Adobe Hacked, 2.9 Million Customer Accounts Compromised

by

Adobe today announced that hackers have managed to obtain information on approximately 2.9 million of its customers that have downloaded its software, including customer IDs, encrypted passwords, customer names, encrypted credit/debit card numbers, expiration dates, and other information on customer orders.

adobe_creative_cloud_feature
Adobe does not believe that the attackers were able to obtain decrypted credit or debit card numbers from its system, and is currently working with external partners and law enforcement to address the issue.

As a precautionary measure, Adobe is contacting users with affected accounts, initiating password resets. The company is also offering customers that had their credit or debit card information accessed the option of enrolling in a one-year complimentary credit monitoring service.

As a precaution, we are resetting relevant customer passwords to help prevent unauthorized access to Adobe ID accounts. If your user ID and password were involved, you will receive an email notification from us with information on how to change your password. We also recommend that you change your passwords on any website where you may have used the same user ID and password.

We are in the process of notifying customers whose credit or debit card information we believe to be involved in the incident. If your information was involved, you will receive a notification letter from us with additional information on steps you can take to help protect yourself against potential misuse of personal information about you. Adobe is also offering customers, whose credit or debit card information was involved, the option of enrolling in a one-year complimentary credit monitoring membership where available.

We have notified the banks processing customer payments for Adobe, so that they can work with the payment card companies and card-issuing banks to help protect customers’ accounts.

We have contacted federal law enforcement and are assisting in their investigation.

In addition to customer accounts, the hackers also accessed the source code of a number of Adobe products, but Adobe says that it is unaware of any increased risk to customers as a result of that particular attack.

Top Rated Comments

(View all)
Avatar
92 months ago
Hmmm.... I wonder if there's a business model where we can get paid again and again forever whether we fix bugs or not, and EVEN if our updates are not very useful ones. One where we're under NO pressure to make our software great, because it won't affect our income. One where we can be paid for apps we let stagnate, alongside the ones we still work on. One where our customers' own creative work is held to monthly ransom, ready for us to lock them out at any time. One where we load their machines with layers of buggy crapware and updaters. And one where we keep ALL our users' credit card numbers on file forever!

�� I think I have an idea!
Score: 21 Votes (Like | Disagree)
Avatar
92 months ago
Maybe the hackers can release a version of Adobe Acrobat that isn't full of security holes :rolleyes:
Score: 17 Votes (Like | Disagree)
Avatar
92 months ago
Yet another good reason I'm not on the cloud. Adobe: "Hey, hackers may have gotten your credit card, and we're not gonna give you any free months of CC. Keep an eye on your own credit card." Greedy bastards!
Score: 13 Votes (Like | Disagree)
Avatar
92 months ago

Silly question but. If hackers got Adobe ID's and passwords whats to keep them from changing the password ?

They got encrypted passwords, which are useless without decryption.

Specifically, the passwords are stored in a hash. What happens is you select your password and Adobe takes that password, does some math to it, then stores the resulting hash in their database somewhere, rather than storing your actual password. Then, when you enter your password to log in, it does the same math on it, and compares the result to the hash they have stored in the database. If the two hashes are the same, it knows you entered your password and it lets you in. If somebody gets the hash straight off their database, as would seem to be the case here, that doesn't help an attacker know what password to type in when they want to log in with your account, unless they can reverse engineer the hash algorithm. So, it really depends on what kind of hash algorithm they used for their database, as to how secure your password actually is.

Generally, it's a good idea to have everyone change their password anyway, just in case the algorithm eventually proves to be vulnerable to attack, or an attacker is properly motivated and willing to spend enough time to crack your password. Some hashes still in use today are considered vulnerable, though, so attackers may very well already be crunching through the hashes and getting plaintext passwords. One can hope Adobe is using a more secure hash, but plenty of big companies have used insecure algorithms in the past.

Hashes are designed not to be reversible, unlike regular encryption designed for actual decrypting at some point, but if the algorithm is known it's possible to simply use it to hash a bunch of password guesses, and then compare those guesses to the hashed passwords. Just search through the database for hashes you've made yourself, and you know the password for each of the accounts with the same password hash. It's essentially a dictionary attack, but it bypasses whatever system Adobe uses to prevent unlimited repeated invalid password entries (like locking your account after a certain number of attempts, or adding delays to the algorithm/webpage so it would take a prohibitively long time to try every possible password).

One method of preventing lookup table attacks like the above is to add a "salt" to the password before it's hashed so the result in the database isn't something the attacker can generate for a table without knowing the salt. Any old salt won't do, though. It needs to be a cryptographically-secure pseudo-random number, unique to each account, never reused when a user changes their password, and long enough that an attacker can't simply make as many tables as there are possible salts. Bear in the mind, the salt still has to be stored alongside the hash in order to authenticate a user, so an attacker knows the salt to use. But, by using a nice long pseudorandom salt for every individual password, each individual password needs a separate lookup table to brute force. Dictionary attacks are still possible if the hash algorithm and salt method is known, but take incredibly long amounts of time to crack the whole database and incredibly large amounts of storage. Against a single specific user, their password may be discovered, but only that one user, and only if they used a guessable password, and each single specific user will require a separate attack. In other words, they're still doing an ordinary dictionary attack, and the usual rules about making your passwords resistant to dictionary attacks apply. Properly salted passwords hashed with a modern secure algorithm are simply not feasible to extract from a database like this, en masse, but it's still a good idea for everyone to change their passwords. It's also a good idea to change any other passwords you have if you've made the common error of reusing passwords on multiple sites.
Score: 12 Votes (Like | Disagree)
Avatar
92 months ago

Maybe the hackers can release a version of Adobe Acrobat that isn't full of security holes :rolleyes:


Hackers are good but they aren't miracle workers.
Score: 8 Votes (Like | Disagree)
Avatar
92 months ago
Here come the "This is why subscription service sucks" posts...

