Important Customer Security Announcement

http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html

by driverdan • 13 years ago

205 103 13 years ago

blogs.adobe.com

nutjob123• 13 years ago

Much more interesting than the customer data: "We are also investigating the illegal access to source code of numerous Adobe products". In the linked blog post they say: "Adobe is investigating the illegal access of source code for Adobe Acrobat, ColdFusion, ColdFusion Builder and other Adobe products by an unauthorized third party"

kunai2• 13 years ago

It's about time. I hate to be one to advocate piracy, but this massive leak of source was something that we needed desperately.

It's illicit, but it will help free software and reverse engineering in a huge way. Adobe doesn't deserve to manipulate its users with CC like it's doing right now.

conductor• 13 years ago

We can expect more 0-day exploits for Adobe Acrobat.

drone2• 13 years ago

Wait, so Adobe doesn't deserve to make decisions about how it wants to sell its products? I'm confused here - are you advocating that companies give up control over their own delivery mechanisms?

We can argue as to whether or not we like their products, value their products, or receive in return for payment value greater than or less than the price of their products, but it seems to odd to say they shouldn't be able to make a decision about how they choose to sell them?

watty• 13 years ago

Manipulate? They're a business who is making big boy business decisions. If you don't like their products don't purchase them. They don't have a monopoly, they simply have good products.

atlanticus• 13 years ago

Internet hippies are like locust, except they want their data private.

mhurron• 13 years ago

Anything made resembling reimplementation of Adobe's stuff by anyone who sees this will be tainted. It would most likely leave not the individual developer open to legal actions but the entire group and project they were working with would be at risk.

You would have to be something of an idiot to look at this if you intend to have anyone ever look at anything you code in the future.

ElliotH• 13 years ago

Any OSS project would be killed dead by the use of stolen source code. There's a reason projects like Wine and ReactOS have to be so careful you know.

bcn• 13 years ago

More details from Brian Krebs' blog post - http://krebsonsecurity.com/2013/10/adobe-to-announce-source-...

  "KrebsOnSecurity first became aware of the source code leak roughly one week ago...with fellow researcher Alex Holden...discovered a massive 40 GB source code trove stashed on a server used by the same cyber criminals believed to have hacked into major data aggregators earlier this year, including LexisNexis, Dun & Bradstreet and Kroll."

  "The hacking team’s server contained huge repositories of uncompiled and compiled code that appeared to be source code for ColdFusion and Adobe Acrobat."

iamshs• 13 years ago

so adobe was not aware of the internal breach until then? Edit: They were.

keyle3• 13 years ago

Well good luck to them with the source of Acrobat and PDF reading/writing.

I'd rather obtain minified javascript.

spoiler• 13 years ago

Well, it might finally shed some light in the Mayan/Inkan/Aboriginal, or just plain out cryptic and esoteric secrets of why the hell the PSD format is so inconsistent and annoying to work with!

dismiss21x• 13 years ago

Not sure if you're trolling... What are you talking about?

mratzloff• 13 years ago

So they were looking for ways to 0-day ColdFusion and Acrobat.

pdknsk• 13 years ago

encrypted passwords

Somewhere, oclHashcat makes room temperature rise.

ibstudios2• 13 years ago

No word on whether or not they encrypted passwords? ...Sigh.

bstrand• 13 years ago

"Our investigation currently indicates that the attackers accessed Adobe customer IDs and encrypted passwords on our systems."

ibstudios2• 13 years ago

Thanks!

cheald• 13 years ago

Start using LastPass and generate random unique passwords for everything you do online. They are now as good as encrypted even if the vendor stores them in plaintext.

aroch• 13 years ago

This quote from the Krebs post is both laughable and horribly saddening. Even Adobe can't manage to keep Adobe software installs up to date

Arkin said the company has not yet determined whether the servers that were breached were running ColdFusion, but acknowledged that the attackers appear to have gotten their foot in the door through “some type of out-of-date” software.

slowdown5• 13 years ago

This sucks, especially considering the fact that I just made a purchase a few hours ago :/

mongol• 13 years ago

Then you are probably lucky since the intrusion likely was earlier than that.

ChikkaChiChi• 13 years ago

Less than 1 year into forcing their users to 'The Cloud' for future updates, Adobe has proven incompetent at protecting our data (and even their own).

