can be prepared.

visarga• 8 years ago

... and ... nothing will happen to Marriott.

CaptainZapp• 8 years ago

Great!

My last stay at a Starwood property was in January 2016 at the Bangkok LeMeridien.

Not that they would bother to set up a call center number for Switzerland.

Do they really expect me to call internationally at my expense to then hang in a loop for an hour or so?

On the plus side: Nothing bad happened since then.

Nevertheless I'm not impressed.

bryanrasmussen• 8 years ago

I'm thinking - they don't really expect you to call internationally to hang in a loop for an hour or so but they have calculated that a certain number of people will call internationally and hang in that loop whether or not any single individual is highly unlikely to do so.

jgust• 8 years ago

I'm willing to bet that they haven't calculated _anything at all_ and they are scrambling to put out the fire.

eletious• 8 years ago

Not entirely on topic, but Marriott seems to be dealing with some internal phone abuse issues as well - calls going directly to hotel rooms (bypassing the front desk) and asking for card details to fix broken incidentals records. I got a call like this yesterday and found out that it's enough of an issue that they've printed out signs in the lobby warning guests to not hand out information.

SmellyGeekBoy• 8 years ago

That's interesting. I've had a couple of calls like this in the past and have always insisted on going to reception instead of giving details over the phone. Thankfully mine turned out to be genuine.

crazygringo2• 8 years ago

Is it time for us to simply accept that it's inevitable that, at some point, everything will be hacked, and hacked often?

Should we be focusing our efforts more on how to make "identity theft" (i.e. fraud) more difficult, even when someone knows all your data?

Something more tied to your physical self, whether 2FA or something else?

freehunter2• 8 years ago

Everyone who knows about security already accepts that everything either already is hacked or will be hacked eventually and no one can stop it. There's a famous quote and I'm not sure if it's originally from former FBI Director Robert Mueller [1] or former Cisco CEO John Chambers [2]:

"There are two types of companies: those that have been hacked, and those who don't know they have been hacked."

[1] https://archives.fbi.gov/archives/news/speeches/combating-th...

[2] https://www.networkworld.com/article/2952184/cisco-subnet/jo...

darkerside2• 8 years ago

Seems like it. Bank vaults are difficult to get into, sure. But they're especially difficult to get into without being detected. Go ahead and force your way in if you want to. You most likely won't have long to enjoy it since you've been witnessed in person, by security cameras, and are now carrying marked bills.

Perhaps in the digital world as well, intrusion detection is more valuable than intrusion prevention?

throwaway5752• 8 years ago

I don't know what your background is, but IPS is a huge deal already. Tens of billions of cumulative market cap in the space. Your physical "bank vault" analogy doesn't model the threat very well for many reasons. If you happen to know how to solve this, though, you will be incredibly wealthy.

sbov2• 8 years ago

The digital world does not require my physical presence which means that even if you detect me, odds are you can't even identify, much less apprehend me. Bank robbers have no such luxury.

jwr• 8 years ago

I hope that after several GDPR fines companies will start considering gathered data as a liability, not an asset and collect less to begin with.

SlowRobotAhead• 8 years ago

Something I was taught awhile back relating to IT, “Data is toxic”. Get rid of it when you can, as often as you can.

You’re right. These companies should absolutely have to weigh the cost of keeping data because they overestimate their ability to keep it safe.

naravara• 8 years ago

The most valuable data is just necessary to do their business though. Our financial and identity information are the things we hold most dear, but that's also exactly what we need to exchange in order to engage in commerce.

mLuby• 8 years ago

You could say the same thing about corporate lawbreaking. It's likely given enough time and employees, but that doesn't absolve the company of its responsibility and liability.

We need tough, enforced penalties for data breaches, plain and simple. It's a negative externality, just like pollution, and so can only be controlled by regulation.

dennisgorelik4• 8 years ago

It's a negative externality, just like pollution

No.

Your leaked data does not hurt me. So it is NOT like pollution.

If you do not like your data on the internet - do not give it to companies you do not trust.

can only be controlled by regulation

Your claim is wrong.

