joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Detect hackers with Auth0 Actions and special accounts designed to catch them in the act.

Use Honeytokens and Auth0 Actions to Catch Malicious User Logins

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Sophisticated cars offer convenience for drivers but opportunities for hackers.



The thought of a hacker remotely seizing control of your vehicle sounds like something from a science fiction movie. But car hacking is not only possible today; it has been since 2005, [according to a computer science researcher](https://www.thetimes.co.uk/article/hackers-could-take-control-of-cars-and-kill-millions-ministers-warned-fx8gv5sk7?wgu=270525_54264_160313865012_90d48c3ac3&wgexpiry=1610914650&utm_source=planit&utm_medium=affiliate&utm_content=22278) from New York University. And many auto manufacturers may not be adequately addressing the growing threat of automotive cyberattacks.

In 2019 alone, automotive-related cyber incidents [doubled from the year prior](https://www.helpnetsecurity.com/2020/01/06/automotive-cybersecurity-incidents/) (a 605% increase from 2016). These include carjackings, data breaches, and even taking control of moving vehicles. But as Justin Cappos (the computer science researcher at New York University) told [The Times](https://www.thetimes.co.uk/article/hackers-could-take-control-of-cars-and-kill-millions-ministers-warned-fx8gv5sk7?wgu=270525_54264_160313865012_90d48c3ac3&wgexpiry=1610914650&utm_source=planit&utm_medium=affiliate&utm_content=22278), the potential threats are even worse than anything we’ve seen yet:

_“If there was a war or escalation with a country with strong cyber-capability, I would be very afraid of hacking of vehicles,” Cappos says. “Once in, hackers can send messages to the brakes and shut off the power steering and lock people in the car and do other things that you wouldn’t want to happen.”_

![Illustration of a car protected by identity management](https://images.ctfassets.net/23aumh6u8s0i/7c82zcQQIPJ41QeNalR9Pg/ac167eeae06822184d671672fc48fe2c/car-hacking-separator-1)

Considering [the rate at which manufacturers are adding connectivity](https://www.consumerwatchdog.org/sites/default/files/2019-07/KILL%20SWITCH%20%207-29-19.pdf) to their vehicles, this is concerning. Even more so considering that last year’s [2019 Synopsys and SAE study](https://www.synopsys.com/software-integrity/resources/analyst-reports/automotive-cyber-security.html?cmp=pr-sig) found 84% of manufacturers worry their current cybersecurity programs aren’t keeping up with the technology they support.

Simply put, manufacturers must take steps to improve automotive cybersecurity moving forward. Here are the most common ways that car hacks happen, as well as how manufacturers can better protect their vehicles from them.

## What Is Car Hacking?

Car hacking refers to all of the ways hackers can exploit weaknesses in an automobile’s software, hardware, and communication systems in order to gain unauthorized access.

Modern cars contain a number of onboard computerized equipment, including an electronic control unit (ECU), a controller area network (CAN), Bluetooth connections, key fob entry, and more. Many also connect to central servers through the internet. And each of these different computerized technologies can be attacked in a variety of ways.

## The Most Common Types of Vehicle Hacking

Today’s vehicles are more reliant on computers than ever before ([Forescout estimates](https://www.secmatters.com/blog/connected-cars-the-new-automotive-cyber-security-threats) that software in modern cars contains 15 times more code than what is in most airplanes). And as such, hackers have a number of points of access to break into a car’s systems.

So what kinds of cars can be hacked? And how?

The type of car hack depends on the kind of car. But [Upstream](https://www.upstream.auto/research/automotive-cybersecurity/) has cataloged every major car hacking incident in the world for the last decade and found several trends. Here is where its research indicates car companies should look to bolster their cybersecurity efforts.

### 1. Key Fob Hacks

The most common way hackers gain access to cars today is through the computerized key fob &mdash; often in order to steal the vehicle (or what is inside of it). This is typically done by spoofing or cloning the signal that a car and key use to communicate with each other.

[Researchers in Beijing](https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can-steal-car/), for example, were able to extend the effective range of a key fob (convincing a car they were close together) with just $22 worth of equipment that anyone can buy. And they were able to do so without the driver even knowing.

Other [security researchers hacked a Tesla Model S](https://www.wired.com/story/hackers-steal-tesla-model-s-seconds-key-fob/) using a cloned key fob, even though it’s supported by an extensive security team and uses encrypted keys (the encryption turned out to be the weak link).

While both of these were done for the sake of research, Upstream’s data shows a number of real, malicious occurrences of key fob hacking across the globe. Meaning it should be a top concern for automakers.

### 2. Server Hacks

Server hacks have the potential to be catastrophic in more ways than one, as breaking into a central server gives hackers access to everything: sales data, mobile apps, and even the controls of every vehicle connected to it.

“This can lead to multi-vehicle or fleet-wide attacks, which are extremely risky to all parties involved, from OEMs to telematics service providers, and companies who manage fleets to the drivers themselves,” Upstream mentions in its report.

While a large-scale attack on vehicle controls has yet to occur, researchers Charlie Miller and Chris Valasek [proved](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/) this threat was possible back in 2015 in [a piece by Wired Magazine](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/), when, from their couch, they stopped a Jeep that was traveling 70 mph on a highway.

Large-scale data breaches, on the other hand, have already occurred and have resulted in the exposure of millions of peoples’ sensitive data ([Toyota’s server breach](https://www.bleepingcomputer.com/news/security/toyota-security-breach-exposes-personal-info-of-31-million-clients/) in 2019, for example).

### 3. Mobile App Hacks

The [mobile app market has exploded](https://www.statista.com/statistics/276623/number-of-apps-available-in-leading-app-stores/) since its inception in 2008, when Apple first launched its App Store. The auto industry joined in [soon after](https://www.emarketer.com/Article/Auto-Brands-Put-Mobile-Front-Seat/1010011).

But while automotive mobile apps have been nice for consumers, the increase in their utilization has also given hackers new ways to access automobiles. And when hackers gain access to the information and control available in automotive apps, the results can be devastating.

