Acer U.S. breached, addresses and credit cards exposed

Infinity · 06-20-2016, 01:15 AM

"Computer maker Acer has sustained a data breach at its U.S. e-commerce site, Acer.com, which could potentially affect anybody that bought from the website throughout the last year or so.

Based on a letter delivered by Acer to the California Attorney General’s office, the hack occurred over a year ago. Customers that used the site between May 12 2015 and April 28 2016 may have had their info compromised. This includes names, mailing addresses and credit card numbers."

http://zerosecurity.org/2016/06/acer-u-s...ds-exposed

Wildfire · 06-20-2016, 02:11 AM

How can a rootkit on the server of fucking ACER go unnoticed for nearly an ENTIRE YEAR? HOW!? I hope it was Umbreon or something difficult because that is honestly just purely ridiculous.

mothered · 06-20-2016, 04:36 AM

(06-20-2016, 02:11 AM)Axari Wrote: How can a rootkit on the server of fucking ACER go unnoticed for nearly an ENTIRE YEAR?

Exactly this.

The report on this Is current, yet brought to the attention of the general public a year later. In terms of the possibility of passwords being compromised, It should be safe to assume that they're stored In an encrypted form and obviously not plain text. Judging by Acer's security (or lack of), they'd probably be silly enough to store the decryption keys on the same server.

superMAUS · 06-20-2016, 04:43 AM

(06-20-2016, 02:11 AM)Axari Wrote: How can a rootkit on the server of fucking ACER go unnoticed for nearly an ENTIRE YEAR? HOW!? I hope it was Umbreon or something difficult because that is honestly just purely ridiculous.

the hackers must have put a . before the filename which would have hided it.

Wildfire · 06-20-2016, 04:52 AM

(06-20-2016, 04:36 AM)mothered Wrote:
(06-20-2016, 02:11 AM)Axari Wrote: How can a rootkit on the server of fucking ACER go unnoticed for nearly an ENTIRE YEAR?

Exactly this.

The report on this Is current, yet brought to the attention of the general public a year later. In terms of the possibility of passwords being compromised, It should be safe to assume that they're stored In an encrypted form and obviously not plain text. Judging by Acer's security (or lack of), they'd probably be silly enough to store the decryption keys on the same server.

Not only that, but if the attackers had access to the web server they could have simply installed a plaintext logger and sat on it for a year. I'd imagine it would have piled up pretty quickly.