Companies behavior is controlled by customers demands. The balance between security and convenience -- is not an exception here: customers demand define where that balance is. There is no need for the government to intervene in this case.

harshreality• 8 years ago

I really want to know why identity verification can't incorporate better technology, since driver's licenses and passports and such have been upgraded but are still non-interactive (from the user's perspective) and can't prove identity remotely.

i.e., instead of the traditional "what are the [last 4 of] your SSN, and/or we'll tell you three things that may or may not be in your credit history and you have to fill in the blank on each of them"...

...why not just use 2FA?

You give everyone a TOTP code on a separate card but tied by the government to your SSN, passport number, and state ID. You provide a government mobile app that they can use if they don't want to use a 3rd party one. When some third party wants to verify your identity, there would be a heavily secured, simple, autited government server that you'd use the app to auth to (ssn + TOTP), returning a temporary auth code/passphrase, stored for 1 day and associated with your SSN. You give that temporary code to the third party, which then verifies that temporary auth code or passphrase with that same government server. You could have an additional voice phone channel to get the temp codes, for people without smartphones.

If your TOTP code card and device are both lost or stolen, you visit in person to get a new one just like normal. Anyone who sees the card can impersonate you, but you shouldn't be carrying it around or waving it around, and even if stolen in individual cases, the scheme eliminates mass identity theft.

U2F could be an option, for anyone with a u2f-capable hardware security key or smartphone, but I'm not sure about mandating u2f because compatible hardware has a non-trivial marginal cost.

megous• 8 years ago

https://en.wikipedia.org/wiki/EIDAS

Went into force a few months ago.

mindslight2• 8 years ago

Because the cost of "verifying identity" is a feature! The easier it is, the more frivolous uses of it there will be - imagine basic forum websites deciding the easiest way to cut spam is to demand real world IDs. Google's new practice of requiring of a phone number to make an account would look tame in comparison.

This very case is already an example of overreach. The only reason a hotel needs someone's identity is in case they trash the room and skip out. There is absolutely no reason that it should have been kept after checkout, except that we've been groomed to expect this surveillance based on payment cards being similarly broken.

I can see the possibility for reasonable progress in the EU, where a government ID could carry rules that it couldn't be involuntarily used for business purposes (and assuming that would actually last). But in the US, the government will mandate some base system and then let companies abuse it ad infinitum - even social security numbers are already way too much.

closeparen12• 8 years ago

Because people who should know better are happy to support legal liability around the protection of shared secrets. Companies almost always prefer to protect legacy systems with lawsuits/regulations than to actually harden them.

jrue• 8 years ago

Is it time for us to simply accept that it's inevitable that, at some point, everything will be hacked, and hacked often?

I disagree. I’d take the Economists route, which is looking for the incentives that drive motivation. If companies were held to a higher standard of accountability, imagine how many would beef up their security. For decades, security researchers have been poking fun at how ridiculous some of these sites are at handling security, and nothing ever happens.

Now, imagine if there was severe economic accountability to a company that was hacked. Perhaps payouts to each person affected (in this case, to all 150m). I imagine you’d see security become a top priority very quickly at most companies.

nkkollaw5• 8 years ago

In Europe you have GDPR, there are huge fines for stuff like this.

_ptgt• 8 years ago

As a developer, do you really want to live in a world where "security is a top priority" at every company? Does such a world even make economic sense after accounting for the opportunity cost of the time most that developers would otherwise spend actually building new products and features?

While companies could probably do better than they are right now, hacks like this are probably never going to be eliminated. There are too many companies and too many developers for nobody to make mistakes, even when they're being mindful not to. Investing in solutions that assume hacks will happen seems reasonable to me.

closeparen12• 8 years ago

Either your information is known to an attacker, or it isn't. Great security "at most companies" in a hypothetical future doesn't help. You need security better than the best attacker, at every company, all the time.

That's a pipe dream. Instead we should take advantage of public-key cryptography, so that authenticating to one company does not leave behind infinitely reusable credentials for others.

bparsons• 8 years ago

Agreed. Statutory, automatic penalties for data mishandling or negligence need to be brought in.

Right now, there are few penalties, outside of a brief reputational hit, for large firms that lose control of customer data.

DanielBMarkham• 8 years ago

That's wrong for many reasons. Others have covered the simple fact that you couldn't start any app with lots of users and zero capital. The downside is huge. Barriers to entry become more impossible than they already are.

