Digital Undercurrents

There has apparently been a sizable data exfiltration at LastPass, an application service provider who stores passwords for user accounts. The data was of sufficient size that it probably includes hashed “master passwords”, which serve as the crypto keys to unlock the stored passwords on the service.

If you’re using LastPass, you may want to change your password. And you may also want to reconsider the wisdom of storing all of your passwords in a stranger’s datacenter.

Sony is not having a great week. Looks like some “external attacker” has made off with the mother lode of data from the subscription section of Playstation Network.

Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

The police in Seattle have seized a black Mercedes thought to be used for large-scale “wardriving” data theft from area businesses. The owners were cruising around the city, looking for small businesses using vulnerable WEP encryption on their wireless networks, and then intercepting data for later use.

If your company has a wireless network, PLEASE be aware of the security implications of what you’re doing. Wireless isn’t like traditional Ethernet – the radio waves can travel right through the walls into the parking lot or other public space, and simple point-and-click eavesdropping tools make it easy for even a technical neophyte to gather data from a misconfigured network.