For example, [one hacker](https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps) found that he could kill thousands of cars’ engines remotely through two GPS tracking apps (ProTrack and iTrack) by exploiting weak password protocols. And in another instance, a security researcher found that they could [control a Nissan Leaf’s functions](https://www.bbc.com/news/technology-35642749) using just the VIN number from the car’s windshield and the associated mobile app.

Here are four ways manufacturers can address these vulnerabilities and mitigate the risks.

## How to Improve Vehicle Cybersecurity and Prevent Automotive Hacking

Unfortunately, there is no one-size-fits-all solution for car cybersecurity. However, based on the most common auto hacking methods above, here’s what we recommend manufacturers do to secure their vehicles.

### Threat Detection

Car hackers have more ways to attack your car today than ever before (not to mention ways to hide those attacks too). So it’s critical that you’re able to detect suspicious activity at every vulnerable point before it turns into a breach (and a PR nightmare).

A great example of threat detection for car manufacturers is [Auth0’s anomaly detection](https://auth0.com/docs/anomaly-detection), which provides both brute-force and breached-password detection (both of which could have helped protect ProTrack and iTrack customers from L&M’s hacking efforts, for instance).

![Auth0 Anomaly Detection view in the dashboard](https://images.ctfassets.net/23aumh6u8s0i/6jjAE6Z4OdcCsrUuJgBziM/d2e3f07d4f08e41e5f7db5b6e59f5c2d/anomaly-detection)

This alerts you to any potentially malicious activity within your system that otherwise may go undetected. And it automatically blocks any unauthorized access that could result in a data breach.

### Simpler, More Secure Logins

Many of today’s cars come equipped with a number of remote control features (remote start, for instance). This list will likely only increase as manufacturers continue to increase the number of connected cars they produce.

However, each of these remote access points creates dangerous vulnerabilities if any of them are weak. So it’s critical to secure each one.

This includes improving the encryption on key fob radio frequencies. But maybe, more importantly, it means securing the logins and passwords to mobile apps and critical server access (which would help prevent major breaches like the iTrack and ProTrack vulnerability could create).

Features like [multi-factor authentication](https://auth0.com/multifactor-authentication) (MFA) and [biometrics](https://auth0.com/blog/tags/biometric-identity/) can help secure that access &mdash; and block hackers looking for a quick way in. With multi-factor authentication, for example, a user needs more than their name and password to log in. Access requires an additional credential, such as a voice snippet, thumbprint, or mobile device.

However, implementing these authentication features can often create a sluggish user experience. That’s why we created [Auth0 Guardian](https://auth0.com/multifactor-authentication), which streamlines this kind of authentication across devices and secures your systems while keeping authentication as lightweight as possible:

![Auth0 multi-factor authentication MFA option views](https://images.ctfassets.net/23aumh6u8s0i/4E1IUEcVcRf7M4ax0OsVlp/b486f11c63679a90771a90c45468389a/mfa-views)

Auth0 Guardian makes multi-factor authentication simple by removing the need for one-time codes. Instead, administrators download the app and approve login requests with the tap of a button. When you’re dealing with a high volume of login requests, Guardian makes the process more efficient, so you can focus on developing and distributing new features.

Regardless of how you go about it, though, it’s critical to confirm user identities at login in addition to monitoring their behavior once they have access. Without this layer of protection, it’s easier for dishonest users to enter a system and wreak havoc.

### Secure APIs

APIs are how different proprietary software systems integrate with each other. And as more automotive systems expose APIs for remote access through third-party software, it will be critical that these entry points be protected with modern authentication features to ensure that each one is protected from hackers.

One way to do that is by using the [OAuth Device Flow](https://auth0.com/device-flow/) &mdash; an emerging standard for securing cloud APIs that devices like in-car systems reach out to directly.

Device Flow extends browser-based authentication to input-constrained devices, allowing users to sign in to their accounts via a secondary device (such as a smartphone). This offers a secure and convenient way to ensure the right user is in control and lets developers integrate authentication features like threat detection and multi-factor authentication directly through other devices.

Device Flow is already used to authenticate people accessing their favorite streaming services sitting on a couch in the living room in front of the TV, for example. But it can also be applied to in-car systems that have limited input functionality (in-car infotainment systems that have cumbersome keyboard input, for instance).

![Illustration of a car velocity and acceleration panel](https://images.ctfassets.net/23aumh6u8s0i/6PP6wYQiUwf7gPwEijptaq/7ae783d181da9201d19fcfe16e2317d8/car-hacking-separator-2)

### Adaptable Cybersecurity Solutions

The auto industry is extremely dynamic. And to keep up with the changes that occur on the cybersecurity front, your systems for threat detection, authentication, and [identity management](https://auth0.com/) must be flexible enough to support your shifting business goals.

Your infrastructure should be able to adapt to changes like:

1. **New features.** These could introduce new entry points/vulnerabilities that you’ll need to address.
2. **New ways and places to use those features.** For example, some users may want to connect their cars to local Wi-Fi hotspots when they park at a restaurant, introducing a potential security threat.
3. **New ways, hackers can access automobile systems.** Hackers are always looking for weaknesses to exploit. So staying on top of any new developments in the automotive industry is critical.

However, when your IT team is busy with daily operations, it can be difficult to create systems that meet your current requirements and are also able to transform based on future priorities.

That’s where an outsourced identity provider can take the burden of keeping pace with evolving standards and threats off your shoulders. Auth0, for instance, offers its partners 100+ pre-built [Rules](https://auth0.com/docs/rules) and Extensions (along with the ability to write original code) that allow you to tailor your user management systems as your needs change.

Rules can enrich user profiles, notify other systems via an API when a specific login occurs, deny access to a white list of users, and more. For a full list, see [here](https://auth0.com/docs/rules).

## Manufacturers Must Lead the Way

While the modern connectivity features of today’s cars are a wonderful thing, it also means vehicle security is a lot more complicated than remembering to lock the doors these days.

There are a whole host of vulnerabilities that the average consumer simply cannot secure. And as a result, it’s up to manufacturers to step up and lead the way.

Auth0 has helped companies like Mazda secure their automotive systems from car hacking. Learn more about how Auth0 could help you improve your cybersecurity as an auto manufacturer [here](https://auth0.com/resources/videos/platform-introduction-video-2020?_ga=2.190916653.600445642.1602802150-1186272569.1602802146).  

