Every major online dating service has been targeted by malicious hackers looking to access private information, but few attacks have been as severe, as pervasive, or as publicly damaging as the data breach attack on AdultFriendFinder in October 2016.
The attack exposed the records of more than 360 million users, and not just from AdultFriendFinder itself but sister sites across the popular FriendFinder network. To this day, it is still one of the largest database breaches ever recorded, leaking the email addresses, usernames, passwords, sexual orientations, and even spoken languages of millions of people across more than two decades of AFF history.
Worse still, it exposed some downright shoddy security practices, which included using SHA-1 cryptographic hashing, already more than a decade out of date by the time of the breach, and storing account passwords in plain text. It was an embarassing moment for the company.
Thankfully, FriendFinder Networks took this breach very seriously indeed, and dramatically stepped up its security practices and protcols. Here are three major changes they made to help protect future users:
AFF overhauled their database security
Think of a website's database as a kind of bank vault. It's where all the most valuable stuff is stashed. And thieves would love to get their hands on it all. In 2016, prior to the attack, AdultFriendFinder had the equivalent of a single-lock safe: it looked secure and intimidating, but malicious actors had long ago figured out how to crack the code and get their hands on the loot.
Now, AFF uses the latest in encryption technology to bolster security, including a technique called "salted hashing" that involves combining each password with a unique, random string of characters (known as the salt) and then passing them through a one-way hash function. It's a sophisticated way of ensuring that even accounts using identical passwords across different sites (looking at you, people who use "password" for your password) aren't all vulnerable during a breach.
AFF hired outside security experts
The ugly truth is that companies can't go it alone in the battle for cybersecurity. In-house security teams, as smart and hardworking as they may be, just don't stand a chance against an army of hackers and malicious actors. These scammers work 24/7 to access your valuable data and are always evolving and finding new ways through.
The 2016 data breach humbled AFF enough to recognize this fact, and they've been contracting outside cybersecurity help ever since, including help fro Google subsidiary Mandiant. These cybersecurity firms don't just examine the potential vulnerabilities in your coding — they also look at corporate structure and employee practices to evaluate potential vulnerabilities.
Forced password resets
Not all cybersecurity vulnerabilities are the fault (or exclusive fault) of the website. Sometimes, users' laziness can be a major vulnerability — in other words, using the same passwords year after year and assuming that's OK. Beefing up AFF's security has involved forced password resets, so you can't just use the same password all the time.
This is now basically standard operating procedure across the internet: Once every six months or once a year, you'll be asked to choose a new password. AFF has formalized this approach to help secure against password vulnerabilities that it can't control, such as leaks on other dating sites. (Be honest: How many of you use the same password across multiple sites? It doesn't take much for a hacker to apply a leaked password from one site to a whole bunch of other sites). This also protects against hardware malware such as keyloggers.
Later this year, exactly one decade will have elapsed since AdultFriendFinder's last security breach. Say what you will about their past mistakes — a full decade of cybersecurity success is an achievement, and modern users of the site should be grateful that AFF has stepped up their game in such a big way.
from Mashable https://ift.tt/YhQZpGz
https://ift.tt/nBE4JKq
Comments
Post a Comment