Edugeek server security compromise

There will be more information, but only as and when we have it. We are not in the speculation game. As has been pointed out, we do not hold information that criminals traditionally go for such as card details.
There is no one more able and experianced to figure out what happened and why than Shaun, but to ensure we do things correctly it will take time.
As for details such as someone having your date of birth to access an onlne bank account, you would also have to have many other details as well as your DOB alone is not enough to identify you. Someone would need to know what bank you are in for a start. Then account numbers, passwords (often 2 passwords now) and other details (none of which were held by us) are required, so please stop fretting.

Working in a bank myself with a team of security guys I have an idea what can happen. The data collected could be sold on. The person who receives it will take what he needs. He might already have a portfolio of someone's data and the date of birth could be the last piece of te puzzle.

It's happened many times before....

Quote:

---

Originally Posted by FN-GM

Working in a bank myself with a team of security guys I have an idea what can happen. The data collected could be sold on. The person who receives it will take what he needs. He might already have a portfolio of someone's data and the date of birth could be the last piece of te puzzle.

It's happened many times before....

---

In which case, you're basically screwed. Local governments lose data all the time. Your schools did. Your banks do. The NHS does. Australia has far weaker data protection laws than the UK and as such it is illegal to send personal data from the EU to Australia, but you don't seem concerned about it, having moved there.

So, my suggestion is the same as everyone else - assume that your data has been copied, and act accordingly.

Quote:

---

Originally Posted by sister_annex

I for one am just happy Edugeek is back, to some semblance of normality, I think people forget sometimes that it is a relatively small outfit that runs the site and they have a million and one things to do as well as keep us happy, I do agree an update to what went on would be nice but I also understand that @ZeroHour has spent many hours working to get services restored (and by now should have a very nice ass groove worked into his chair!).

Patience is a virtue, I am sure the details will appear in time :)

---

That's a nice post . . . . but a troubling image.

Quote:

---

Originally Posted by FN-GM

Working in a bank myself with a team of security guys I have an idea what can happen. The data collected could be sold on. The person who receives it will take what he needs. He might already have a portfolio of someone's data and the date of birth could be the last piece of te puzzle.

It's happened many times before....

---

While I wait for my main account to get sorted (forgot about this one)

Are those in the bank winding the noobie up?
LMAO if the DOB was truly the magic bullet everyone on facebook would be done for. The amount of people who advertise there DOB to the public on that is insane and thats before we get to those that put their address.... and you have never told posted your age (as your month/day is public on edugeek according to your settings) which would allow the complete DOB.
Also if you bank with a bank that will let you into someones account with their DOB I would change banks ;)
The next office birthday will be interesting at least....

And before anyone says "ahar, I never put my YEAR of birth on fb/linkedin/whatever!" remember you have a nice sharp peak among your friends of people born in the same year as you... :D

Zak has some point about data mining of personal details is rarely about a single breach (unless they are lucky and get a full DB of personal and card details) but a breach of any site could release information which can then be used to target other areas. However, it is often combined (when details are sold on) with attempted access to email account ... and the advice about changing passwords is good advice. The concern about DoB is only a very small one ... and if they have access to your email account as well, and that has your personal details in too then whether they gain your DoB from here or anywhere else is of no matter. I would not place my DoB as a security detail where possible anyway ... and have turned it off as a verification item where I can. My DoB is pretty public anyway ... people wishing me happy birthday and me mentioning my age ... it doesn't take a rocket scientist to work out.

Because of the uncertainty of what may have been targeted and for what reason, and the details about attack vector needing to be covered, etc there is little more that can be added other than that which was in the original article or from DB's subsequent posts. The ICO advise that sites should not be put straight back up to get to 'business as usual' but should take appropriate security action to deal with the issue. As a member, I am happy and confident that this has been done. I would not expect for DB and ZH to give me a complete public run-down of what they have done on the security side of things to improve things even further, in the same way I wouldn't expect any of the other members to give me a complete breakdown of your security arrangements on a public site. Although it may be considered security by obscurity, it is also a bit of common sense.

Quote:

---

Originally Posted by Arthur

We did in a way. Valve's Steam Users' forums and Sony's MyResistance.net forums were hacked around the same time as EduGeek. Both use vBulletin and the latter is still offline! :eek:

---

Sony's MyResistance.net forums ran on either MyBB or SMF not vBulletin (Can't remember which).

Quote:

---

Originally Posted by localzuk

but you don't seem concerned about it, having moved there.

---

And you know me that well do you?

Quote:

---

Originally Posted by localzuk

So, my suggestion is the same as everyone else - assume that your data has been copied, and act accordingly.

---

I wasnt asking for your advice.

Quote:

---

Originally Posted by FN-GM

And you know me that well do you?
I wasnt asking for your advice.

---

PMing you.

Quote:

---

Originally Posted by localzuk

People suddenly seem to be behaving like this site is some giant commercial operation when it isn't.

---

But the thing is we are always being told that edugeek is a global support site with huge member numbers from around the world and how it is recognized by important companies within the IT world. They even come to Philly to promote the site. Now when something like this happens we are told that it is a relatively small outfit and to stop fretting. So which is it?

I believe what Localzuk means is like an outfit like Amazon or MS Technet or something to that effect.

I can see where you are coming from @RoF however from Edugeeks' POV they are big fish in a small pond (infact the biggest fish in a small pond as Experts Exchange take most answers from here and charge for the privilege).

In terms of global multifunction tech support sites - Edugeek is the biggest
In terms of global tech support sites - Edugeek is small fry (Technet - largest, Apples equivalent - next, Redhat (which now covers all linux distro's) - 3rd, and so on and so forth).

Edugeek markets itself globally to get more hits, more users and more views (and in terms of ad revenue it is a huge boost...the site experiences a massive surge in users and such like during and after BETT for example). So it makes fiscal sense for them to market themselves globally (however I call dibs on the trips to AUS and NZ :D lol).

Personally I do not care if someone got my DOB as they could have gotten that from facebook/linkedin if they have me as a contact and the password for here, it is unique to this site only (usually my passwords are around 26 digits letters, numbers, symbols, upper case and lower case which is enjoyable remembering them! lol).

As for the statement, I wait with interest.

Quote:

---

Originally Posted by nephilim

In terms of global multifunction tech support sites - Edugeek is the biggest

---

What is a multifunction tech support site? :confused:

Supports more than just 1 product.

Quote:

---

Originally Posted by nephilim

As for the statement, I wait with interest.

---

I don't. Any statement will be kinda superfluous to me, IMO. The fact that the site had an intrusion, and that passwords should be reset is enough. I don't see what a statement would do really.