<include src="asides/AboutAuth0" />


Car Hacking Is Real. Here’s How Manufacturers Can Combat It

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

A global community of ethical hackers brings new perspectives to the hunt for vulnerabilities



Of all the tools available to stock your app security arsenal with, we have to say — bug bounties might just be the hammer you’re looking for.

Modern application assembly bears only a passing resemblance to the historical development methodologies it inherited its DNA from, often leading to a sort of complacency when it comes to securing the dev cycle. If you determine that it is indeed time to scale your security to keep pace with your developers, consider what we at Auth0 did, we set up a bug bounty program and are already reaping the benefits.

Application development environments today more closely resemble an actual assembly line, with developers picking and choosing where to insert a pre-existing extension or module and where to build from scratch. It’s a lot like a build-your-own-bowl lunch place, where you make it your own by mixing the existing bases with just the right tasty sauce combo. Combine the conveyor belt model with a dispersed workforce of developers who may be sitting on opposite sides of a continent from one another, and you get a new and unprecedented workplace paradigm that puts collaboration front and center. 

Bugcrowd is working at the forefront of this new remote paradigm, blending that collaborative spirit with a crowdsourcing model to bring a diversity of perspectives to the hunt for exploits and vulnerabilities. 

## What Is a Bug Bounty and Who Is Bugcrowd?

TLDR &mdash; A bug bounty is when a company or app developer rewards ethical hackers for finding and safely reporting vulnerabilities in their code. And, [Bugcrowd](http://www.bugcrowd.com) is a company who provides this service through a crowdsourced security platform.

A few brief words about a word &mdash; “hacker.” If your only exposure to this word is based on media reports about data breaches, you probably have a negative image of who “hackers” are. In the world of bug bounties and app security, the word has multiple connotations. A hacker can be either good or bad. An ethical cybersecurity researcher, or an unethical bad actor. The researchers used by Bugcrowd are ethical hackers, meaning they’re using their security knowledge, deep curiosity, and coding skills to help companies like Auth0 secure their digital assets.

OK, back to our story.

A bug bounty program can be implemented by any company with a software product. Whether it faces the public or not, anything written with code and connected to a network can be broken into. Offering a bounty for ethical hackers/researchers to find and document these exploits is the best way to stop bad actors from finding and, well, exploiting them later.

That’s a bug bounty in a proverbial nutshell; now on to Bugcrowd. Their unique model combines traditional pentesting with a cutting-edge crowdsourced bug bounty program to quickly and effectively locate vulnerabilities in their client’s code. The crowdsourcing aspect is used to connect their client companies with carefully curated and vetted cybersecurity researchers from around the world who are ready to bring their individual perspectives to the project of zapping bugs.

Luke Stephens, Manager of Training and Quality Assurance for Bugcrowd, puts it like this, “Bug bounty programs aren’t just about accessing talent; they’re about understanding what your security posture looks like; when a motivated adversary shows up.” By bringing ethical hackers with a variety of backgrounds and a mixed set of skills together with a singular goal, finding the backdoors attackers use to wreak havoc, Bugcrowd sets the security bar that much higher by finding the exploits before the bad guys have a chance to.

## What Role Can Bug Bounties Play in Modern App Assembly?

As mentioned above, [the state of modern app assembly](https://auth0.com/resources/whitepapers/state-app-assembly-2020) is a far cry from the early days of software development. Rather than a piece of software being written and tested by a team of in-house developers from start to finish, today’s apps are an amalgamation of custom code integrated with pre-existing modules written by third-party providers. It’s like the way your burrito-sauce-mixed-with-sriracha creation brings out the tanginess in the adobo pork in that lunch bowl last week.

This model speeds up your development time, makes it very easy to iterate, and leads to a more familiar user experience; however, it also opens up a whole new world of security concerns. It increases the complexity of your attack surface, which now includes a constellation of third-party code and services. 

Consider an app that uses an IAM solution from one provider, residing on a PaaS (platform-as-a-service) from another, with a payment system from a third. This all sits behind a custom UI written in-house. That’s four discrete code sets, multiple programming languages, and untold possibilities for vulnerabilities to slip between the code cracks. Remember the heartburn that bowl gave you last week? Yeah, that.

A bug bounty program brings together researchers from around the world, each with their own unique background and particular expertise, and turns them loose on that amalgam. Your developers know their code, but how well do they know the code used in all those modules? The range of perspectives and specializations brought by a team of crowdsourced bug bounty hunters is unparalleled and means you stand a much stronger chance of vulnerabilities and potential exploits being found before an attacker can get at them. 

All of that said, bug bounties are not a one-and-done solution to all of your testing needs. A program like that offered by Bugcrowd forms one prong of a defensive, in-depth approach to app security. Traditional third-party pentesting still holds a place in the pantheon of security measures, and a solid IAM solution can still find its place alongside bug bounties in a mature security program.

> “Strong internal security practices and compliance need to be accompanied by active, continuous, incentivized security testing, and bug bounty programs are an effective and scalable way to achieve this.”
_-Luke Stephens, Manager of Training and Quality Assurance, Bugcrowd_

## The Business Impact Of a Bug Bounty Program

ROI is king when it comes to business decisions, right? What if you could make one change to your dev ecosystem that could potentially raise ROI by 4x? Well, that’s precisely what our experience has been. Dollar-for-dollar, we see in the range of 3-4x the vulnerabilities with this program than we have in the past. More bugs are found in less time and for less money. With the global average cost of a data breach in 2019 sitting at over [$3.8 million USD](https://www.ibm.com/security/data-breach) &mdash; we think our bug bounty program is a sound investment.

Beyond the purely financial aspect, there’s a team cohesion and training aspect to setting up a bug bounty program that can’t be overlooked. People trust people, so having a living, breathing researcher document a vulnerability has a much stronger impact on the development team than an automated scan or test sequence does. And that’s how you build better security awareness into your next iteration or new product. To go back to Luke at Bugcrowd:

> “Bug bounty programs provide a scalable way to not only identify risk to help the security team but to help impart security awareness to builders within our organization.”
_-Luke Stephens, Manager of Training and Quality Assurance, Bugcrowd_

## Lessons Learned From Our Ongoing Partnership With Bugcrowd

In our time working with Bugcrowd and their researchers, we’ve learned some valuable lessons around app security and the value of discovery. We’ve drilled down and come up with our top two most impactful lessons to share with you:

1. **First and foremost, the bugs identified by Bugcrowd have been far more complex and deeply buried than anything we’ve found in the previous testing**. This dovetails with the quote earlier about bug bounty programs finding 3-4x more vulnerabilities per dollar spent. 

