Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

Adobe Breach Compromised Over 38 Million Users, Photoshop Source Code 145

Posted by Soulskill from the downside-to-massive-reach dept.
rjmarvin writes "Adobe's investigation into the massive data breach they were hit with this past August has revealed that over 38 million active users, not to mention inactive accounts, had their user IDs and passwords pilfered by hackers. An Adobe spokesperson confirmed the number, along with the theft of Adobe Photoshop source code. The initial report earlier this month put the extent of the breach at only 3 million credit card accounts, plus stolen Adobe Acrobat, Reader and ColdFusion source code."
This discussion has been archived. No new comments can be posted.

Adobe Breach Compromised Over 38 Million Users, Photoshop Source Code More

Adobe Breach Compromised Over 38 Million Users, Photoshop Source Code

Comments Filter:

  • We can always hope (Score:5, Insightful)

    by nospam007 ( 722110 ) * on Tuesday October 29, 2013 @05:52PM (#45273685)

    The breach was made possible by a bug in Adobe Acrobat Reader I hope.
    That would be Karma.

    • Re: (Score:2)

      by gmuslera ( 3436 )
      The next breach will be made possible using the NSA backdoor that the hackers found in Flash Player source code.

    • Re:We can always hope (Score:5, Insightful)

      by dgatwood ( 11270 ) on Tuesday October 29, 2013 @06:20PM (#45273985) Homepage Journal

      In my experience, it's a safe bet that any company that cuts as many corners as Adobe does in one area probably cuts corners in almost every other area. This leads to the obvious question of whether the crackers will find any serious security holes in Photoshop and exploit them. Given how much they seem to resist fixing even the most trivial bugs in Photoshop, I'd be willing to bet that the entire codebase is an unholy cesspool, which means it is probably rife with security holes, too.

      • Re:We can always hope (Score:5, Insightful)

        by dhaines ( 323241 ) on Tuesday October 29, 2013 @06:45PM (#45274241)

        ...they seem to resist fixing even the most trivial bugs in Photoshop...

        Adobe fixes bugs! They save up all the fixes then charge for them in the next release.

        • Re: (Score:3, Insightful)

          by Timothy Hartman ( 2905293 )
          Now that we have no more perpetual licensing the issue of having to pay for a next release is a non-issue. They still haven't pushed out a compelling feature for my licenses to merit upgrading, however.

      • "probably cuts corners in almost every other area" uh let's make that 'always cuts corners ...'

      • Re: (Score:2)

        by dbIII ( 701233 )

        which means it is probably rife with security holes, too

        Considering that their "encryption" which they had a Russian imprisoned for "cracking" was a cipher written about by Julius Caeser and has been used as code wheel toys printed on the back of cereal boxes I'd say that is a very safe bet.

      • Maybe someone can examine the source code now and explain to me once and for all why Photoshop takes 30 minutes to install when gimp takes 30 seconds.

    • Re: (Score:1)

      by Anonymous Coward

      I don't know, a flaw in Flash or CodeFusion would also be just deserts. The real question isn't even how they got in, but what took them so long.

    • Well, if the source code is as intuitive and well designed as Photoshop, they've nothing to worry about.

  • With Photoshop "open sourced" (Score:3)

    by RunFatBoy.net ( 960072 ) * on Tuesday October 29, 2013 @05:53PM (#45273699)

    I can finally write that lens flair javascript library

    -- Jim
    Weekly feedback [weeklyfeedback.com] for your website.

  • The untold story (Score:5, Funny)

    by dysmal ( 3361085 ) on Tuesday October 29, 2013 @06:00PM (#45273771)
    The untold story is that the hackers tried to give back the source code but Adobe said NO GIVE BACKS!

  • No News Is Good News (Score:5, Funny)

    by Anonymous Coward on Tuesday October 29, 2013 @06:01PM (#45273777)

    Adobe hasn't notified me of anything so my data must be safe. Right?

    Right?

  • Cloudy skies (Score:5, Insightful)

    by girlintraining ( 1395911 ) on Tuesday October 29, 2013 @06:01PM (#45273789)

    So how's that new "Cloud all the apps" thing working out for you guys so far? Ah. I see you leaked pretty much your whole database of people who had signed up for it. Well then, carry on.

