You've probably read by now that online retailer Zappos suffered a security breach affecting over 24 million customers. As a Zappos customer, I received the email last night alerting me about the breach. I got a nearly identical email from their sister company, 6pm.com, as well. This is a clear sign that I buy too many shoes. What's interesting to me about this breach is that Zappos is renowned for their customer service, so watching how they communicate in the coming days and weeks should be an interesting case study. A few notable points so far:
Tony Hsieh, the CEO, posted a copy of the internal email that they had sent to all their employees. And tweeted about it. The only difference from the customer-facing email was that it stated the number of records affected. But it's unusual for a company to share internal communication like this.
Zappos expired everybody's password, forcing customers to follow the password reset workflow before regaining access to their account. Usually a company will urge you to change your password but won't force you to do so. This was a good move on their part. The servers seemed very overloaded though; around 9pm last night it took me a few minutes (and a couple of server timeouts) to successfully reset my password.
In the customer-facing email, Zappos notes that credit card numbers were not affected, but "cryptographically scrambled" passwords were. This is where I believe they ought to be more forthcoming. What does "cryptographically scrambled" entail? An unsalted MD5 hash, Stratfor style? Salted hashes? Symmetric encryption? A homegrown algorithm? Something stronger like bcrypt or scrypt? This detail is critical, because it indicates how easy it will be for attackers to recover the original passwords from the affected customers and try to use them on other sites like Gmail, Facebook, Twitter, and others. Customers might be more likely to change their password on other websites if they understood the relative risk.
The email does not disclose how long customer data was exposed prior to the breach notification. This is an important detail that was omitted.
Zappos has been actively engaging with customers on their @Zappos_Service Twitter account. In fact, last night when I posed a question to the CEO's Twitter alias, @Zappos_Service responded 4 minutes later. They didn't have an answer, but they responded.
They turned off their phone system because they felt responding via email would be more efficient (and their phone system couldn't handle the volume anyway). Still, can you imagine a "typical" company doing this? It seems simultaneously crazy and brilliant.
It takes a long time to send 24+ million emails. I received mine last night at 8:34pm and 9:03pm, but a colleague here at Veracode mentioned he didn't get his until this morning. So assuming they're going out alphabetically by e-mail address, that's how long it took to get from "c" to "r".
Since both Zappos.com and 6pm.com were affected, it's possible that they shared a single database. There are a bunch of scenarios though. It could be a vulnerability in application code shared by both sites. It could have also been an insider attack, but the fact that credit card numbers were not compromised suggests to me that the attack was external.
For me, the two things to watch for now are how quickly they restore international access and whether or not they disclose how passwords were stored and what "cryptographically scrambled" means in that context. Security breaches happen to the best of companies and these days what differentiates you is how you respond. So far I believe Zappos is on the right track. (Incidentally, Tony Hsieh's book, Delivering Happiness, is a fantastic read. I have a lot of respect for how this company operates, and not just because my shoes arrive overnight.)
Chris Eng, vice president of research, is responsible for integrating security expertise into Veracode’s technology. In addition to helping define and prioritize the security feature set of the Veracode service, he consults frequently with customers to discuss and advance their application security initiatives. With over 15 years of experience in application security, Chris brings a wealth of practical expertise to Veracode.
Love to learn about Application Security?
Get all the latest news, tips and articles delivered right to your inbox.
Veracode is a leading provider of enterprise-class application security, seamlessly integrating agile security solutions for organizations around the globe. In addition to application security services and secure devops services, Veracode provides a full security assessment to ensure your website and applications are secure, and ensures full enterprise data protection. Application protection services from Veracode include white box testing, and mobile application security testing, with customized solutions that eliminate vulnerabilities at all points along the development life cycle.