2. **Be ready. You should expect to see a significant increase in the number of vulnerabilities discovered compared to before the program**. That means you need to be sure your security team is ready to triage and mitigate those vulnerabilities, so you ensure they’re dealt with before a malicious actor.

Both of these lessons are reciprocal. We’ve learned a lot about our product, and by having the resources to address issues quickly, we’ve shown the Bugcrowd researchers that we’re responsive and how highly we value the work they do. 

Auth0 Senior Manager of Product Security, Marcin Hoppe, sums it up succinctly:

> “We don’t control what types of vulnerabilities bug hunters are looking for, and they might be looking for things we have not included or prioritized in our own security testing efforts. This gives us a chance of getting reports of vulnerabilities we might have otherwise missed.”

## What Does The Future Hold For Bug Bounty Programs?

Though relatively new to the security scene, official bug bounty programs are seeing a high adoption rate across industries. That’s right; bug bounties aren’t just for the tech sector. According to a [report from Bugcrowd](https://www.bugcrowd.com/resources/reports/priority-one-report/) themselves, 2019 saw an increase of 29% in the number of bug bounty programs launched, along with a 50% increase in public programs. Leading the way were the financial (71%) and retail (50%) sectors, with healthcare (41%) coming in third.

With programs like Bugcrowd showing the way to proactively seek out, document, and mitigate potential vulnerabilities **before** they cost the company millions of dollars — that trajectory shows no signs of slowing down. By answering the formerly unanswerable question, “what is a vulnerability worth?” bug bounty programs are providing a new peace of mind for today’s app devs.

## Auth0 and Bugcrowd: A Security Partnership That Works

Here at Auth0, security is what we do. By partnering with Bugcrowd, we found added peace of mind, further tightened our security perimeter, and have sped up the resolution process when a vulnerability is discovered.

<include src="asides/AboutAuth0" />


Bugcrowd’s Bug Bounty Program: Crowdsource Your App Security

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

The trends defining the year and how businesses can protect themselves

The 11 Biggest Data Breaches of 2020 (So Far)

Hackers are preying on confusion, so businesses need a clear plan.



Between social distancing, an uncertain economic outlook, and the Coronavirus itself, business leaders have enough on their plates without having to worry about cyberattacks. Unfortunately, cybercriminals aren’t taking a vacation; they’re using the Coronavirus pandemic as an opportunity to prey upon organizations around the globe, with potentially disastrous results.

Around the world, security experts are reporting an alarming uptick in Coronavirus-related scams and attacks on our most vital infrastructure.

It’s easy to feel powerless in the face of this epidemic, but when it comes to cybersecurity, executives can actually do a great deal to limit the damage. Put measures in place now to protect your business’ data from attack, and you’ll come out the other side of the pandemic better equipped to deal with cybersecurity threats. Let’s start by identifying those threats.

## Cyberattacks Surge During Coronavirus

It was tempting to hope that hackers might give the world a break during a global health crisis. In fact, security company [Check Point](https://blog.checkpoint.com/2020/04/20/coronavirus-update-as-economic-stimulus-payments-start-to-flow-cyber-attackers-want-to-get-their-share-too/) has reported a sixfold increase in the average daily number of attacks in recent weeks. Of Coronavirus-related attacks, they report that 94% are phishing scams. This statistic is echoed by [Google](https://www.darkreading.com/threat-intelligence/stimulus-payments-are-popular-leverage-for-cyberattacks/d/d-id/1337601), which said it rejected close to 18 million virus-related phishing emails per day in one week in April.

These phishing scams can take a myriad of forms, but criminals posing as government agencies are particularly common. They may offer false guidance, claim to have a list of new Coronavirus cases, or offer people help [getting their stimulus checks](https://www.darkreading.com/threat-intelligence/stimulus-payments-are-popular-leverage-for-cyberattacks/d/d-id/1337601) or other financial assistance. Regardless of the ploy, the goals are the same: trick the reader into clicking on a link, downloading an attachment that exposes them to malware, or entering in private information, which hackers can then use to hijack their identity.

![COVID-19](https://images.ctfassets.net/23aumh6u8s0i/7smqXxxmZ8XdqSMgrGqQ22/4bd9e3fb3ab22cda8376270da6e058ec/goverment-uk)

Many phishing attacks also pose as internal business emails, taking advantage of the confusion resulting from people working from home. Even individuals who would normally be more cautious about clicking on a suspicious link may have their judgment compromised due to pandemic-related stress. People hoping for miracle cures or financial relief are far more likely to click on suspicious links than they would be otherwise.

Tragically, one of the hardest-hit sectors during the Coronavirus has been healthcare, which has been victim to a spate of ransomware attacks. As [Michael Salát of Avast](https://blog.avast.com/how-hospitals-can-protect-themselves-from-ransomware-avast?utm_campaign=socialposts_us&utm_source=twitter&utm_medium=social) has written, “hospitals are not necessarily more susceptible to ransomware attacks,” but since any system downtime could literally cost lives, “they are more likely than other organizations to pay the ransom.” Both the [Department of Homeland Security](https://www.us-cert.gov/ncas/alerts/aa20-099a) and [INTERPOL](https://www.interpol.int/en/News-and-Events/News/2020/Cybercriminals-targeting-critical-healthcare-institutions-with-ransomware) have issued warnings about cyberattacks in healthcare and urged hospitals to educate their employees on email safety, external backups for critical data, and strong, unique passwords.

{% include tweet_quote.html quote_text="As @avast’s threat intelligence director @michal_salat has noted, “hospitals are not necessarily more susceptible to ransomware attacks” — but attacks can cost lives — and they’ve tragically seen an increase during COVID.
" %}

The importance of these steps was highlighted by the experience of an Illinois hospital, which had to pay hackers $300,000 in ransom to get back access to their system after being locked out for three days. As a [hospital administrator said](https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2020/04/13/hospital-hackers-seize-upon-coronavirus-pandemic), “The only good thing was that just a few months before, we had put our electronic medical records and our email on the cloud, so they were not affected.”

