In May 2019, Flipboard, the news aggregation app, disclosed that attackers had gained unauthorised access to some of its databases and copied user account information. This post looks back at what happened and what companies and users can learn from it.
What happened
According to Flipboard’s notice, attackers had access to its systems during two periods: between June 2018 and March 2019, and again for a short time in April 2019. During that time they obtained copies of databases containing user account information.
The data included:
- Names, usernames and email addresses.
- Hashed passwords.
- Digital tokens that some users had created to connect Flipboard to third-party accounts, such as social media.
Flipboard said not every user was affected, and it found no evidence that the attackers used the third-party tokens to access the connected accounts.
How the passwords were stored
Most of the passwords were protected with bcrypt, a slow, salted hashing algorithm designed to make cracking very expensive. However, accounts that had not changed their password since early 2012 were still protected with the older SHA-1 algorithm, which is fast and far easier to crack.
This is a common pattern: a company upgrades its password storage, but old hashes stay in the database until each user logs in or changes their password.
How Flipboard responded
- Reset passwords for affected users and prompted them to create new ones.
- Replaced or deleted the third-party account tokens.
- Brought in outside security experts and notified law enforcement.
Lessons for companies
- Migrate legacy password hashes. When you move to a stronger algorithm such as bcrypt or Argon2, rehash or force-reset accounts still on the old one instead of waiting years.
- Detect intrusions faster. The attackers had access for around nine months. Good logging and alerting on database access shortens that window.
- Treat tokens as secrets. OAuth and API tokens stored for users should be encrypted and scoped to the minimum permissions needed.
- Test regularly. Independent penetration testing and cloud security reviews help find the entry points attackers use.
Lessons for users
- Use a unique password for every service, ideally with a password manager, so one breach does not unlock your other accounts.
- Turn on two-factor authentication wherever it is offered.
- Review which apps are connected to your social media and email accounts, and remove the ones you no longer use.
If you want to know whether your own application could be the next breach notice, get in touch.