I feel particularly bad for the design houses that have entrusted Adobe with their intellectual property because it was supposed to be safe who now have to rethink how safe their assets really are.

tigerweeds• 13 years ago

Maker of the most insecure end-user software in human history gets hacked. Karma, it is a bitch.

zapt02• 13 years ago

This is huge.

keyle3• 13 years ago

We need some technology that makes our Credit Card numbers change every few days.

I am shocked that most people think it's OK these days to drop the "Oops, nasty baddies bad bad got in and there goes your details, so so sorry, come again."

If this happens to some small startup with the one PHP nerd that doesn't really know what he's doing (and is underpaid anyway) - that's fine. Or at least acceptable. You're living on the edge.

But a Fortune 100 company... COM'ON.

keyle3• 13 years ago

Is there a site that tracks all the hacked companies?

This needs a ladder of shame. If we don't shine the light on this, things just won't get better.

elliottcarlson2• 13 years ago

http://datalossdb.org/

tlrobinson• 13 years ago

Some credit card companies let you generate expiring CC numbers for specific purchases, but that's a lot of work, and wouldn't work for recurring purchases (like Adobe Creative Cloud)

nivla• 13 years ago

Some credit card companies let you generate expiring CC numbers.

I know Citi Credit card lets you do that.

and wouldn't work for recurring purchases (like Adobe Creative Cloud)

It could. If I remember correctly, Citi card lets generate three types of Virtual Cards. One based on the expiration (less than a month), another based on the maximum amount/balance (where expiration is about a year) and finally a combination of both.

Virtual credit-cards are real handy especially when trying those 30 day trial services.

pbhjpbhj• 13 years ago

Why doesn't it work the other way around. That Adobe send your bank account a signed money request (with a verification code retained on the Adobe end so even if private keys were taken the abusers would need to currently own the server in order to maintain the pretense of having issued a request).

Then you go through the requests in your account and allow those you wish.

Like a sort of reverse Direct Debit/ Standing Order.

Simucal• 13 years ago

I think that some banks let you generate temporary credit card numbers to make online transactions which you can disable at any time.

drawkbox• 13 years ago

Indeed, we need a ticket system for custom tokens per merchant. So instead of actually putting in the credit card number, you put in a token (very similar to an oauth type token).

If say for instance the token you gave to Adobe gets stolen, you or they just disable all tokens or ask for new tokens.

So not only will fraud be more difficult but merchants also will be known who has been compromised. Right now banks won't always tell you what merchant was compromised and causing you to get a new number/card.

New payment systems have this, for instance stripe is built similar to this.

Why do people have to update all their cards with all their merchants after one fails? Getting multiple cards and internet cards sometimes helps compartmentalize but really we need this at least per merchant.

Some banks have this like Bank of America ShopSafe but it should be the new normal.

mmanfrin• 13 years ago

This is actually how a lot of merchants work -- they send CC info to a bank or processor, and get back a token they can use to charge that CC (without having to store CC information). Why Adobe didn't utilize this is beyond me.

mrtksn• 13 years ago

In Turkey, we have these things called virtual credit cards. You basically log in into internet banking, click a button to generate a new card, it shows up instantly, then you define how much limit it would have and you are ready to use it. For convenience you can use that card many times, just reset the limit or you can create new one if you wish. It's really good, I use it every time.

mikeash• 13 years ago

Why do you care?

Seriously, I don't get it. At least in the US, card holders have zero liability in these instances.

If your card number got leaked and is used to make a fraudulent purchase, simply report it to your card issuer. They will reverse the charge and issue you a new card number.

The paranoia around card numbers for consumers is crazy. There's literally no risk. It makes sense for merchants because they bear risk, but I don't understand why cardholders get upset.

6thSigma• 13 years ago

It's a combination of uneasiness that someone was attempting to steal from you and you have to do work to remedy the situation.

Osmium• 13 years ago

We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders. At this time, we do not believe the attackers removed decrypted credit or debit card numbers from our systems.

Well that's reassuring(!) If these hackers were so "sophisticated" then presumably they could have obtained Adobe's decryption keys too? If not, why not?

Guess I'll have to phone my bank tomorrow... hope they don't charge me for the new card. Oh Adobe...