## How to Protect Against Coronavirus-Era Cyberattacks Today

The Coronavirus pandemic is an ideal situation for hackers since they thrive on confusion, ignorance, and misinformation. To thwart them, businesses need to counter with communication, education, and knowledge.

Step one is to counter misinformation and confusion by **educating your employees** on cybersecurity best practices.

These include:

* Use a unique password for every application to guard against phishing and [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks. Ideally, all your employees should be using a company-approved password manager to ensure they aren’t re-using passwords.
* Be on guard against common phishing techniques, such as emails purporting to be from company representatives but with an unfamiliar or misspelled email address.
* Regularly update all software, especially anti-virus software, on any device (including mobile devices) on which you conduct company business.

It’s up to you how you educate your employees, but given how vital this information is and [how overwhelmed your team is likely to be](https://uptickapp.com/blog/what-managers-owe-our-teams-during-coronavirus), you should consider something more in-depth than a simple email. Conducting video training with specific examples of phishing attempts will make a bigger impact and let you respond to any questions your team has.

If possible, you should **mandate that all work is done on company-issued devices** since employees are less likely to be as vigilant about security updates and downloads on their personal devices. If that’s not an option, you should still **ensure that any remote tools you’re using are secure** and you’re not compromising data security in the name of convenience. (That’s particularly true for the healthcare sector, in which [telemedicine is opening up exciting possibilities](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) but also sparking concerns over patient privacy.)

As always, one of the best defenses against unauthorized intrusions into your system is to **implement a sophisticated Identity and Access Management (IAM solution)** using [multi-factor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/). MFA works by requesting an additional form of credentials beyond a username/password combination, such as a one-time code or biometric. That way, even if an employee unwittingly shares their password in a phishing scam or is the victim of a credential stuffing attack, a hacker can’t use that information to waltz into your system.

[Auth0 Signals](https://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals/) is a new service designed to help facilitate this by offering a real-time assessment of a login attempt’s threat level and when to request additional credentials.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Build Digital Resiliency to Guard Against Tomorrow’s Attacks

In choosing how to protect your company’s data, it’s important to think beyond short-term survival strategies and find solutions that are designed to last for more than a few months. After all, many experts predict a [second wave](https://www.washingtonpost.com/health/2020/04/21/coronavirus-secondwave-cdcdirector/) of the pandemic that could mean a return to social distancing and remote work. And Coronavirus aside, cybersecurity threats to business are on the rise, so it’s important to be proactive rather than merely reactive.

**Conduct risk assessments** of your company’s technology, especially every tool your employees may need to work from home. [Norton advises remote teams](https://us.norton.com/internetsecurity-emerging-threats-working-from-home-due-to-coronavirus.html) to “control the urge to improvise” by switching to unsecure applications when their work-approved tools fail. Yet the best way companies can protect against so-called [Shadow IT](https://www.webopedia.com/TERM/S/shadow-it.html) is to make sure that every piece of software that your team will need to remotely collaborate works as it should.

{% include tweet_quote.html quote_text="Build digital resiliency — it’s important to think beyond short-term survival strategies for protecting your company’s data and find solutions that are designed to last for more than a few months. 
" %}

As Auth0’s CSO Joan Pepin has written, you should also draw up a [pandemic plan](https://auth0.com/blog/how-to-create-an-actionable-pandemic-plan/) to prepare for future crises. That way, in the event of an emergency, all parties know their roles, and your business won’t descend into the kind of confusion that makes it easy prey for hackers. Making this plan will also deliver immediate benefits since you’ll spot potential weak points in your company’s documentation, technology, and overall structure.

## Be Careful, Not Fearful

In times of crisis, when resources (and patience) are stretched thin, it can be challenging to think about long-term solutions. But the Coronavirus is highlighting why it’s so vital to have a culture of security in place to keep a crisis from becoming a catastrophe. That culture should include regular audits, employee training, and third-party partners you trust to keep your systems updated. It’s the difference between building a lean-to shelter to get through a storm and building a sturdy house that will keep out all the storms to come.

If you’d like to learn more about how a sophisticated IAM platform can protect against cyberattacks without slowing your business down, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20the%20team%20at%20auth0).

<include src="asides/AboutAuth0" />


Coronavirus and Cybersecurity: How Your Business Can Stay Safe

How to protect customer data from internal and external attacks



On September 30, [American Express sent letters](https://media.dojmt.gov/wp-content/uploads/Consumer.pdf) to some of its cardholders, informing them that their personal information had been improperly accessed by a former employee, who apparently tried to use that data to open fraudulent accounts at other financial institutions. Amex has not disclosed how many accounts were compromised but told victims that their account numbers, addresses, dates of birth, and Social Security numbers had been stolen.

While the full scope of this crime is not yet clear, the implications are potentially serious, and not just for Amex. Incidents of data theft and mismanagement are on the rise—just days after the Amex story broke, [Twitter found itself](https://www.forbes.com/sites/emmawoollacott/2019/10/09/twitter-inadvertently-gives-user-security-data-to-advertisers/#29e3e2ea5f63) embroiled in its own user data scandal—and the costs are mounting.

These costs can take the form of lost revenue, lost customer trust, fines issued under new data privacy laws, and the increasing potential for credentials stolen in one attack to be used against other businesses.

Corporate titans such as American Express can weather the storm of a data breach, but SMBs can ill-afford the cost of a breach on their revenue and reputation. Yet despite the risks, many SMBs drastically underestimate the cost of a breach. [According to AppRiver's Q3 Cyberthreat Index for Business Survey](https://www.appriver.com/cyberthreatindexforbusiness/), 67% of respondents estimated a breach would cost less than $25,000. In reality, the average cost is $149,000.

