StockX was hacked, exposing millions of customers’ data

https://techcrunch.com/2019/08/03/stockx-hacked-millions-records/

by rmason • 7 years ago

142 102 7 years ago

hacker_9• 7 years ago

The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version.

The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen data is shoe sizes? MD5 hashing for passwords isn't ideal, especially combined with email addresses - that could lead to some email accounts being accessed if people use the same password for everything. The article seems to not really give much attention to this though, not clear if the author even realises this is the main problem.

TeMPOraL• 7 years ago

The stolen data is shoe sizes?

StockX is a platform for trading shoes, among other things.

perl4ever• 7 years ago

I never heard of them before, so I checked Wikipedia and read this:

"The platform works by buyers undercutting each other in a fashion similar to the stock market, eventually causing limited items to lose all value. "

Can someone elucidate how this is like the stock market, because I don't get it.

anon4242• 7 years ago

Well, every data helps if you're trying some targeted hacking. If the username is LebronJames and the shoe size is 9, it's not the right Lebron...

adrr2• 7 years ago

We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak puts other companies at risk.

sieabahlpark• 7 years ago

You can't sue a company for your own bad security practices.

whatshisface• 7 years ago

That would be a civil case prosecuted by the other companies, not a criminal case.

JudgeWapner• 7 years ago

they should be sued based on the number of breached records, period. let their insurance company dictate what hash algorithm to use. Damages would be automatically awarded to plaintiffs based on what data was breached. Just like a car accident: you destroyed my rear bumper, tail light, and window, the damages were $3200. Pay up.

youeseh2• 7 years ago

Author might be a young intern writer.

youeseh2• 7 years ago

My bad. He isn't. I suppose this was a 'strictly news' piece. Separate analysis coming soon.

conroydave• 7 years ago

arent they a quicken family company?

werber• 7 years ago

Yep

txcwpalpha6• 7 years ago

The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted)

This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators should have known better (sadly, despite this, an absurdly high number of companies still use MD5 for pass hashing).

These passwords, hashed with MD5, might as well be considered to have been stored in plaintext.

xwdv3• 7 years ago

Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware. You are probably not cracking the password in any reasonable time, period.

And when you have a unique salt per user, that’s basically game over.

cm21872• 7 years ago

Usually the salt is stored along the login and password.

txcwpalpha6• 7 years ago

Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt, within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.

viraptor• 7 years ago

In 2012: https://www.zdnet.com/article/25-gpus-devour-password-hashes...

That's 7.2 billion hashes per second per single Radeon GPU for md5. For 8 character password with numbers and letters that's 8.5 hours max and 4.25h on average.. The numbers only got better since then, I expect it's at least halved for this year's hardware. (edit: 1080ti does 32GHps, so yeah... make that 1h on average https://www.servethehome.com/password-cracking-with-8x-nvidi... )

Assumptions, not specified in the article:

- The salt is stored with the hash (this is a standard approach)

- It's only a trivial implementation with a single round of MD5. If they used multiple rounds or PBKDF1, then the hash choice doesn't matter as much.

SkyPuncher2• 7 years ago

You need to update yourself on the vulnerability of MD5.

5 years ago, a run of the mill gaming PC could crack an MD5 hash in a reasonable amount of time. Worst case, you'd have to let it run overnight.

One of the big issues is collisions. You might not find the original key, but you'd find something that hashed to the equivalent output.

wpietri• 7 years ago

Given that data, doesn't their attempt to call this "system updates" constitute a violation of California's data breach notification laws? https://oag.ca.gov/privacy/databreach/reporting

elliekelly2• 7 years ago

Oh man this is an interesting grey area. If the data was “encrypted” then they aren’t required to notify unless the encryption key is reasonably believed to have been acquired by the hacker.

I don’t know anything about MD5 or what makes it vulnerable but if StockX has no reason to believe the hacker acquired the key they could certainly make the argument they had no notice obligation.

Reading the statute (and assuming MD5 is as weak as everyone here says) I would say it falls outside the definition of “encrypted” but it really kind of depends on how honest the security engineers were with the lawyers.

I’ve never thought to ask “how encrypted?” when dealing with a breach but I definitely will now.

dehrmann2• 7 years ago

hashed with MD5, might as well be considered to have been stored in plaintext.

Somewhere I used to work (now-defunct) stored DES-encrypted passwords with the key one column over in the database.

rvz• 7 years ago

...The company “robbed their users of the chance to evaluate their exposure” by not informing customers of the breach when it happened...

StockX is valued at $1B and aside from their cataclysmic choice of using MD5 + salt as their way of hashing passwords (They obviously don't take security seriously) the company failed to inform their customers of this security breach as soon as it happened and left it very late for the customers to change their credentials. I would expect any unicorn valued company to have some form of incident-response system to immediately inform staff of the breach and to instantly reset all user credentials and to notify their users.

Instead they didn't inform their customers after the breach and now someone is calculating all those MD5 collisions and attacking all accounts with common passwords.