Edit: It just occurs to me that people with pirated Adobe software aren't having any problems right now. The same argument could be made of any service, of course, but at least with the old way of purchasing Adobe software (vs. Creative Cloud) Adobe didn't have to store your credit card number for an extended period of time. I don't think this excuses piracy, but it's not going to do anything to discourage it.

zmmmmm2• 13 years ago

At this time, we do not believe the attackers removed decrypted credit or debit card numbers from our systems

That sentence is disinformation. It carefully leaves unanswered the question of whether the encryption keys were stored in a location accessible to the attackers. The only reason to use that kind of language is to try and confuse everybody into believing things are not as bad as they would otherwise look.

x0054• 13 years ago

At this time, we do not believe the attackers removed decrypted credit or debit card numbers from our systems

That sentence also suggests that Adobe DOSE store decrypted credit or debit card numbers, but the hackers did not get to that database... yet.

davvid• 13 years ago

We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders

On first reading I had a split-second where I thought the attackers did everyone a favor by deleting the data; e.g. "drop table customer_financial_data". Unfortunately they meant the ~other~ kind of "removal". I think "obtained" would have been a better word to use here (instead of "removed").

wglb• 13 years ago

Exfiltrated.

Udo• 13 years ago

It's like this Hollywood trope where data can only ever be moved - not copied. Come to think of it, that's essentially what the MPAA believes, too.

jrockway• 13 years ago

Too bad the hackers were looking for credit card information and not their DRM master keys.

ddalex• 13 years ago

Fucked if they do, fucked if they don't. If it wasn't encrypted, why were they so stupid ? If it's encrypted, fuck them too.

This shit happens. To EVERYBODY, sooner or later. What makes a difference is how to handle it. I say Kudos to Adobe for storing encrypted data, being open and owning it up, and trying to fix what's been messed.

jere• 13 years ago

I love how I have no emails from Adobe today except for Creative Cloud advertisements. Thanks.

unclebucknasty4• 13 years ago

No emails here either.

Hmm. Maybe the fraudsters literally took the data. As in, Adobe no longer has our email addresses with which to notify us.

It may as well be that ridiculous.

Samuel_Michon3• 13 years ago

certain information relating to 2.9 million Adobe customers

It would be nice to know how many user accounts Adobe manages, so that I can better estimate the likelihood of my accounts being affected. If they only have 2.9 million accounts, I should be worried; if they have 100 million accounts, I should still worry but perhaps a little less so.

I have not (yet) received an email from Adobe regarding this latest attack, but I have an Adobe Creative Cloud subscription as well as several Typekit accounts. I use 1Password to generate passwords, but of course that doesn’t protect my credit card information.

slowdown5• 13 years ago

As a customer who just made a purchase from Adobe a few hours ago, I feel good and horrible at the same time. I feel good that their source code was stolen (I will explain why). I feel bad that my credit card was compromised.

Around November 2011, Apple screwed up one of it's premier softwares (Final cut pro) and Adobe jumped right in and offered a 50% discount to all of its Creative suites (version: 5.5). Their pitch then was - "Apple screwed up, try ours and hey, if you buy the suite, it's yours forever and you get peace of mind". And so I bought the Windows edition of one of their suites. A year later, CS6 was announced and I decided to wait for sometime before upgrading. Just to be clear, I shelled out almost $1000 on the CS 5.5 version.

In the last few months, I made the switch to a Mac and I found out that my license for Windows wouldn't work on a Mac. Fortunately, Adobe seemed to provide a "crossgrade" path, wherein I can just swap my platform at no additional cost. Sounds good? No. Except that you can't swap from an older version (CS 5.5) to a newer version (CS 6). You can only switch between platforms of the two same versions. Okay, that's in a way fair enough, since it's been over a year anyway and it's time to upgrade. So, let me just upgrade to CS6, I thought.

This is where it started to get messy. I searched for links to upgrade to CS6, and I did find a few. But they all re-directed to the stupid Creative Cloud edition. WTF?

[1] http://www.adobe.com/mena_en/products/creativesuite.html‎

I searched and searched and finally found a link that worked. I placed an order and 24 hours later, my order was cancelled for no reason. I had to search for that link I found earlier, again. After giving up finding the link, upon contacting customer support, I was tried to be pushed into the stupid Creative Cloud platform, again.

