Reading time: 4 minutes
Yesterday (17), Tecmundo (link) announced that it had received a file posted on a data-sharing site (Pastebin) containing a list of usernames and passwords from Brazil's major e-commerce sites, such as Netshoes, Centauro, PagSeguro, Casas Bahia, among others.
Despite the seriousness of the situation, we would like to offer some reassurances to reassure the public, who may currently be questioning the security of their data on these e-commerce sites, especially smaller stores.
Analyzing the situation presented, we can first see that only a few accounts were posted, just over 360, which is a relatively low number for this type of leak. Normally, to prove the authenticity of such claims, hackers usually post the complete list of users, as happened when the Snapchat database was leaked (link). Another important factor to note is that these are several different websites, all major market players, using different platforms and technologies, which further reduces the chances that they were actually hacked. Of course, we are not suggesting that you ignore the alert issued by Tecmundo, nor do we want you to; the best thing to do is still to take precautions by updating your password and even canceling any credit cards saved in these stores. However, another factor that leads us to believe that the stores' security was NOT actually compromised is that the passwords are visible, which is very strange, as it is common practice to store passwords in encrypted form. This last point is very important because everything indicates that this is nothing more than a hoax. If the leak were proven true, the failure would be extremely serious and very amateurish, something we do not believe could occur systematically across all the stores reported.
Understand how password encryption works
For laypeople, the subject may seem complicated, but any professional in the field who has worked with databases and login systems knows how basic the user password encryption process is. We will try to explain it in a way that the general public can understand more easily, ignoring some technical details such as password salting, types of encryption algorithms, etc.
Think of it this way: when you register your account at a store, the password you type is encrypted before being stored in the database. This transformation turns your password into a completely different sequence of characters from the actual password. Below is an example of a password encrypted using the SHA-1 algorithm:
Knowing this new sequence is not enough to access your account because every time the login process is performed, the password you enter must be encrypted and then compared with the stored password. In other words, without knowing the actual password, it is impossible to know the corresponding encrypted version. Theoretically, it is not completely impossible, but to "crack" an encrypted password would require a great deal of processing power, which would take years even on the most powerful supercomputers in the world. It is a matter of mathematics.
There are several very simple reasons why passwords are encrypted before being stored. The first reason is to prevent the employees of these companies from accessing this information, which could lead to various problems. The second reason is that if a leak occurs, your password will not be compromised, thereby preventing the intruder from using this information to access your account.
What could have happened then?
It is highly likely that the leaked accounts were captured through some type of malicious software, such as viruses, Trojans, keyloggers, etc. There is also the possibility that they are accounts created to generate a false alarm or even fake accounts used for fraud. In any case, we advise you to change your password. Above all, this is the simplest measure that can ensure a more peaceful night's sleep. Also, keep an eye on the news for updates on the incident. Until more is known, it is best to stay alert to avoid complications and not underestimate or ignore what happened. Oh, and don't forget not to use easy passwords such as dates or easily guessable sequences.
Check Commerce's Position
Check Commerce follows security standards, keeping passwords encrypted and not storing payment data such as credit card numbers. So far, we have not found any compromise of information stored by us or our partners. We are monitoring technology providers such as Magento, Shopify, PagSeguro, Moip, among others, for any new information about the incident.
Stores' Positions
By Tuesday morning (18), some stores had already issued statements about the incident. Here are the statements from these stores originally posted by Tecmundo (link):
Netshoes' Position
“Netshoes states that its database was not attacked and that the information of its registered customers remains secure. Data security is a recurring concern for the company, and Netshoes reaffirms its commitment to ensuring the protection of its customers' information”
Centauro's Position
“Centauro states that its customers' information is secure in the company's database, which did not suffer any type of attack. The company also guarantees that its online store is a secure website and that its customers can continue to rely on the company's commitment to protecting their data“.
