Hacker steals 17M users' data from restaurant app Zomato(dailymail.co.uk)
dailymail.co.uk
Hacker steals 17M users' data from restaurant app Zomato
http://www.dailymail.co.uk/sciencetech/article-4518060/Hackers-steal-17-million-users-data-Indian-restaurant-app-Zomato.html
2 comments
In hindsight, what helped us contain the extent of the breach?
You didn't contain a breach. You're security was a joke.
You didn't contain a breach. You're security was a joke.
Wait, what?
A security researcher listed data they'd stolen through a security exploit on the dark web so they could bring it to your attention?
Am I the only one thinking this seems incredibly questionable on an ethical level?
What would he have done if you hadn't seen the data was for sale? Sold it to blackhats to exploit? Or spammers to take advantage of?
That seems like the 'researcher' was being a real sleazebag here. Forget ethical disclosure, this person is clearly going to be sued at one point or another with those sorts of practices.
Either way, sorry you went through this. Hope you learnt how to improve your security for the future after this debacle too.
A security researcher listed data they'd stolen through a security exploit on the dark web so they could bring it to your attention?
Am I the only one thinking this seems incredibly questionable on an ethical level?
What would he have done if you hadn't seen the data was for sale? Sold it to blackhats to exploit? Or spammers to take advantage of?
That seems like the 'researcher' was being a real sleazebag here. Forget ethical disclosure, this person is clearly going to be sued at one point or another with those sorts of practices.
Either way, sorry you went through this. Hope you learnt how to improve your security for the future after this debacle too.
It was clarified later that the "hacker" was a security professional who put up all that data on the Dark Web to draw Zomato's attention to loopholes in its systems.
http://blog.zomato.com/post/160986258541/security-update-wha...
Edit - Turns out the OP's article mentions the same thing. Might as well confess a personal bias - every time I see a Daily Mail article, I can't help but think about how they served as a Nazi mouthpiece for years before the war, so all their stuff's got to be inaccurate/biased.
http://blog.zomato.com/post/160986258541/security-update-wha...
Edit - Turns out the OP's article mentions the same thing. Might as well confess a personal bias - every time I see a Daily Mail article, I can't help but think about how they served as a Nazi mouthpiece for years before the war, so all their stuff's got to be inaccurate/biased.
> [Daily Mail] served as a Nazi mouthpiece for years before the war
> [Therefore,] all their stuff's got to be inaccurate/biased.
That conclusion doesn't really follow from the premise.
> [Therefore,] all their stuff's got to be inaccurate/biased.
That conclusion doesn't really follow from the premise.
Here's the more interesting part: As per some sources the data used MD5 with a 2(!) character salt.
EDIT: Here's some more info from Zomato's side: http://blog.zomato.com/post/160986258541/security-update-wha...