Adobe Data Found Online

A computer security firm has discovered data it says belongs to some 152 million Adobe Systems Inc user accounts, suggesting that a breach reported a month ago is much larger than Adobe has so far disclosed and is one of the largest on record.

LastPass, a password security firm, said that it has found email addresses, encrypted passwords and password hints stored in clear text from Adobe user accounts on an underground website frequented by cyber criminals.

Adobe said last week that attackers had stolen data on more than 38 million customer accounts, on top of the theft of information on nearly 3 million accounts that it disclosed nearly a month earlier.

The maker of Photoshop and Acrobat software confirmed that LastPass had found records stolen from its data center, but downplayed the significance of the security firm’s findings.

While the new findings from LastPass indicate that the Adobe breach is far bigger than previously known, company spokeswoman Heather Edell said it was not accurate to say 152 million customer accounts had been compromised because the database attacked was a backup system about to be decommissioned.

She said the records include some 25 million records containing invalid email addresses, 18 million with invalid passwords. She added that “a large percentage” of the accounts were fictitious, having been set up for one-time use so that their creators could get free software or other perks.

She also said that the company is continuing to work with law enforcement and outside investigators to determine the cost and scope of the breach, which resulted in the theft of customer data as well as source code to several software titles.

The company has notified some 38 million active Adobe ID users and is now contacting holders of inactive accounts, she said.

Paul Stephens, director of policy and advocacy for the non-profit Privacy Rights Clearinghouse, said information in an inactive database is often useful to criminals.

He said they might use it to engage in “phishing” scams or attempt to figure out passwords using the hints provided for some of the accounts in the database. In some cases, people whose data was exposed might not be aware of it because they have not accessed the out-of-date accounts, he said.

“Potentially it’s the website you’ve forgotten about that poses the greater risk,” he said. “What if somebody set up an account with Adobe ten years ago and forgot about it and they use the same password there that they use on other sites?”

Source

Is Twitter Selling Your Tweets?

Twitter users are about to become major marketing meat, as two research companies prepare to release information to clients who will pay for the rights to mine that data.

Boulder, Colorado-based Gnip Inc and DataSift Inc, based in the U.K. and San Francisco, are licensed by Twitter to analyze archived tweets and basic information about users, like geographic location. DataSift announced this week that it will release Twitter data in packages that will encompass the last two years of activity for its customers to mine, while Gnip can go back only 30 days.

“Harvesting what someone said a year or more ago is game-changing,” said Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse in San Diego. As details emerge on the kind of information being mined, he and other privacy rights experts are concerned about the implications of user information being released to businesses waiting to pore through it with a fine-tooth comb.

“As we see Twitter grow and social media evolve, this will become a bigger and bigger issue,” said Graham Cluley, senior technology consultant for British-based Internet security company Sophos Ltd. “Online companies know which websites we click on, which adverts catch our eye, and what we buy … increasingly, they’re also learning what we’re thinking. And that’s quite a spooky thought.”

Twitter opted not to comment on the sale and deferred questions to DataSift. In 2010, Twitter agreed to share all of its tweets with the U.S. Library of Congress. Details of how that information will be shared publicly are still in development, but there are some stated restrictions, including a six-month delay and a prohibition against using the information for commercial purposes.

Source…