    In other news, I hope your new strategy crashes into the dirt so hard the only thing that'll be memorable about Adobe in 5 years will be is the case study on it in business classes around the world on how not to do it.

    • Re:Cloudy skies (Score:4, Insightful)

      by aiadot ( 3055455 ) on Wednesday October 30, 2013 @12:27AM (#45276809)
      Whether the cloud strategy is working or not doesn't matter. As long as artists, web designers, graphic designers, wannabes, etc, keeping using Photoshop et al for everything they do, even when is completely unnecessary either because there are cheaper, sufficient or better alternatives depending on the job, Adobe has no need to listen to reason. They'll still be making all the money they want.

  • Would suck to be them (Score:5, Insightful)

    by jones_supa ( 887896 ) on Tuesday October 29, 2013 @06:02PM (#45273807)
    I know we're gonna get all the "ha ha, it's an evil megacorp anyway", but damn it must be stressful moments to some of the folks at Adobe. :/ Especially if the source code leaks turn out to be true.

    • Re:Would suck to be them (Score:4, Informative)

      by sconeu ( 64226 ) on Tuesday October 29, 2013 @07:03PM (#45274403) Homepage Journal

      Allow me to introduce you to a new word... Schadenfreude [wikipedia.org].

    • Re: (Score:1)

      by Anonymous Coward

      You know, it serves them right.

      After that whole Creative Cloud disaster, it's about time they start learning it the hard way. If only someone would come up with a competing line of products... It's kind of sad that this screw-up of a company is the leading provider of creative software...

      Also, I started giving all those cloud services the finger. I'm fed up with my personal information being treated like open source.

    • Re: (Score:1)

      by Anonymous Coward

      Yeah, how horrible it would be if the source code was leaked everywhere and people were able to see how the software they (or others) run on their computers actually works.

    • Re:Would suck to be them (Score:4, Interesting)

      by InfiniteLoopCounter ( 1355173 ) on Tuesday October 29, 2013 @08:32PM (#45275097)

      I know we're gonna get all the "ha ha, it's an evil megacorp anyway", but damn it must be stressful moments to some of the folks at Adobe. :/ Especially if the source code leaks turn out to be true.

      Leaking the source will be a big embarrassment for Adobe. I mean given the quality of the applications there will probably be lots of comments on top of functions that say:

      We have no idea what this function does. The guy who wrote it left and it is used for backwards capability. It is also tied into main areas of the program and can't be removed.

  • Oh no! (Score:1, Funny)

    by Anonymous Coward

    Oh no! Stolen!? I hope they get their source code back soon!

    • I don't. Their source code would be better off in the hands of just about anybody else, including monkeys with typewriters.

      • Re:Oh no! (Score:4)

        by Mordok-DestroyerOfWo ( 1000167 ) on Tuesday October 29, 2013 @06:57PM (#45274357)

        I don't. Their source code would be better off in the hands of just about anybody else, including monkeys with typewriters.

        I was under the impression that it was initially created by monkeys with typewriters.

        • No offense, but if their code was so shit why did anyone bother stealing it?
          Why are they the dominant leaders in their particular area of expertise?
          Just because you don't like closed source software does not mean it is shit code.
          I have seen plenty of shit code in open source code myself.
        • Oh you are so full of shit.

          There isn't a single line of Shakespeare in there anywhere!

          ;)

      • Re: (Score:3)

        by Cryacin ( 657549 )

        including monkeys with typewriters.

        It's unfair to marginalize the support team like that. They work hard.

  • Is it time... (Score:3)

    by ADRA ( 37398 ) on Tuesday October 29, 2013 @06:06PM (#45273843)

    I keep hearing about this breach and that breach, but what I'd love to see are some seriously ambitious groups of skilled security engineers standing up to help encourage good security practices that are widely recognized and standardized. The networked computing eco-system is so intertwined and desperate that how can any Jack or Jill admin be expected to have a fair set of skills in their toolbox to tackle such a hurdle? To expect any or ALL admins to have enough competence to just know the depth and complexity of a highly enabled enterprise is very unlikely.

    For a possible first step, lets consider blocking broadcasts by default. All computers fall into 255.255.255.254 and rely on tight enforcement of shared communication as a reasonable start.
    A second may be for all communications channels to be flagged with security credentials of the communications user (or machines), or anonymous for completely un'authorized' communications and rely on block by default as a sane start. Allow 'users' to reach out to unsecured locations if you like, but make sure that their connection to secured resources are a lot harder to reach (and fully audited when performed)

    Anyways, this is a huge problem which is at least in part to why this happens over and over again. I could say X, and 100 experts will give me 101 answers to why its the most stupid solution in the world, so.... enjoy!