Executives in every industry should take note of this breach and use it as an opportunity to examine their own data security. With that in mind, let’s take a look at what we know about the American Express data theft, how businesses can protect themselves from employee malfeasance, and the potential for stolen data to lead to further breaches

![Image of a credit card secured by a lock](https://images.ctfassets.net/23aumh6u8s0i/3dRPHqHpQRLsWibR1AWvgd/f67cb7415472656e0b9206f5bc071249/credit_lock)

## The Facts (So Far) about the Amex Breach

According to American Express, the employee accused of using cardholder data for identity theft no longer works for the company and is under investigation by law enforcement.

In its letter, Amex assured victims that they won’t be liable for fraudulent charges and offered two years of free Experian identity monitoring. (Ironically, to use that service, victims must disclose their SSNs and addresses to Experian, and some customers may feel uncomfortable trusting that information to credit monitoring services in the wake of the [Equifax breach](https://www.teampay.co/insights/b2b-fraud-schemes/).)

It bears mentioning that this [isn’t the first time](https://www.theregister.co.uk/2016/03/17/american_express_cardholder_data_breach/) American Express customers have had their personal information compromised. However, this breach is somewhat unusual in that it isn’t the result of [accidentally exposed data](https://www.pymnts.com/news/security-and-risk/2018/american-express-india-database-data-breach/) or a malicious intruder posing as a trusted third party but of an actual employee improperly accessing sensitive information.

## How Businesses Can Protect Themselves from Employee Fraud

American Express hasn’t revealed whether the employee responsible for this breach had the appropriate credentials to access unencrypted customer data or how they copied that data for their personal use. Whatever the specific circumstances, identity professionals know the most effective tactics for deterring employee fraud are carefully controlling and monitoring access to sensitive data.

![An image of a consumer using his credit card to buy online](https://images.ctfassets.net/23aumh6u8s0i/5qKdbPEP8YnwRPYcXwTE0x/a5f28025bbad3b6efd01988f2ef393da/creditcard)

[Cloud Identity and Access Management (IAM)](https://auth0.com/learn/cloud-identity-access-management/) is an effective way for cloud-based enterprises to manage access to resources. A good cloud IAM solution functions as a single, centralized resource for admins to grant access to data. With the flip of a switch, you can assign permissions based on what an employee needs for their current task and then revoke it when that task is completed, so valuable information is exposed as little as possible.

All cloud IAM solutions aren’t created equally, however, and you should look at one that lets you proactively keep an eye on employees and identify suspicious behavior. In its report on MFA for e-commerce, [NIST specifically recommends](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that businesses “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.”

[Auth0’s dashboard](https://auth0.com/docs/dashboard) gives you a comprehensive, bird’s-eye view of user behavior, including customers, third parties, and employees.

[Using Auth0’s Rules](https://auth0.com/docs/rules), you can configure your dashboard to alert admins in the event of suspicious behavior, which you can define according to your needs. For example, you might want to be alerted if an employee continually tries to access sensitive resources unrelated to their work or logs in from a new device or at an unusual time of day.

## Guarding against the Ripple Effects of Data Breaches

The American Express data breach is unlikely to be the last scandal involving credit card companies since they are such high-value targets for thieves. But executives across every industry should understand that breaches such as this don’t just harm the individual company involved; they threaten the entire e-commerce landscape.

Data breaches like this have a spillover effect since hackers often use data stolen in one breach to impersonate users on other sites, a type of attack known as [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). The best protection against this is [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires users to prove their identity via means that are more difficult to fake than simple data, such as a fingerprint scan or a one-time code sent to a personal device.

Auth0’s MFA comes with the added security of [breached password detection](https://auth0.com/breached-passwords). Auth0 keeps a constantly updated collection of breached credentials and alerts users if their login information may have been compromised.  

## Don’t Be the Next Casualty of an Amex-Style Breach

For executives, there are already valuable lessons to be learned from the American Express data breach. However, those lessons are unlikely to comfort the victims of this breach or restore their faith in their credit card company. So for now, one truth about this attack is already abundantly clear: when it comes to customer data, it’s better to invest in vigilance than damage control.

<include src="asides/AboutAuth0" />


What the American Express Data Breach Should Teach the C-Suite

How hackers got in, what they stole, and how to prevent more incidents in 2019.



> [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) have become commonplace — yet some industries are more vulnerable than others. Unfortunately, media is notorious for being a magnet for cyberthieves. 

In the last decade, dozens of media companies, ranging from prestigious publications like the *Washington Post* to social media platforms like [Facebook](https://mashable.com/2018/06/08/facebook-media-company-news-shows/#UMeaOo_oDsqI), have seen customers’ and the companies’ private data exposed.

Why? One reason is that billions of people have accounts with media companies. Facebook users alone hit [2.27 billion](https://www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/) in Q3 2018. As more and more people consume their news online, the surface area for cybercriminals continues to expand. Another reason, according to [Security Magazine](https://www.securitymagazine.com/articles/89404-media-and-entertainment-industry-unprepared-for-cyber-risks), is that media companies often rely on outside vendors. Even if the media companies themselves are confident in their security processes, it’s hard to track how safe third parties are. 

While some vendors like Auth0 take compliance seriously — acquiring [security certifications](https://auth0.com/security/) such as ISO 27001 and 27018, as well as SOC 2 and HIPAA  — this isn’t always the case with third parties.

Below is a roundup of 11 of the worst media breaches in the past decade. Hackers hit teams large and small, niche and high-profile, new and established. It’s clear that no company is immune.

We deliver tips for how all media teams can bolster their cybersecurity practices in 2019. 

## 1. BuzzFeed Data Breach

In 2016 BuzzFeed was hacked by a group called OurMine. On several BuzzFeed articles, headlines read  "HACKED BY OURMINE" with a link to the group's website. Several of the headlines also included profanities.

An [article in *Wired Magazine*](https://www.wired.com/2016/10/hack-brief-hackers-breach-buzzfeed-retaliation-expose/) described how the group had a history of getting into systems using passwords that were previously leaked in large-scale data breaches. They used the compromised passwords to access BuzzFeed accounts with the same login data.

## 2. Dow Jones Data Breach

In October 2015, hackers uncovered the personal data of current and former Dow Jones subscribers between July 2012 and August 2015. [Reports](https://www.wsj.com/articles/dow-jones-discloses-customer-data-breach-1444406517) divulged that the hackers got credit card information from close to 3,500 individuals — along with names, addresses, email addresses, and phone numbers.

