{"id":16949,"date":"2019-11-20T11:10:21","date_gmt":"2019-11-20T19:10:21","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/11\/20\/news-10686\/"},"modified":"2019-11-20T11:10:21","modified_gmt":"2019-11-20T19:10:21","slug":"news-10686","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/11\/20\/news-10686\/","title":{"rendered":"Disney+ security and service issues: Here’s what we know so far"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Wed, 20 Nov 2019 18:11:36 +0000<\/strong><\/p>\n

The long wait is over.<\/p>\n

Disney+, the new video-streaming service to rival Netflix and Amazon Prime, debuted last week to much fanfare, racking up 10 million subscribers<\/a> within a single day of launch. Unfortunately, it wasn\u2019t the kind of splash the majority of users predicted, as they were met with connection and performance issues<\/a> out the gate\u2014soon to be followed by reports of hacked accounts being stolen and sold on the dark web. <\/p>\n

\"\"
The Disney+ problem trend line, outage heat map, and most reported problems, according to Downdetector.<\/figcaption><\/figure>\n
\n
\"\"
A snapshot of some of the hitches users are encountering (Courtesy of Downdetector Australia)<\/figcaption><\/figure>\n<\/div>\n

Disney+, on the other hand, didn\u2019t expect to be overwhelmed with technical complications due to exceedingly high consumer demand<\/a>. Nor do they admit to suffering a data breach<\/a>, despite user complaints of being frozen out of their accounts or seeing their credentials changed without approval.<\/p>\n

Things continue to unfold as we speak, but here\u2019s what we currently know about the Disney+ security issues.<\/p>\n

Disney+ user credentials in the dark web<\/h3>\n

For as low as US$3, interested buyers lurking on the dark web can acquire a trove of stolen Disney+ accounts, which popped up in several underground markets mere hours after launch last week. According to an investigation<\/a> conducted by Catalin Cimpanu of ZDNet, \u201cHacking forums have been flooded with Disney+ accounts, with ads offering access to thousands of account credentials.\u201d They also saw hacked accounts being offered for free use and for sharing.<\/p>\n

\n
\"\"
The pitch to free Disney+ accounts (Courtesy of ZDNet)<\/figcaption><\/figure>\n<\/div>\n

The BBC, with the help of an unnamed cybersecurity researcher, further confirmed the sale of thousands of Disney+ accounts<\/a>. <\/p>\n

No smoking gun…yet<\/h3>\n

As of presstime, Disney denies that there was a data breach of its streaming platform, and no one has pointed to a root cause on how Disney+ accounts were hacked. However, there are smart speculations.<\/p>\n

Users with hacked accounts may have used recycled credentials.<\/strong> And this won\u2019t be a surprise if it’s true. According to a Google survey, two in three Internet users reuse their passwords<\/a>\u2014some for multiple accounts, some for all of them.<\/p>\n

Armed with leaked credentials from multiple data breaches, hackers likely used credential stuffing\u2014the automated entering of compromised username-password combinations to target account forms, which in this case were from Disney+. This works under the assumption that users entered the exact combo in that service.<\/p>\n

Disney+ also allows for password sharing, but its user interface doesn’t include an option to easily log others out from account access. In addition, it doesn’t require two-factor authentication<\/a>, a security measure that could have prevented recycled credentials from being an issue.<\/p>\n

\n

Read: Are hackers gonna hack anymore? Not if we keep reusing passwords<\/a><\/p>\n

\n

Hackers may have guessed user passwords correctly. <\/strong>Another method hackers can use is password guessing. It seems silly, but this works, too, because many users are still so bad at making strong passwords and opt for easy-to-remember ones like “12345<\/a>,” “password,” and “qwerty.” Add in the difficulty of entering complex passwords via TV remote, and that makes this scenario even more plausible.<\/p>\n

ZDNet noted, however, that even consumers who used unique passwords claimed their accounts were stolen. In that case, it is possible that\u2026<\/p>\n

Disney+ really was hacked or their user database leaked online.<\/strong> Not all companies fess up to being hacked right away, especially if they are in the middle of investigating the culprit\/root cause. In addition, Disney has a documented history of cutting corners<\/a> on investing in technology infrastructure. It’s possible their databases were not properly secured and credentials actually leaked online, allowing threat actors to simply grab the information they needed without having to breach at all.<\/p>\n

Users may actually have malware on their systems.<\/strong> It\u2019s not a long shot, considering we have nasties like spyware<\/a> and keyloggers in the wild. So many houses are Internet-connected through streaming services and other IoT devices<\/a>, such as home assistants, thermostats, doorbell, security, and lock systems. These networked devices are notoriously vulnerable to attack.<\/p>\n

Users may have been phished.<\/strong> Although there are no reports of an active phishing campaign<\/a> against Disney+ users, we have seen a well-timed, professionally put-together phishing email fool even the cleverest of Internet users.<\/p>\n

A Disney+ account lockdown is a security precaution<\/h3>\n

There are user complaints on social media wherein they claim to have been locked out of the Disney+ service. While this may suggest that hackers have successfully changed linked emails and passwords to affected accounts, it could also suggest that a security precaution<\/a> Disney had put in place is working: When their system sees suspicious activity on an account during the login process, it locks that account down.<\/p>\n

Of course, until Disney customer service confirms this to be true for affected users, we can only assume that finding yourself locked out is the streaming service\u2019s way of protecting your account from getting compromised. Unfortunately, Disney made the mistake of linking its new streaming service with the rest of its platforms, freezing some users out of their other Disney services as well.<\/p>\n

At the end of the day, there\u2019s good news<\/h3>\n

There is big room for improvement, for both the users and Disney+.<\/p>\n

Users should take this incident as a reminder of the importance of good password hygiene, such as creating unique and complex credentials and never reusing them. Chances are, online criminals already have some of your old passwords in their stash, so why continue to use them? <\/p>\n

Heed what others have already advised and start using a password manager<\/a>. There are a lot of options out there, so take your time and make sure you pick the one you think is for you. Because Disney+ doesn\u2019t have another layer of account protection in place, such as two-factor authentication (2FA)<\/a>, it is more crucial than ever to use a randomly generated, long password that you don\u2019t have to memorize.<\/p>\n

Speaking of passwords, it\u2019s also good practice to avoid sharing them with anyone, including friends and family members. Yes, Disney tolerates the practice of password sharing, but for security’s sake, it’s best not to. At the very least, consider introducing a little bit of friction in keeping your accounts secure. And this is true not just for Disney+ account holders.<\/p>\n

There is no shortage of great suggestions for Disney+ to increase its security, too. Apart from implementing and mandating the use of 2FA (especially for linked Walt Disney accounts), the streaming service should also have provided a feature where a user can view other devices connected to their Disney+ account. Some also suggest<\/a> that, since Disney also owns Hulu, Disney+ should have a feature that allows account holders to log everyone out in the event of a hack.<\/p>\n

Disney+ is set to roll out<\/a> in European countries and the UK in March 2020. Hopefully by that time, both users and Disney will have done more to ensure their accounts are secured, beefier protections are enabled, and performance issues are ironed out. <\/p>\n

The post Disney+ security and service issues: Here’s what we know so far<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Wed, 20 Nov 2019 18:11:36 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
The most anticipated streaming service Disney+ officially launched early last week. And while it was met with an overwhelming influx of users, there were also a myriad of Disney+ security issues. Read on for the latest.<\/p>\n

Categories: <\/p>\n