Feeds

Spotify breach creates password hack risk

Radio ga-ga

The essential guide to IT transformation

Popular online music service Spotify has warned of a security breach that may have exposed user passwords and other sensitive data.

A notice - posted on Wednesday - explains that a bug in Spotify's protocols that was recognised and resolved in December was more serious than first suspected. Last week Spotify learned that a group of hackers had managed to compromise its protocols as a result of this (now resolved) vulnerability.

This, in turn, meant that password hashes of individual users was exposed, though not in an easy to decrypt form. Even so if particular users had used weak passwords then the breach meant these password could be extracted using a brute-force attack, Spotify explains.

The hashes are salted, making attacks using rainbow tables unfeasible. Short or otherwise bad passwords could still be vulnerable to offline targeted brute-force or dictionary attacks on individual users, but you could not run attacks in parallel. Also, there has been no known breach of our internal systems. A complete user database has not been leaked, but until 19 December, 2008 it was possible to access the password hashes of individual users had you reverse-engineered the Spotify protocol and knew the username.

Although credit card details were not exposed a lot of sensitive information was, Spotify adds.

Along with passwords, registration information such as your email address, birth date, gender, postal code and billing receipt details were potentially exposed. Credit card numbers are not stored by us and were not at risk. All payment data is handled by a secure third party provider.

The common habit of using the same password and username combo on many sites means the effects of the breach extend beyond Spotify. The site advises users to change their password across the board, where accounts were registered prior to 19 December and the same password was used on multiple sites. ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?