    Support: Based on what we have discussed I highly recommend that you purchase Creative Cloud which includes Photoshop CC for images, Indesign CC for print design, Illustrator CC for graphics, Flash Pro CC for animations, After effects CC for adding effects and plus more.
    Support: Plus you will get all the upgrades and updates for free of cost.
    Support: You can install CC on 2 system both on mac/ Windows.
    Support: I am sure CC will meet all your requirements.
    you: Oh no thank you, please. It doesn't fit my budget. Once I stop paying, everything is gone, unlike in the case of a CS 6 install.
    Support: I do understand your concern, however, going forward there is no upgrade path available since CC is replaced by CS6.
    (WTF)?

    you: Do you mean to say, that I can't upgrade from Cs 5.5 to 6?
    Support: The upgrade path from CS6 to CS7 is not available, since CC is replaced by CS7.
    you: Yes, I understand that.
    you: I don't need CC ma'am, really.
    you: It doesn't fit my needs.
    Support: That's okay.
    Support: Let me provide you with the link to upgrade to CS6 production premium, okay.

(Finally!)

It's funny I had to spend so much time with support to purchase CS6, since Adobe clearly conveys that it intends to sell CS6 indefinitely. [2]http://www.adobe.com/products/cs6/faq.html

Even though the support person gave me the link to buy CS6, I thought it would be a good idea to probably re-consider CC again. So I checked on the Creative Cloud page to see if I could just pay $45 for say, about two months and later upgrade to CS6. But, again, Adobe tries to backstab its users. IF you cancel your CC subscription before 1 year, you will be billed 50% of the total amount (50% of ($45x12)) as a penalty. WTF?!! So, basically they want to beat their users to the ground as much as they can.

I decided to try alternatives, because I really wanted only a good Photoshop-like program and nothing else more (at that point). So, I searched, but I couldn't find. Now, this is highly deceptive on Adobe's part because they play a monopoly role clearly and they decided to backstab their users all of a sudden.

There is no easy way to buy CS6, there is no easy way to subscribe to CC for just a few months and the calculations they demonstrate are also deceptive at best. CC is more expensive than the boxed product.

One of my friends is a blogger, he has a huge follower count. Adobe contacted him and gave him a free 1 year subscription to CC. I was curious and I found a lot of bloggers reporting the same. One thing that was common in most of these Adobe contacted bloggers' posts, was how their stress to explain how the CC version was effectively cheaper than their boxed version.

So basically Adobe is indirectly bribing bloggers to write good stuff about their CC subscription.

Adobe's CEO is an incompetent backstabber who is totally fit for nothing. This was the same guy who argued with Steve Jobs that Flash on mobile rocks and later discontinued it. Backstab #1. I was a Flash developer previously. I was even jobless for a few days because I relied so much on this technology.

Adobe's CEO also backstabbed the much capable Flex eco-system. Do you know how many Flex developers are jobless now? Backstab #2.

And the Creative cloud (CC). Backstab #3.

That is why I feel happy that their source code was stolen. I was a genuine customer amongst a million others who just wanted to pay ONCE to use my software. I could have pirated like many others, but I didn't. I trusted them. But they took a U turn and decided to shoot us in the back.

Also, this guy is never straightforward: http://gizmodo.com/5984191/adobes-ceo-completely-refuses-to-...

This guy is incompetent and needs to be replaced. Atleast someone should file a class action suit for abusing their monopoly.

Samuel_Michon3• 13 years ago

Around November 2011, Apple screwed up one of it's premier softwares (Final cut pro)

I understand why you would say that, but I don’t agree. At the time, I used Final Cut Pro 7 daily and when Final Cut Pro X was released, I didn’t immediately switch to it. I waited for multicam editing and XML export, and Apple delivered. That’s when I switched to Final Cut Pro X and it was a great improvement over version 7. When Adobe came up with Creative Cloud, I signed up. That meant I got Adobe Premiere as part of the package, but after trying it, I still much preferred Final Cut Pro 7. Comparing Premiere and Final Cut Pro X, for me, it’s not even a contest. With Final Cut Pro X, I’m way more productive than I ever was in FCP 7, Avid, Premiere or Media100.