Either way, bummer. :/
Score: 8 Votes (Like | Disagree)

Top Stories

iPhone 12 Pro in Graphite and iPhone 12 in Blue Shown Off in Unboxing Videos

Monday October 19, 2020 8:20 am PDT by
While the iPhone 12 Pro does not launch until Friday, we now have an early unboxing video of the device courtesy of Twitter account DuanRui, providing a closer look at the shiny new flat-edge design and sleek Graphite color option. Ben Geskin re-uploaded the unboxing video to YouTube, which we've embedded below: Geskin has also uploaded an unboxing video of the iPhone 12 in Blue: ...

New Photos Offer Better Look at iPhone 12 Color Options

Tuesday October 20, 2020 2:34 am PDT by
As we wait for the iPhone 12 review embargo to lift later today, more pictures are circulating of the devices in real-world lighting conditions, providing a better look at the different colors available. Leaker DuanRui has shared images on Twitter of the iPhone 12 in white, black, blue, green, and (PRODUCT)RED. The black and white colors are similar to the iPhone 11 colors, but the other...

Kuo: iPhone 12 Pro Demand Higher Than Expected

Sunday October 18, 2020 10:39 pm PDT by
TF International Securities analyst Ming-Chi Kuo released a research note this morning detailing what he's seen with the volume of iPhone 12 and iPhone 12 Pro pre-orders in the first weekend of sales. Kuo had previously indicated that Apple's estimated shipment allocations for the new iPhone models placed the iPhone 12 at the top with 40-45% of inventory allocation (up from 15-20%). However, ...

Apple Releases iPadOS and iOS 14.1 With Multiple Bug Fixes Ahead of iPhone 12 Launch

Tuesday October 20, 2020 10:06 am PDT by
Apple today released iOS and iPadOS 14.1, the first major updates to the iOS and iPadOS 14 operating system updates that were released in September. iOS and iPadOS 14.1 come a week after Apple released the golden master versions of the updates to developers. The iOS 14.1 update can be downloaded for free and it is available on all eligible devices over-the-air in the Settings app. To access...

Hands-On With Apple's MagSafe Charger for iPhone 12

Monday October 19, 2020 11:54 am PDT by
Alongside the new iPhone 12 models, Apple introduced a MagSafe charger that attaches to the back of the iPhones using magnets embedded both in the charger and in the iPhone. It allows for speedier charging and paves the way for a portless iPhone in the future. MagSafe chargers are shipping out and are in some Apple retail locations now, and we picked one up to check it out. Subscribe to the ...

Watch: iPhone 12 and iPhone 12 Pro Unboxing Videos and First Impressions

Tuesday October 20, 2020 6:05 am PDT by
Apple's embargo has lifted for iPhone 12 and iPhone 12 Pro reviews. In addition to our detailed review roundups for each device, we've rounded up over a dozen unboxing videos and first impressions below. iPhone 12 in Blue on left and iPhone 12 Pro in Pacific Blue on right via Engadget Key new features of the iPhone 12 and iPhone 12 Pro include a flat-edge design, 5G support, a much faster A14 ...

Some Apple Watch SE Owners Experiencing Issues With Overheating [Updated]

Monday October 19, 2020 11:38 am PDT by
There may be an issue with the new Apple Watch SE, which some users have found is overheating after a few hours of usage. Several Apple Watch SE owners in South Korea have run into problems, as noted in a Reddit post chronicling the complaints. There have been six reports from Apple Watch SE owners in South Korea who have had their Apple Watches get hot and malfunction, with a yellow spot...

Gold Version of iPhone 12 Pro Apparently Has a More Fingerprint Resistant Stainless Steel Frame

Tuesday October 20, 2020 11:56 am PDT by
iPhone 12 Pro reviews hit the web today, and one of the more interesting tidbits came from TechCrunch's Matthew Panzarino, who revealed that the Gold version of the device apparently has a more fingerprint resistant coating applied to the stainless steel frame. From his review:Most of the iPhone 12 Pro finishes still use a physical vapor deposition process for edge coating. But the new gold...

iPhone 12 Pro Max Has Smaller 3,687 mAh Battery According to Regulatory Filing

Tuesday October 20, 2020 8:48 pm PDT by
Apple's new iPhone 12 Pro Max is equipped with a 3,687 mAh battery, which is around 7% less capacity than the 3,969 mAh battery in the iPhone 11 Pro Max, according to a regulatory filing published by TENAA, the Chinese equivalent of the FCC. The regulatory filing, spotted by MacRumors, also lists the iPhone 12 Pro Max with 6GB of RAM as seen in benchmark results last week. Apple has filed ...

Hands-On With Apple's iPhone 12 and 12 Pro MagSafe Cases

Tuesday October 20, 2020 1:33 pm PDT by
Apple's iPhone 12 and 12 Pro are launching this Friday, and ahead of that release date, Apple is shipping out various accessories like the MagSafe charger and MagSafe cases. Yesterday we took a look at the MagSafe charger, and today our MagSafe case came in the mail, so we thought we'd take another look at the charger to see how it works with the case and just how strong the case magnets are. S ...