The hackers' goal was to send fraudulent solicitations, according to the [*Wall Street Journal*](https://www.wsj.com/articles/dow-jones-discloses-customer-data-breach-1444406517)*. *The company suspected the incident was part of a much larger, multi-company data breach.

## 3. Avid Life Media Incident 

Also in 2015, the parent company to Ashley Madison, Avid Life Media, released a [statement](https://www.prnewswire.com/news-releases/ruby-corp-and-plaintiffs-reach-proposed-settlement-of-class-action-lawsuit-regarding-ashley-madison-data-breach-634551783.html) saying that hackers had gained access to computer networks and published nearly 10 gigabytes of sensitive personal information. These [included](https://www.wsj.com/articles/ceo-of-ashley-madison-parent-steps-down-1440773362?mod=article_inline) customers' names, email addresses, and credit card details contained in individual accounts.

Hackers, part of a group called The Impact Team, released nearly 10 gigabytes of data stolen from Avid Life. 

The company fought back, denying the severity of the attack:

![Avid Life Media Incident](https://images.ctfassets.net/23aumh6u8s0i/3wCntqxyboNdz1k6lpLMyo/062ee3dc8df5e5a760fd672bde6a2feb/avid-life-media)
[Image Source](https://www.databreaches.net/statement-from-avid-life-media-august-19-2015/)

Ultimately, the data breach led to Avid Life Media's CEO resigning. In 2017, Avid Life (now Ruby Corp) [reached a settlement of $11.2 million](http://www.prnewswire.com/news-releases/ruby-corp-and-plaintiffs-reach-proposed-settlement-of-class-action-lawsuit-regarding-ashley-madison-data-breach-634551783.html) with potential plaintiffs.

## 4. Facebook Scandal

Facebook's series of data breaches — including the [Cambridge Analytics scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Russian interference in the U.S. elections, the realization that major apps continue to [illegally share user data](https://siliconangle.com/2018/12/31/report-finds-major-apps-illegally-sharing-data-facebook/) with the company, and recent exposure of [_50 million accounts_](https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html) in September 2018 — are some of the most high-profile of the year. 

To make matters worse, many believe the most recent breach of personal accounts actually began as far back as July 2017. For months, hackers were rooting around for private information, including names, sexes, hometowns, and photos. After obtaining the data, attackers used people's lists to steal access tokens for third-party apps like Spotify and Instagram. 

While the hack didn't expose [_financial information_](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), the breadth of personal data they were able to access still had enormous value. 

## 5. Sony Data Breach 

In 2014, hackers [accessed and wiped personal data](https://www.forbes.com/sites/josephsteinberg/2014/12/11/massive-security-breach-at-sony-heres-what-you-need-to-know/#23bcec9144d8) from Sony customer accounts. In addition, they alluded to attacking theaters set to release the film “The Interview,” with James Franco and Seth Rogen. (Sony was forced to release the film online instead.) 

Hackers released information to the public like the salaries of tens of thousands of employees and Hollywood stars and [sensitive email traffic between executives and movie moguls](http://time.com/3629480/sony-pictures-hack-amy-pascal-emails/). Reports noted the incident amounted to [100 terabytes](http://time.com/3639275/the-interview-sony-hack-north-korea/) of data. 

Sony employees immediately knew something was wrong when they arrived at work and found images of grinning red skulls on computer screens. Hackers identified themselves as #GOP — Guardians of Peace. 

## 6. Washington Post Scam

In 2011, [1.27 million](https://www.pcmag.com/article2/0,2817,2388200,00.asp) *Washington Post* user accounts were hacked. This was a major incident because it was one of the first attacks on a prestigious media institution. It shook public confidence in the security of the trusted company. 

Hackers were able to get in via the *Washington Post*'s Jobs site.They stole usernames and email addresses — likely in order to conduct [phishing scams](https://auth0.com/blog/phishing-attacks-with-auth0-facts-first/), according to [*PC Mag*](https://www.pcmag.com/article2/0,2817,2388200,00.asp).

The company released an informational piece on online scams following the attack.

![Washington Post Scam](https://images.ctfassets.net/23aumh6u8s0i/7ikzMFxC9eaSZVyOhAzsIt/f294320bf73f546245712e4b8f80632c/washington-post)
[Source: Washington Post](http://www.washingtonpost.com/wp-srv/jobs/product-pages/fraud-email.html?noredirect=on)

Because such an attack was relatively new at the time, the piece helped users [understand the risks](http://blog.idonethis.com/security-ringcaptcha/)and what they could do to move forward.

## 7. DailyMotion Personal Data Theft

When DailyMotion was hacked in October 2016, it was one of the most visited sites online. A Russian hacker named Peace breached 85.2 million accounts and stole email addresses and usernames. *The Hacker News* reported that [18 million users](https://thehackernews.com/2016/12/dailymotion-video-hacked.html) had [hashed passwords](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/).

In 2018, DailyMotion was fined [€50,000](https://www.broadbandtvnews.com/2018/08/03/dailymotion-fined-for-data-breach/) for the incident.

## 8. Myspace Data Breach

Hackers were suspected of taking usernames and passwords from [360 million stolen Myspace accounts](https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/) and selling them to a forum online in 2016, according to [TechCrunch](https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/).

At the time, the Myspace attack was suspected to be the largest data breach of all time. Although data was mostly from accounts that weren't currently active, because people [reuse the same passwords](https://auth0.com/blog/avoiding-password-reuse-attacks/), hackers had the potential to use the information to log into other active accounts of the users.

## 9. Quora Security Incident

The attack on Quora occurred just a few weeks ago — in December 2018. The company released a [comprehensive statement](https://blog.quora.com/Quora-Security-Update?awc=15748_1545351800_5f9ec96c657ae3bee293392a15c47366&uiv=6&txtv=8&source=awin&medium=ad&campaign=uad_mkt_en_acq_us_awin&set=awin) detailing what occurred, what information was involved, and what Quora was doing to rectify the situation. 