Apple could’ve done better by offering the first few releases of FCP X as a free beta, but right now, FCP X is a way better product than FCP 7 ever was.

slowdown5• 13 years ago

My argument is not about which of the two companies' products are better. Probably Apple's is better, but the creative suite at a 50% off was a deal not to be missed for me at that time (It included Photoshop, Illustrator, After Effects, Premier and Audition)

estel2• 13 years ago

there is no easy way to subscribe to CC for just a few months

Isn't that what the monthly plan does [0]? $75 / month rather than $50, but with the option to only pay for individual months. I think they said they were originally thinking of freelancers who might only take on work that involved using CC a few times a year.

[0] http://www.adobe.com/products/creativecloud/buying-guide.htm...

slowdown5• 13 years ago

$75 a month is pretty expensive for many freelancers and the only reason I considered CC in the first place was I got a 40$ discount of $30/mo, but again the penalty applied, so I didn't buy it. Sorry for not mentioning this in the parent post.

MarkMc• 13 years ago

I understand you feel cheated Adobe, but I feel the need to present their side of the story.

But, again, Adobe tries to backstab its users. IF you cancel your CC subscription before 1 year, you will be billed 50% of the total amount (50% of ($45x12)) as a penalty. WTF?!! So, basically they want to beat their users to the ground as much as they can.

What you call 'beat their users to the ground' I call 'charge fees which maximise their profit'. They are not being deceptive - their price list clearly states, "Requires annual commitment; billed monthly" [1]

There is no easy way to buy CS6

If you Google "buy adobe cs6" the first result [2] allows you to buy a CS6 'Master Collection' licence for $2,599. Just click 'buy' then 'Add to cart'. Seems pretty easy to me.

there is no easy way to subscribe to CC for just a few months

Not true - as pointed out by estel, you can easily subscribe for $75 per month. I think by 'easy' you mean 'cheap'

the calculations they demonstrate are also deceptive at best

Can you provide a link to the deceptive calculations? Because to me the price list [1] seems to be fairly straightforward and honest

CC is more expensive than the boxed product.

Doesn't that depend on how long you use the software for? You can buy a single month for $75 - I doubt that you can get the boxed product for cheaper than that.

One thing that was common in most of these Adobe contacted bloggers' posts, was how their stress to explain how the CC version was effectively cheaper than their boxed version.

If it is true that Adobe implicitly says, "write good things about us and we'll give you free stuff" then I agree that this is pretty bad behaviour. (But if they say, "here is some free stuff, please write good things about us" then that would be OK as long as the blogger notes in their review that they had received the free stuff.) The fact that bloggers who received free stuff had previously wrote good things about Adobe is not sufficient to convict Adobe of indirect bribing. It could be that the bloggers who did not receive free stuff also wrote good things about Adobe (ie. their products are generally viewed positively)

Backstab #1. I was a Flash developer previously. I was even jobless for a few days because I relied so much on this technology…Do you know how many Flex developers are jobless now? Backstab #2.

It sucks to lose your job, but is it really 'backstabbing' for Adobe to drop support for a platform they developed? For all software I expect the companies who develop it to say "this is a great product and we fully support it" right up until they day they drop that support. It's not like Adobe said, "we will support this product until at least 2015".

[The CEO] is never straightforward...This guy is incompetent and needs to be replaced.

Personally I think it is very straightforward to say, "I refuse to discuss our pricing strategy with you". But in any case the CEO's job is to maximise profits - and using the strength of Adobe's market position to charge nosebleed prices sounds to me like he is doing just that. Not at all incompetent.

At least someone should file a class action suit for abusing their monopoly.

It's not necessarily illegal to have a monopoly and charge a very high price for your products.

[1] http://www.adobe.com/products/creativecloud/buying-guide.htm...

[2] http://www.adobe.com/products/catalog/cs6._sl_id-contentfilt...

chestnut-tree• 13 years ago

Some naive questions from someone who genuinely doesn't know: how is it that a company cannot detect when someone downloads a giant database of sensitive personal information from their servers? Surely, there are ways to monitor access to this data and immediately flag suspicious behaviour? How do the intruders even find the location of this data and then download it? Isn't there some best practice security measures that can prevent of all of these things? I presume Adobe failed at all of them?

seiji• 13 years ago

You'd be surprised how little companies know about what their networks and applications (and intruders) are doing.

drone2• 13 years ago

how is it that a company cannot detect when someone downloads a giant database of sensitive personal information from their servers? Surely, there are ways to monitor access to this data and immediately flag suspicious behaviour

There are classes of products related to this specific task, generally we call them "DLP" or Data [Leak|Loss] Prevention.