But that's not the worst of it. The Economist here is doing a static analysis, oddly enough. They're making the simple observation that if things cost more or have more risk, they get more attention.

That's if they have more risk today. Once you collect data, it doesn't go anywhere. Every bit that sits on your servers can easily be copied to another server, today, tomorrow, ten years from now. Do you know what all the bits are on your computers?

This isn't copyrighted DRM or porn. You could have a blob hashes and userids. If I put that on your computer, would you know? Could you be expected to find it? Know what it was?

As Facebook and the other platforms are demonstrating, this data continues to have value many years after it was collected. And once somebody gives some data to you, it's effectively both invisible and trackless. Over long periods of time, your cost becomes infinity to maintain this risk. Meanwhile, attack vectors get better and people come and go out of your offices all the time. Could you manage that risk? Forever?

I can't think of _any_ sensitive data on the web that's stayed safe. Why would attaching any amount of value change that?

james_s_tayler• 8 years ago

So far the market has decided that she economics for protecting users and protecting data just isn't there and that's why we see what we see.

That's why GDPR happened. "Ok, if you're not going to do anything about it, we'll make you do something about it."

So you're not taking the economists point of view at least from the perspective of the free market rather you're thinking about which economic levers you could pull to effect change from a regulators point of view.

SilasX• 8 years ago

Has any state's DL database been compromised? The US government's passport DB?

ams61103• 8 years ago

Most likely yes, we just may not know about it.

ryanlol12• 8 years ago

DBs containing essentially all US citizens like Accurint/Seisint have been compromised in the past https://www.theregister.co.uk/2007/03/08/lexis_nexis_hacker_...

https://phys.org/news/2013-09-lexisnexis-breach-earlier-year...

I'm preeetty sure they source DL data from some state DMVs.

sneak5• 8 years ago

You're only thinking of transactions. Physical location history (which hotels they frequent, and when) is damaging enough to HNWIs. Name + location + timestamp is sufficient to prove physically dangerous when leaked.

What we need are more options to transact anonymously. This "show ID for everything" culture needs to stop.

cheeseomlit• 8 years ago

Maybe, but there's a legitimate fear that this thinking will eventually lead to everyone being required to be implanted with a microchip to participate in the economy

cmurf2• 8 years ago

Past time. There are way too many people comfortable with giving companies date of birth, passport and social security numbers, as forms of ID. And therefore the sane and aware people who don't want to give up that information, are left as non-participants because they are the minority. And therefore I think there needs to be law making it illegal for certain personal information to be stored. Marriott can sufficiently confirm my identity by getting my name, address, phone number, and a credit card number. The latter can be used to verify the former via a 3rd party, the issuer of the credit card. And this verification doesn't require storing the credit card number.

Anyway, these companies are bad at their job as evidenced by the breach happening. And I definitely think we're past the time where it should be illegal for companies to even ask for passport numbers, DOB and social security. A phone company, a hotel, need none of that. They just want it. Big difference.

late2part3• 8 years ago

Like a chip in your forehead or right hand?

xur17• 8 years ago

I'm starting to wonder if it would be a good thing if the data from one of these broad hacks was widely distributed, forcing companies to come up with a better way to verify "identity".

If companies knew that there was a database that everyone has access to with all the data you need to signup for new sources of credit for 50% of US residents, there would be a very strong financial incentive to actually fix the problem.

ken2• 8 years ago

I see two possible readings of your comment, which are almost opposites. One is that we should all learn to deal with this much data about ourselves being exposed. The other is that the root cause here was how much data they collected about us in the first place.

I really don't understand why so many companies think they need so much information about me. Or even if they do need it, why such disparate data as passport numbers, credit card numbers, email address, gender, and home address would be stored in the same database.

Is there a law that requires hotels to collect all this data? I've stayed at some cheap motels where they glanced at my driver's license and accepted a couple of $20 bills, and I got a key, and that was the entire transaction.

netwanderer3• 8 years ago

Agree. The Infosec field is a rabbit hole. It's a cat and mouse game. As long as it's run by human, everything is bound to be hacked eventually.

rednerrus• 8 years ago

I do not envy their ops team.

cs702• 8 years ago

As a first rough approximation, this figure includes everyone on HN.

