• TREND MICRO
  • ABOUT
Search:
  • Latest Posts
  • Categories
    • Android
    • AWS
    • Azure
    • Cloud
    • Compliance
    • Critical Infrastructure
    • Cybercrime
    • Encryption
    • Financial Services
    • Government
    • Hacks
    • Healthcare
    • Internet of Everything
    • Malware
    • Microsoft
    • Mobile Security
    • Network
    • Privacy
    • Ransomware
    • Security
    • Social Media
    • Small Business
    • Targeted Attacks
    • Trend Spotlight
    • Virtualization
    • Vulnerabilities
    • Web Security
    • Zero Day Initiative
    • Industry News
  • Our Experts
    • Ed Cabrera
    • Rik Ferguson
    • Greg Young
    • Mark Nunnikhoven
    • Jon Clay
    • William “Bill” Malik
  • Research
Home   »   Industry News   »   Current News   »   Lessons learned from recent Evernote breach

Lessons learned from recent Evernote breach

  • Posted on:March 4, 2013
  • Posted in:Current News, Cybercrime
  • Posted by:
    Trend Micro
0

With more than 50 million users utilizing Evernote, a service that is designed for archiving data and taking notes, a data security breach is essentially a worst-case-scenario event. This past week, the worst case came true, as the company said it suspected usernames, email addresses and encrypted passwords were stolen.

"Evernote's Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service," officials confirmed in a company blog post. "As a precaution to protect your data, we have decided to implement a password reset [for all users]."

Evernote's Ronda Scott said, according to PC World, that they will release updated versions of their applications across the board and update accounts with new and secure passwords in an effort to make the process easier on everyone.

Matthew Schwartz, an InformationWeek editor, wrote that issues like this are something that needs to be taken note of by both customer and cloud providers, as there is always something to learn from a data breach of this magnitude. The first thing he believes companies should do is detail what hackers are going after and how they are attacking it. Schwartz wrote it was good that Evernote broadcasted their security warning and clearly stated what the attackers were after and noting that it was protected. In this case, the user passwords were likely protected well enough to buy users some time and let them detect and respond to the breach.

Positives to be learned
As another piece of good news, he wrote on the website that the company opted to kill all passwords instead of first trying to figure out which were breached and which were not.

"While our password encryption measures are robust, we are taking steps to ensure your personal data remains secure," Evernote said. "This means that in an abundance of caution, we are requiring all users to reset their Evernote account passwords."

Other things to learn from this attack, according to Schwartz, include:
– Weak points should be locked down, as it appears there was a mass amount of updates issued after the Evernote attack for all operating systems
– If a breach happens, do not include website links in the password reset email, as this can be seen as careless
– For users, a breach of email addresses and usernames will likely mean they will be added to multiple spam lists. He wrote that attackers will likely start sending spam emails that will look like they are from some popular website or service in an effort to draw them into another attack
– The volume of hacks is not dropping, so businesses and users must be on their toes to make sure they are protected from the ill will of any cybercriminal

Another thing Schwartz said is necessary is two-factor authentication in order to add to the data security of both users and businesses.

"Too few businesses have followed the security example set by game maker Blizzard, which offers its users a $6.50 two-factor authentication token, as well as a two-factor smartphone authenticator," Schwartz wrote on InformationWeek. "Notably, two-factor authentication would have prevented the Evernote hackers from using any passwords they successfully decrypted. If both Blizzard and Google can do it, what's stopping cloud services such as Twitter and Evernote from offering better security to their users?"

Robert Belfort, a partner with Manatt, Phelps & Phillips LLP told CIO.com that most data breaches tend to start with a moment of confusion with something that the company or an employee didn't even think about suddenly going missing. Businesses need to be covering all bases when it comes to data security to help avoid these instances.

Data Security News from SimplySecurity.com by Trend Micro.

Related posts:

  1. Security lessons learned from Anonymous’ BART breach
  2. AP Twitter hack causes market chaos, public panic
  3. Apply lessons learned from Wi-Fi to help BYOD
  4. Our Journey to GDPR Compliance: Lessons learned on our way to May 25th

Security Intelligence Blog

  • Our New Blog
  • How Unsecure gRPC Implementations Can Compromise APIs, Applications
  • XCSSET Mac Malware: Infects Xcode Projects, Performs UXSS Attack on Safari, Other Browsers, Leverages Zero-day Exploits

Featured Authors

Ed Cabrera (Chief Cybersecurity Officer)
Ed Cabrera (Chief Cybersecurity Officer)
  • Ransomware is Still a Blight on Business
Greg Young (Vice President for Cybersecurity)
Greg Young (Vice President for Cybersecurity)
  • Not Just Good Security Products, But a Good Partner
Jon Clay (Global Threat Communications)
Jon Clay (Global Threat Communications)
  • This Week in Security News: Ransomware Gang is Raking in Tens of Millions of Dollars and Microsoft Patch Tuesday Update Fixes 17 Critical Bugs
Mark Nunnikhoven (Vice President, Cloud Research)
Mark Nunnikhoven (Vice President, Cloud Research)
  • Twitter Hacked in Bitcoin Scam
Rik Ferguson (VP, Security Research)
Rik Ferguson (VP, Security Research)
  • The Sky Has Already Fallen (you just haven’t seen the alert yet)
William
William "Bill" Malik (CISA VP Infrastructure Strategies)
  • Black Hat Trip Report – Trend Micro

Follow Us

Trend Micro In The News

  • Trend Micro Goes Global to Find Entrepreneurs Set to Unlock the Smart Connected World
  • Winners of Trend Micro Global Capture the Flag Demonstrate Excellence in Cybersecurity
  • Companies Leveraging AWS Well-Architected Reviews Now Benefit from Security Innovations from Trend Micro
  • Trend Micro Announces World's First Cloud-Native File Storage Security
  • Digital Transformation is Growing but May Be Insecure for Many
  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © 2017 Trend Micro Incorporated. All rights reserved.