Your data is in good hands with Adobe. (Not)

[Doyle Yoder]

Remember when asked if it was an employee or a ex-employee, the answers was only they were pretty sure it was not an ex-employee.

Do they have some idea of what employee is responsible.

[makaphoto]

On November 19th I received a new email from Adobe Customer Care (well, so it says, as I'm beginning to suspect that it might have been a fake).They tell me that my password has been reset AGAIN by them, and I'm supposed to change it. Same thing that I had been asked a few weeks ago after the big data hack.
So I typed in my new password. Today (four days later) I checked that new password and tried to log into my Adobe Account. I was denied access. I thought this a bit strange, and tried with the old one (the one I got the message that it had been reset). And - hey presto - I was logged in.
Still a big mess there at Adobe, I guess.

[Doyle Yoder]

Adobe in bed with Experian.

Now this even gets stranger.

http://forums.adobe.com/thread/1341742?tstart=0

[Farmer]

Interestingly, I got an email from EverNote (which I use) saying they had compared all their user email adresses with those from the Adobe hack and were reporting to anyone where they found a cross-match and recommending that EverNote passwords be changed.

That's good, proactive support from EverNote.

[PierreVandevenne]

Doyle, this is life as usual in the IT Security world. Nothing that rampant malpractice can't explain.

Want to sign as Microsoft? Just ask Verisign whose sole job at the time (2001) was to ensure IDs and certificate matched. 
http://news.cnet.com /2100-1001-254586.html

Want to steal a stealth fighter design? Ah, a bit more complex. Two steps...

1) hack RSA istelf to create ID tokens. Of course, RSA will first deny it, then confirm it in a limited way, which, of course, should have no impact.

http://gcn.com/articles/2011/06/07/rsa-confirms-tokens-used-to-hack-lockheed.aspx

then, it becomes obvious it is not that limited

http://dankaminsky.com/2011/06/09/securid/
http://arstechnica.com/security/2011/06/rsa-finally-comes-clean-securid-is-compromised/

2) send a fishing e-mail with a compromised PDF to Lockheed Martin to executives and HR, gain a foothold in the network, then use the token to access the secure part (the fundamental mistake here was that there was a bridge between HR and R&D)

I could go on for pages and pages.

Adobe, also in 2001, managed to sell an expensive document security suite that encrypted documents and stored the encryption key and decryption routine in them. They then got the guy who revealed that slight (cough, cough) issue in jail (and backtracked when they realize they couldn't defend their position)

http://www.zdnet.com/news/dimitry-sklyarov-enemy-or-friend/116424

So, in that sense, the attack on Adobe is nothing out of the ordinary. While it may seem extraordinarily hard to pull off, it is not the case and it's not necessary to have insider collaboration.

[Tim Lookingbill]

Adobe in bed with Experian.

Now this even gets stranger.

http://forums.adobe.com/thread/1341742?tstart=0

Where does it say in that Adobe Forum discussion link that Adobe is in bed with Experian?

This DOJ link:

http://www.justice.gov/opa/pr/2013/October/13-crm-1116.html

...indicates the capture and indictment of one of the persons Experian sold personal information to but it doesn't say how the information exchanged hands and by what process security mechanism was used and certainly no mention of Adobe. If you're blaming it on Adobe's security holes in their PDF creation apps, please point directly to how Experian used a pdf to sell personal information.

BTW doing some calling around and research on the web what Experian did is totally against the law, so Experian is going to be the one to blame unless you all have evidence that indicates different.

[Fine_Art]

Adobe should not be keeping that data. It is not their area of expertise so they should be using the credit card company's system. The only retailer company I trust to keep data is Amazon.

[Steve Weldon]

Adobe should not be keeping that data. It is not their area of expertise so they should be using the credit card company's system. The only retailer company I trust to keep data is Amazon.

Virtually every on-line retailer (who doesn't use a service such as Digital River) keeps payment and credit card records.  The business suites that 99% of them use, come from the same software companies.

If you're depending on a internet sight to keep your data secure.. well.. that's your first mistake.  Don't do that.