In the case of StockX handling this security breach, this is un-professionalism at its finest.

barbecue_sauce• 7 years ago

Jeez. Even coding bootcamps teach developers to use at least bcrypt for passwords.

doctorpangloss• 7 years ago

It’s just a Wordpress site using ancient defaults. It’s not exactly a technology business.

xkcd-sucks• 7 years ago

Then they get into I dustry and get told that getting stuck in the weeds of security isn't something which generates value

FDSGSG2• 7 years ago

calculating all those MD5 collisions

What now? What do MD5 collisions have to do with passwords?

morgajel2• 7 years ago

you don't need the password, you just need a string that when hashed produces the same hash as the password e.g. the hash of "insecurepass123" has a hash of 79054025255f, which is the same hash as "%AZQ%ɟr7<[؂>1V4[m6S49cH͠3BW".

If you know the hash is, either will match the hash.

bertil• 7 years ago

This is every day now, right? Is anyone tracking those regularly? Less the passwords (haveibeenpwd does that well) than the executives? Does anyone loose their job over this? What does the email asking the engineer who rung the alarm to get lost read like?

rolltiide2• 7 years ago

Well the reporting of the breaches is more strange than the fact they happened.

A platform like StockX should be a continual breach, because the information will let you make advantageous trades and time series against the customers.

Its pretty dumb to even announce a past tense on this as if it was a single event.

joshu• 7 years ago

a time series of... shoes?

maxdata2• 7 years ago

I very nearly worked there in their engineering department, but once I got through the initial HR interview into the technical stuff, there were so many red flags that I got outta there as soon as I could.

A few higher level people who were all let go with me ended up going there, and having met up with them a few times, I've heard some absolute horror stories about everything ranging from dev workload, to security, to extremely unqualified devs being hired to fill seats.

I'm not surprised by this in the least, and frankly, I'm surprised it's not worse.

throwawayfoc3• 7 years ago

This is endemic to the FoC. When your entire team is recent boot camp grads, this is the end result. The engineering culture is a joke. (Source: former employee.)

maxdata2• 7 years ago

I'm a current employee in the FoC (just not StockX), and with more than a decade in software development, I am easily the least experienced on our team by several years.

bagels• 7 years ago

What is "FoC"?

gist• 7 years ago

there were so many red flags that I got outta there as soon as I could

Instead of joining the bashing party and lieu of making a broad statement why don't you detail what some of those red flags were?

PopeDotNinja2• 7 years ago

I had a similar experience, but I made the mistake of taking the job. I spent several months in denial about how smart people who act so... not smart. At one point, I asked the CTO for guidance on how to work with the team architect whose feelings I kept hurting. For example, I wrote a constructor for a class, and the architect asked me what "def initialize" was for, and got upset when I asked if they knew how OOP in the language worked. Another time they asked me for help on a weekend to figure a null pointer error on a machine that wasn't running the software they were trying to debug, and got upset when I pointed that out. I brought up both examples to the CTO. The CTO pointed out that the Architect had 10 more years of experience than I did, and while I might be right, I probably wasn't. Then the CTO said (direct quote) "you have delusions of grandeur about your technical abilities" to my face. I started looking for a new job immediately after that conversation. After I left, I heard the project got canceled, the architect got promoted, and they were hiring devs straight out of bootcamps because they couldn't attract anyone with experience.

pgm87052• 7 years ago

I used to work closely with Quicken Loans and other FoCs and can attest that this behavior is commonplace. There is this strange culture within the Family of Companies where non-tech leaders think that tenured Quicken engineers and tech people are these sort of super-geniuses. Many years back I was a part of a company in the Quicken led start-up space. We were often "encouraged" to meet with Quicken or FatHead senior engineers for advice. One time I reluctantly agreed and met with "the best programmer in Michigan" who's first piece of advice was:

"Delete your app and start over. Ruby on Rails is trash. Real programmers use C#. With C# you can create libraries that you can reuse across all your apps."

alephnan5• 7 years ago

Sounds like you dodged a bullet.

Did you end up working at another Fashion-Tech company? I'm curious how much of this is characteristic of Fashion-Tech industry in general.

throwawayfoc3• 7 years ago

I used to work at a Dan Gilbert Quicken Family of Companies company, and I am not the least bit surprised by this, especially the abysmal choice to use MD5. Let’s just say, the engineering chops across the family of companies is... mediocre, at best.

40acres• 7 years ago

Discussions regarding use of MD5 hashing is missing the point, Capital One and Equifax had plain text data exposed. The hashing strategy is irrelevant.

bootlooped• 7 years ago

We're talking about poor security practices that lead to increased risk to consumers right? Doesn't hashing fall within that? I didn't see anybody claiming that was the only factor, it's just one that stick out.

txcwpalpha6• 7 years ago

"Discussing one company's bad security is irrelevant because a totally separate company had even worse security"?

I don't see where you're coming from at all.

UncleMeat2• 7 years ago

There are two topics that are HUGELY overrepresented in discussions of computer security: password complexity and password hashing.

MD5 hashes is not good. But it also isn't catastrophe level security. If you aren't reusing passwords then the hashing choice doesn't matter since the system has already been breached. If you are reusing passwords you don't exactly want to rely on bcrypt hardness to keep you safe.