What we don't know, is how the information was transferred from the servers, and how much different that traffic looked compared to normal activity. It's easy enough to catch a credit card number flying through a plain HTTP packet over the network in the wrong direction, but it gets much harder when the party trying to transfer that data is intentionally attempting to avoid detection.

Isn't there some best practice security measures that can prevent of all of these things

Yes, but none of them are perfect, and even if they were, they would require perfection from human operators. (Perfectly configure, maintain, monitor, etc.) And, of course, they assume you can identify a threat before it leads to compromise.

petercooper• 13 years ago

Could this result in a huge fine or penalty, not least due to potential PCI DSS violation? Here in the EU, it'd be a big data protection issue as well.

coldcode• 13 years ago

How does source code leak in such an attack? Why would customer facing servers and databases share a network with a code repository?

zmmmmm2• 13 years ago

That's kind of a scary part to it. Large organisations don't colocate code and credit card numbers. They carefully segment things and isolate them to completely separate silos in completely unconnected systems.

So I would infer that the attackers obviously had access at a very high level, probably compromising the credentials of someone very senior with very high privileges. Which in turn means they could almost certainly have compromised the encryption keys and would be most likely to do so before downloading the actual CC data.

eksith• 13 years ago

I was told repeatedly that I was a sucker for buying Adobe products (I own CS3 and never found it necessary to upgrade) instead of pirating. Well, I'm conflictingly feeling like a sucker.

Conflictingly because my CC info has since expired, but other personal data would still be in their records. I wonder how far back they keep those, but I guess I'll find out soon enough if I'm in the lot.

Edit: If anyone is worried about the source getting leaked giving rise to 0-day exploits and the like, you can at least move away from Reader into something like Sumatra PDF (open source). If all you need is a reader, it's a very handy alternative and far more nimble with resources (no I'm not part of their project. I'm just a very happy user)

elwell• 13 years ago

Well if the cc #'s were encrypted at least half as esoterically as the PDF file format, we have nothing to worry about.

plg• 13 years ago

I wonder if this is why my university IT dept just broadcast an email saying that Adobe is "auditing" every computer on campus for the university's site license. They want to come into everyone's office and labs and run some "script" on every machine that does who knows what. Needless to say I said "no thank you".

bitserf2• 13 years ago

Well, pretty happy I bought Lightroom through Amazon right about now.

Reason: Adobe charges basically double the US price in Australia/NZ if you buy from them directly, and I refuse to pay a location tax since it costs them zero dollars extra to send me bytes through CDNs.

jestar_jokin• 13 years ago

Support staff and localised service centres still need to be paid for somehow. Also, sales staff, business liaisons, legal staff to deal with local laws and regulations, all the managers to manage them, etc. With a smaller potential userbase in Aus, they can't subsidise the support costs across as many people, so maybe that's why they charge more.

bitserf2• 13 years ago

Those are the Adobe responses to Australian government when queried about the discrepancy, correct.

Not sure how much localisation is required since Australia, like New Zealand, is an English speaking Western democratic country.

Pretty sure we could understand US vernacular and cultural differences.

Call it what it is: Discriminatory pricing because they think that is what the market will bear. Fine, but I feel free to work around it as well.

jlgaddis• 13 years ago

POSTED BY BRAD ARKIN, CHIEF SECURITY OFFICER

Time to dust off the ol 'résumé, Brad.

uslic001• 13 years ago

Just another reason for me to continue to despise Adobe. Thankfully I bought my version of Acrobat Pro on Amazon so they did not have my credit card, but still Adobe handed all my other information over to the hackers due to poor security practices. Thankfully I also had used Lastpass to generate a unique password for their site.

hunvreus2• 13 years ago

I used to pay for Photoshop and Illustrator too, until I realized Adobe was more interested in adding clutter-ware (Adobe Updater, anyone?) than trimming down and speeding up their monstrosity of a code base.