It appears to include everyone who's ever stayed in a room at a Marriott, St. Regis, Ritz-Carlton, Bulgari, W Hotel, JW Marriott, The Luxury Collection, Le Meridien, Renaissance, Westin, Tribute Portfolio, Sheraton, Autograph Collection, Design Hotel, Marriott Executive Apartments, Delta Hotels & Resorts, AC Hotels, Element, Gaylord, SpringHill Suites, Courtyard, Residence Inn, Fairfield Inn & Suites, Moxy Hotels, Protea Hotels, TownePlace Suites, Aloft, Four Points by Sheraton, or Marriott Vacation Club property.

For reference, there are under 130M households in the US and around 200M households in the entire EU.

cr18952• 8 years ago

From the article:

"The hotel chain said the guest reservation database of its Starwood division had been compromised by an unauthorised party."

"Starwood's hotel brands include W Hotels, Sheraton, Le Méridien and Four Points by Sheraton. Marriott-branded hotels use a separate reservation system on a different network."

edit: the Marriott website itself confirms as much that this is limited to Starwood properties.

http://news.marriott.com/2018/11/marriott-announces-starwood...

" guest information relating to reservations at Starwood properties* on or before September 10, 2018.'"

"* Starwood brands include: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Starwood branded timeshare properties are also included."

Do you have other information?

jayess• 8 years ago

* Starwood brands include: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Starwood branded timeshare properties are also included.

isostatic4• 8 years ago

What possible reason would Marriot have to have details of my stay from 6 years ago on record, especially on their reservation system.

pc864• 8 years ago

Customer reactivation.

Other marketing activities.

Resale to third parties.

You at any point requested to be added to their mailing list and that's linked to purchase history.

Web analytics linked to purchase history.

Corporate policy is not to delete data.

Laziness.

So there's seven reasons of various legitimacy off the top of my head.

donkeyd• 8 years ago

I recently got added to Starwood Preferred Guest. I still don't know why they have my e-mail (don't seem to have stayed at any of their hotels), but I guess it's out there now, even though it wasn't in HIBP before.

nkkollaw5• 8 years ago

This is going to end so many marriages, it's not even funny.

0xmohit• 8 years ago

The New York Attorney General is opening an investigation into a Marriott data breach that may have affected 500 million guests.

https://twitter.com/NewYorkStateAG/status/106851007239602995...

swarnie_• 8 years ago

I would expect the EU to follow with GDPR shortly, massive fines incoming.

shawn-butler• 8 years ago

Great massive fines, significant lawyer billing, some worthless credit monitoring service free for 6 months and screw the affected consumers.

Let's see Target is probably the most obvious parallel: $202 million in reported legal fees and other costs. $18 million to states (fines). $39 million to the financial institutions affected by the breach and a whopping $10 million for the consolidated class action lawsuit (along with the $6.75 million for plaintiffs’ attorneys fees and expenses).

Oh wait, Target annual profits are $20 billion? Never mind.

lawnchair_larry2• 8 years ago

They still don’t even use https, so this is not surprising.

SketchySeaBeast4• 8 years ago

Outside of the privacy problems (which, let's be honest, our data is already out on the web) if you changed your credit card since your last visit you're probably safe on that particular financial attack vector, right?

codedokode2• 8 years ago

If they didn't keep the data from long ago, then the damage would be much smaller. Such companies definitely need some help from lawmakers. Companies shouldn't keep personal information for years.

duxup2• 8 years ago

It said an internal investigation found an attacker had been able to access the Starwood network since 2014.

Jebus that seems like a long time before discovering it.

ransford• 8 years ago

Marriott's incident page [1] links to a Q&A page [2]. Apparently the forthcoming sorry-we-lost-your-data notifications will come from "starwoodhotels@email-marriott.com".

"Let's immediately set up a separate domain name that looks like ours" remains one of the weirdest antipatterns in incident response.

[1] http://news.marriott.com/2018/11/marriott-announces-starwood...

[2] https://info.starwoodhotels.com/

cm11• 8 years ago

Is this to purposefully increase likelihood of getting caught in a spam/phishing filter? So they claim they've reached out while also (probably correctly) claiming it's not their fault if customers didn't get it.

