Please note that even if there is a Google+ or Facebook registration, this could happen. The information was strong and our article too. Although Gearbest is a trusted store, leaving your server unprotected was a major flaw.
How do you know if your account was in this vulnerability?
According to Gearbest official information, only the new accounts and users who made purchases in less than 3 days were in that database. After these 3 days the data was erased. In other words, and playing by insurance, if you used or registered with Gearbest from March 1, 2019 until March 15, 2019, change your passwords immediately. If your website password is the same as any other account, change it as soon as possible.
The online store from China that sells by millions to Nigeria, Portugal, Brazil, and the world, responded officially in a statement and you can read:
"Immediately after we became aware of this incident, our security experts began an investigation to verify the allegations made by Mr. Noam Rotem. Although we have discovered that all our databases or servers used to store or process data are protected with all necessary encryption measures and are absolutely safe, some of the external tools we use to store data temporarily may have been accessed by others.
The external tools we use are designed to improve efficiency and prevent data overload, and Data will only be stored in such tools for less than three days before being automatically destroyed. Considering possible data security breaches, we protect these tools with powerful firewalls to prevent that data from being compromised by malicious verification by other people. However, our investigation reveals that on March 1, 2019, these firewalls were mistakenly removed by one of our security team members for reasons still under investigation. This unprotected status directly exposed these tools for scanning and access without further authentication.
Currently, we believe this may have affected our newly registered customers as well as our former customers who placed orders with Gearbest during the period from March 1, 2019 to March 15, 2019, for a total number of approximately 280,000. Fortunately, the irregularity was corrected by us within two hours immediately after detecting it and will further strengthen our internal security administration to prevent this incident from happening again.
We sincerely apologize for what happened. In addition to the above, we will be implementing urgent measures to disable the passwords of these newly registered customers to avoid any illegal login to their accounts and we will also send an email to all affected clients to update the situation . " of Gearbest.
0 Comments:
Post a Comment
Your comment and facebook share will be appreciated