If I could make the web services I use switch to MD5 hashes and spend more time on other relevant security posture, I'd very seriously consider that.

harrygallagher4• 7 years ago

I got an email 3 days ago asking me to reset my password due to "system updates" and initially assumed it was just a phishing email. Since gmail is pretty aggressive about filtering those I looked into it more and realized it was genuine which made me even more confused because I couldn't imagine what sort of "system updates" they could've done that would require a password reset for all users. I kind of assumed they were covering up a breach so I wasn't at all surprised to see this headline. How scummy.

mattnedrich• 7 years ago

I had the same reaction to the email

aarbor989• 7 years ago

I thought the same thing when I received it. However, at the end I gave them the benefit of the doubt that perhaps they were migrating from one hashing algorithm to another and decided to just reset everyone's password in the process. Lying about the breach entirely is so shady

alephnan5• 7 years ago

I expect a lot of downvotes for this post from people who have not had experience working with people in fashion.

Investors should be weary of people from the fashion industry. I say this as someone who has both a computer science degree and a fashion design degree, and 90% of my friends were in the fashion industry at some point. Coming from tech, you'll find people here are much flakier and just unreliable. In the NYC fashion scene in particular, people have huge egos and they don't always act out of pragmatism or logic. The tendency to keep up appearances manifests itself in many ways. Look at Barney's, it appears great on the outside, but recently considered bankruptcy before receiving a capital injection.

Recently, I went into one of the top streetwear brands in the world, a staff member tried to start a fist fight with me after a piece of paper fell out of a hat, and I refused to pick it up and told them to screw off after the guy tried to disrespect me in front of my girlfriend. I've never been to a retail store where a staff member told a customer "meet me outside p___y", but that is the nature of streetwear culture in NYC. In case you aren't aware, these streetwear stores in NYC have BOUNCERS. Let that soak in. They're just accustomed to bullying customers because people are so desperate to buy clothing that they are willing to put up with the nonsense. They particularly like to single out mainland Chinese who don't realize (or maybe don't care) when these staff are disrespecting them, and, since I'm Asian, the guy who picked the fight thought I would not stand up for myself. If you want more examples of ridiculousness of streetwear, search "ym bape compilation" on YouTube. This dude loves the clothing brand called "Bape" and goes around and assaults everyone he sees wearing the brand Supreme.

There's economic demand and money to be made here, but just know the demographic you're dealing with. The customers and investees are of the same thread. I'm looking to start a fashion tech company myself, and aren't intimidated by potential competitors considering how disjoint these two worlds are, both network-wise and culturally. The typical engineer won't see the value of all this vain-ness, and people in fashion business aren't always the most reasonable people. A UX designer I work with recently told me a story of how they were redesigning a website for a top fashion brand, and the brand requested they make the shopping experience as UN-usable as possible and difficult for people to actually make a purchase (but it works I guess). At any rate Investors, find a leader who can bridge that gap while still being able to attract engineering talent.

Don't get me wrong, you can fund leaders in the FashionTech who are completely unreasonable, and even incompetent, but the company will still do well since product-market fit and demand will outstrip all other factors, until something like this happens. One of my professors owns a set of retail stores in NYC that was acquired by one of the largest clothing manufacturers in the US, but they did not know a single thing about accounting, business operations, engineering, and non-artistic things. Super unreliable, super unprofessional professor but they had a really good intuition for branding.

Luxury brands, corporations (Adidas, Nike), and the LVMH conglomerate are a slightly different story

omarchowdhury3• 7 years ago

Whose hat did the paper fall out of?

alephnan5• 7 years ago

The store's. I put the hat on while I continued shopping. I had every intention of buying the hat, but apparently the paper fell out. The employee came to me fist-clenched, with a fighting tone. I'm sure you're skeptical and think there's two sides to every story, but I don't want to expand too much on the story for privacy and retaliatory concerns. I invite you to come to SoHo, NYC and visit a few stores if you have any doubts.

carti• 7 years ago

This comment plays into some awful streetwear stereotypes. "ym bape compilation" is about as representative of streetwear as a video of Raiders fans rioting is representative of professional sports, if not less so. Sure, there are some assholes. Where aren't there?

I think the sort of behavior you describe can happen with any sort of niche or exclusive retail. It's not particularly fair to single out streetwear here, which already has a negative stigma in many circles.

I'd assume the bouncers would be there primarily to prevent shrinkage. Seems reasonable to have people around to ensure running off with hundreds of dollars of clothing is less attractive of a proposition. Sorry you had to deal with that confrontation either way, though.

I'm curious how much of the flakiness attributed to fashion applies to other arts or arts-adjacent areas.

albertshin• 7 years ago

Can't believe something like this (md5) wasn't flagged during tech diligence by any of their investors (GV, General Atlantic, Battery, DST Global, etc)...

CPLX• 7 years ago

The interesting part to me was that this happened in May, and they closed $110MM in funding a month ago. That could explain quite a bit.

StockX was hacked, exposing millions of customers’ data

Related Stories