CobrastanJorji• 8 years ago

Interesting theory. My theory was that there's incident management contractors get this sort of business and don't want to bother integrating with any existing company's infrastructure, so they just set up something entirely different.

ransom1538• 8 years ago

Close to my theory! Basically, they need to send out millions of email fast. This email, with a bunch of legal text will probably have a high 'mark as spam' rate. This will destroy the domain's marketing ability. SO! The marketing guy won the argument in the meeting: don't use the root domain.

celticninja• 8 years ago

I think the stated reason is usually "a single place users can go to directly", the least nefarious reason is that they don't want to associate the breach with their main site, so only affected or inquisitive customers will know about it.

gukov• 8 years ago

Airlines do something similar when one of their planes crashes and the fuselage stays relatively intact: they cover the airline's name/logo on it.

rbobby• 8 years ago

Anti-pattern does seem like a strong enough word sometimes. These domains are available:

emai1-marriott.com

email-marriot.com

e-mail-marriott.com

I wonder whether it might be better if governments took over the notification side of things. Something like "notice@databreach.gov". Companies could pick from a few standard templates and get charged $1.00 per email.

hamilton• 8 years ago

A handful of years ago, Paul Ohm wrote about a concept he called the "Database of Ruin" [0]. I think about it every time one of these pieces of news breaks.

"Once we have created this database, it is unlikely we will ever be able to tear it apart."

[0] https://hbr.org/2012/08/dont-build-a-database-of-ruin

imnotlost• 8 years ago

I'm almost certainly in the database.

So I have to get a new passport, get a new phone number, get a new credit card, change my email address... in the US, can I sue in small claims court to recover the costs of doing these things?

randomsofr• 8 years ago

don't forget to change gender and date of birth as well

bduerst2• 8 years ago

I just signed in to Marriott.com see what info they have on me that was stolen, and was forced to change my password. It even required email verification, which is good.

Then when I tried to log in with my new password I was rejected, saying my account is 'under audit' for suspicious activity. God dammit.

Is anyone else unable to log in?

drcode3• 8 years ago

A breach like this should mean that Marriott should immediately be in bankruptcy, since the potential damage to any individual customer is well above multiple thousands of dollars.

I wish some of these giant companies would see some real consequences for their lax security practices.

cmurf2• 8 years ago

History being a guide, Marriott will obtain a contract with some financial security monitoring service, and offer a ~12 month free period for affected consumers. I've always thought these products are b.s. The advertising is scammy. I'm betting they leak even more data, like your purchase histories.

Does anyone know of the efficacy of these monitoring services? If they were really even slightly more effective than even odds, I would say that consumer protection laws should require free monitoring for a longer period, say 24 months or even 36 months. Ironically though, proper monitoring means sharing all of this same personal information with a 3rd party, and then some.

I also wonder if it's just more effective to take advantage of the free credit report freezing feature, since that doesn't require me to share even more personal information with a 3rd party; and actually restricts access to personal information instead of expanding it.

drcode3• 8 years ago

Is anyone else noticing unusual downvotes on this thread? Anyone think it's plausible a Marriot damage control team is participating on this thread?

pc864• 8 years ago

I think it's unlikely that a Marriott "damage control team" cares about comment vote totals on an HN thread.

drcode3• 8 years ago

I would usually agree, but near as I can tell the vast majority of the top-level comments in this thread have a negative score and I find that surprising.

Jabbles• 8 years ago

How could it affect 500 million? 1 in 16 people worldwide have stayed in a Marriott hotel? That seems like a lot...

pc864• 8 years ago

500 million reservations from 150 million people/companies/entities.

magnamerc3• 8 years ago

When you start using Ethereum and web 3.0, the solution to data security becomes quite clear. I'm sure I'm gonna get roasted here for even mentioning this, but you'll all eventually come around.

brewdad• 8 years ago

This was the kick in the pants I needed to finally take the time to freeze my credit. I don't know how much it will help but it can't hurt, I guess.

calebm• 8 years ago

A nice article to read while sitting here in a Marriott.

Marriott hack hits 500M Starwood guests

Related Stories