After a while on Inkscape I am now running with:

- Sketch (http://www.bohemiancoding.com) as a replacement to Illustrator (vector drawing).

- Acorn (http://flyingmeat.com/acorn/) as an alternative to Photoshop for bitmap design (though it now supports vector drawing, much like Photoshop).

I am not affiliated in any way.

richforrester• 13 years ago

1) Adobe Updater works fine for me now that they've got CC; lots more frequent updating.

2) Sketch/Acorn are not available on Windows.

Not saying you're wrong; just saying I disagree :)

hunvreus2• 13 years ago

The few times I got to play with Photoshop/Illustrator on Windows I felt the experience (performance, responsiveness etc) was overall better than on MacOS. Admittedly, I've owned mostly laptops since 2005.

unclebucknasty4• 13 years ago

Awesome. That's two breaches in one day from two different companies with which I've done business.

This is out of control. The bad guys are winning. Time for a new paradigm.

QuiteMouse• 13 years ago

I refuse to use the cloud services anymore. I may be using a version of Photoshop that is 4 years old, but it does the job and does it well. There are some new features that I'd like to have, yes, but it's a small price to pay when compared to having all your personal information compromised.

grogenaut• 13 years ago

Looks like not even adobe does the daily update / reboot requires when adobe software is installed.

ChuckMcM2• 13 years ago

I expect this sort of thing will be the ultimate death of 'cloud' computing in the sense Adobe and others would have you use that term.

There is tremendous "pain" here (both for vendors and for customers) which, if effectively addressed, could be the next Google or Apple.

simula67• 13 years ago

Can you please explain what you meant ?

Are you saying we need to create a cloud service that is completely secure ( which we know is impossible ). My understanding is that CloudFlare is already tackling the security aspects of hosted services and seem to be doing well.

donavanm• 13 years ago

My understanding is that CloudFlare is already tackling the security aspects of hosted services

Im curious; which aspects are they tackling, specifically? Authn, authz, byte validation... Or ?

ChuckMcM2• 13 years ago

Can you please explain what you meant ?

Sure, and note that my background has included secure systems design work.

Secure systems operate under a couple of constraints. It is as you posit, impossible to make a 'completely secure' system, just as it is impossible to make a 'completely safe' airplane (and the 'impossible' here means that such a system continues to be usable or commercially viable). But generally if you can make a 'secure enough' or 'safe enough' system, then you can still make a business out of it.

Using a fairly simple example, general residences in the US are not secured against experienced thieves, but in general experienced thieves aren't trying to steal things out of random houses, they go for specific houses. So the system "works" because you aren't getting broken into every day. And if the house next door is burglarized your house is no less secure than it was the day before.

But in a cloud system the thieves get tremendous economy of scale, rather than breaking into one house they can break into every house in the city. In that way even if you don't have 'much' if you have anything they can steal it.

Cloud computing both ties together high value and low value targets on the same system, and makes the total return of compromising the system higher in proportion to the number of users of that system. That is a real challenge because now everyone needs really really good locks on their houses, the costs go up and the usefulness goes down.

chmars• 13 years ago

Have you had success with your password reset?

I always get an error message:

The provided email address could not be matched to an account on file. Please try again.

Thanks to 1Password, I am pretty sure that the provided mail address is correct …

Havoc• 13 years ago

Adobe seems to be in the business of producing security flaws...

driverdan• 13 years ago

Why was the title changed from the informative "Adobe Accounts Hacked" to the useless and generic "Important Customer Security Annoucement"?

pirho• 13 years ago

Here's the email...

----------

Important Password Reset Information

To view this message in a language other than English, please click here.

We recently discovered that an attacker illegally entered our network and may have obtained access to your Adobe ID and encrypted password. We currently have no indication that there has been unauthorized activity on your account.

To prevent unauthorized access to your account, we have reset your password. Please visit www.adobe.com/go/passwordreset to create a new password. We recommend that you also change your password on any website where you use the same user ID or password. In addition, please be on the lookout for suspicious email or phone scams seeking your personal information.

We deeply regret any inconvenience this may cause you. We value the trust of our customers and we will work aggressively to prevent these types of events from occurring in the future. If you have questions, you can learn more by visiting our Customer Alert page, which you will find here.

Adobe Customer Care

Important Customer Security Announcement

Related Stories