A portion of the statement is below: 

![Quora Security Incident](https://images.ctfassets.net/23aumh6u8s0i/5dP0e79zrDmeTkosePu77k/0aec22bc42bd30ac30c2a74e1024ed95/quora-security-update)
[Image Source: Quora Blog](https://blog.quora.com/Quora-Security-Update?awc=15748_1545351800_5f9ec96c657ae3bee293392a15c47366&uiv=6&txtv=8&source=awin&medium=ad&campaign=uad_mkt_en_acq_us_awin&set=awin)

The company continues to have up-to-date FAQ on security [here](https://help.quora.com/hc/en-us/articles/360020212652-Quora-Security-Update-FAQ).

## 10. Associated Press Attack

Taking a different approach, hackers in 2013 accessed the Associated Press's Twitter account and [tweeted](https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23) that there were explosions in the White House and that Obama was injured. In six minutes, before order was restored, the Dow Jones Industrial Average plummeted. The hack impacted the stock market by [$136 billion](https://www.washingtonpost.com/news/worldviews/wp/2013/04/23/syrian-hackers-claim-ap-hack-that-tipped-stock-market-by-136-billion-is-it-terrorism/?utm_term=.6795bf505121). 

A group called the Syrian Electronic Army [claimed responsibility](https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23) for the attack.

## 11. Twitter Data Breach

Finally, even Twitter hasn’t escaped unscathed. In May 2018, the company [shared](https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html) that they had identified a bug in their internal log of user passwords that prevented Twitter from completing the [hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) process and fully securing them. 

![Twitter Data Breach](https://images.ctfassets.net/23aumh6u8s0i/27CklKf5h0eco99KcmDXEi/98504ef54775e3f97b08b80fd18bf00a/twitter)
[Image Source](https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html)

They asked users to re-set their passwords to prevent unwanted access — but the company's reputation suffered.

## What These Data Breaches Have in Common

Many of these attacks have common threads:

* Cyberthieves use [passwords that have been recycled](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/) — allowing them to access multiple accounts for a single individual.
* Hackers often get in through [vulnerabilities](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) in a company’s or third party’s system.
* Companies don’t always know how to respond to an incident in productive ways (although some are bold and clear with their communications).

Given similar issues among major data breaches, these are the areas to double down on to prevent future attacks.

## What You Can Do to Protect Yourself

There is no one-size-fits-all solution to protect your company against a data breach. If you’re new to [managing customer data](https://blog.getbase.com/8-ways-to-effectively-manage-your-customer-data) you might start with comprehensive employee training or make it a point to store only the data you really need.

_[Outsourcing cybersecurity to an expert team](https://auth0.com/forrester-total-economic-impact/)_ is increasingly popular among companies that deal with vast amounts of customer information. While internal IT teams are usually quite capable, they simply have too much on their plates to stay on the cutting edge of security — which is where you need to be to keep up with cybercriminals.

Solutions like Auth0 that come with [built-in security certifications](https://auth0.com/security/) can give you peace of mind knowing that you have a group working 24/7 on your security systems. It can free you up to build and roll out new products directly tied to your bottom line.

Among our many offerings, Auth0 has a special [breached password detection feature](https://auth0.com/breached-passwords) that monitors large-scale data breaches and notifies your users when their credentials are leaked. You can opt to block access until the user has reset their password.

See [here](https://auth0.com/) for our full suite of offerings to help you stay safe in 2019!


11 of the Worst Data Breaches in Media

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

An unsecured database allowed hackers to steal personal information from over 820,000 Cloudpets customers. Learn how this may affect you and what to do next.



[Spiral Toys](http://spiraltoys.com/) is a company that creates toys for children. It has an internet-connected product called [CloudPets](http://cloudpets.com/) which allows parents and children to record and send voice messages to each other through a mobile app. On January 7, hackers discovered that the database the company was using to store data for this product was unsecured. Hackers took control of the database, deleted all information, and demanded a payment to restore the data.

![Cloudpets Homepage](https://images.ctfassets.net/23aumh6u8s0i/4ISXmWTbhcqnqACVvBoSLv/6c7cb193c8c49f69d71da5ffd32cc7bc/cloudpets)

The database contained information for 820,000+ users containing emails, bcrypt hashed passwords, and links to voice recordings customers and their children had made which could now be publicly accessed. Additional information stored included pictures, names, birthdays, and relationships. Customers were not notified that their data had been compromised.

[Troy Hunt](https://twitter.com/troyhunt) wrote an excellent [article](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/) covering this incident. Some highlights include that the database used was publicly accessible and did not even require a password to access. Cloudpets was also notified at least four times that their database was exposed and the reporters never heard back from the company. Finally, staging and test databases were also discovered which had production data that could have also been compromised.

Aside from the devops failure to secure the database properly, password requirements for user accounts were non-existant. Although the passwords were stored as bcrypt hashes, Troy was able to use [Hashcat](https://hashcat.net/hashcat/) and find valid passwords such as "qwe", "password", and "123456".

![Cracked Bcrypt Hashes](https://images.ctfassets.net/23aumh6u8s0i/1ChTEWQXZQBJD3YjBclNhX/76bdc049376598ed8261792961ad335d/cracked-bcrypt-hashes)

Source: [Troy Hunt](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/)

Since the database has been publicly exposed since at least December 25, 2016, it is safe to assume that many malicious parties have accessed and downloaded the data. We urge customers that have Cloudpets accounts to change their passwords and monitor their other accounts for signs of malicious activity.

## Personal Information Security Guide

Even if you don't have a Cloudpets account, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, best practices for choosing good passwords, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

## Auth0 Can Protect Your Users and Apps

Managing identity is a complex and difficult task. At [Auth0](https://auth0.com), our goal is to make identity simple for developers. A recent feature we launched called [Breached Password Detection](https://auth0.com/breached-passwords) can help alert your users that their credentials have been compromised in a data breach when they login to your app. We are still working on getting and adding credentials from this breach to our database to better protect your users. This feature helps your users stay safe, but also protects your apps from malicious access. Additionally, Auth0 meets the standards for various [password strength requirements](https://auth0.com/docs/connections/database/password-strength), provides [multifactor authentication](https://auth0.com/multifactor-authentication), and more.

If you want to make identity simple and secure for your applications, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">give Auth0 a try</a>.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


"hackers"