More like this

Security

Alibaba security fail: Brute-force bonanza yields 21m logins

'Crack security team' didn't notice attempt to log in 99 million times

Up to 21 million accounts on Alibaba e-commerce site TaoBao may have been compromised thanks to stolen credentials reused on breached third-party sites.

TaoBao is a seller-to-seller commerce site like Gumtree or eBay where users rely on reputation to secure the most sales.

Reuters reports that China's Ministry of Public Security said the hackers used a database brimming with 99 million usernames and passwords, which they entered into Alibaba's cloud network. Doing so showed that 20.6 million passwords were accurate and linked to TaoBao accounts.

The epic brute force siege lasted from mid-October to November, using compromised accounts to buy products and post fake reviews to bolster seller reputation.

The attacks were immediately reported to police. Six people have been arrested.

Alibaba says its systems were not breached and adds that it has reminded users not to reuse passwords.

It has not commented on how its "world-class security team" failed to detect the likely millions of failed rapid-fire bot entries into its login portals until weeks after it begun.

Sophos security man Paul Ducklin says the attack may have flown under TaoBao's radar since only a few common passwords needed to be used in order to gain access to a large number of accounts.

"One problem in this case is that with nearly 100 million account names to work with, the crooks didn’t need to try thousands of passwords per account to get a good hit rate, so Taobao may not have seen evidence of massive password guessing," Ducklin said.

"Taobao is one of the busiest websites in the world, so processing hundreds of millions of logins, even it they come from the same internet region - Alibaba’s cloud network - is all in a day’s work."

Ducklin says the attack serves as a warning for web site owners to apply login rate limiters and for users to deploy two factor authentication and ensure passwords are not reused. ®

Sponsored: Global DDoS threat landscape report