    • I'm not really sure what network and OS security has to do with application security?

    • Re: (Score:3)

      by dnaumov ( 453672 )

      I keep hearing about this breach and that breach, but what I'd love to see are some seriously ambitious groups of skilled security engineers standing up to help encourage good security practices that are widely recognized and standardized.

      According to the people with actual decision-making power, this would be too expensive. The end.

  • so it wasn't real anyway.

  • Hmm... Source Code... (Score:3)

    by wjcofkc ( 964165 ) on Tuesday October 29, 2013 @06:08PM (#45273863)
    While I fully realize that it would be both wrong and illegal, with the Photoshop source code in the wild, is it possible some of it could added to or at least quietly re-engineered into OSS projects? Real CMYK support for Gimp would be like birthday + xmas combined times a million.

    • Re: (Score:1)

      by Anonymous Coward
      Then it would have years of intense auditing. See: ReactOS

    • Re: (Score:2)

      by fatphil ( 181876 )
      If GIMP wanted CMYK, then it could have done it a decade ago when it was first asked for. When they were laughed at for not having it. Repeatedly.

      • Re: (Score:2)

        by wjcofkc ( 964165 )
        Yea, I know. But I can still dream!

      • Re:Hmm... Source Code... (Score:4, Informative)

        by XanC ( 644172 ) on Tuesday October 29, 2013 @06:26PM (#45274057)

        According to their FAQ:
        http://www.gimp.org/docs/userfaq.html#cmyk [gimp.org]

        "It is clear from the product vision that GIMP eventually needs to support CMYK, but it is impossible to say when someone finds the free time and motivation to add it."

        So they're not anti-CMYK, it just hasn't been done yet.

        • "It is clear from the product vision that GIMP eventually needs to support CMYK, but it is impossible to say when someone finds the free time and motivation to add it."

          Sounds like another open source project with inappropriate funding. Sometimes it's nice to use commercial software just because of that: when the company can throw good cash at developers, they are motivated to work hard on new features.

          • Re:Hmm... Source Code... (Score:5, Insightful)

            by 0123456 ( 636235 ) on Tuesday October 29, 2013 @06:52PM (#45274311)

            Sounds like another open source project with inappropriate funding.

            They have much more important things to do. Like crippling the 'Save As' window so it can now only 'Save As' GIMP format, and you have to 'Export' to save a JPEG.

            • Re: (Score:1)

              by Anonymous Coward

              Nah, this is a great change. Export remembers your last used settings too.

        • Re:Hmm... Source Code... (Score:5, Interesting)

          by mark-t ( 151149 ) <markt.nerdflat@com> on Tuesday October 29, 2013 @06:46PM (#45274255) Journal
          CMYK and more should be there for 2.10, once GEGL [gegl.org] and babl [gegl.org] are fully incorporated.

      • Correct, like 16-bit support, native RAW support, single-window GUI (that they fixed in the last version, after many years of discussion), and a name that makes sense.

        It's not that the GIMP people will ever go and say "see, we told you that CMYK support is useless, who's laughing now?". Granted, almost nobody cares about CMYK support in GIMP, but the software still has a looong way to go and why shouldn't they want to have CMYK support?. I work with it almost daily as a hobbyist photographer and there are

        • Re: (Score:1)

          by Anonymous Coward

          The GIMP was finished after they put in the lens flare and beveled edge effects.

        • Re: (Score:3)

          by fatphil ( 181876 )
          Being an amateur photographer, I wanted to design my own business cards for one of my businesses. Being exclusively linux/FOSS, I tried GIMP. On screen, I was quite proud of what I'd designed. Until I saw it on card.

          Alas, my bold ambers came out a kind of bilberry blue in the test run of the cards. It's my belief that until I've got end-to-end RAW/CMYK, all I will be able to do is tweak curves and pay for another test run (less than 5e for 36 cards, and the kinds of people I'm giving these to don't care abo

        • Did they ever fix the problem with layers not being unbounded? In photoshop, the size of a layer is effectively infinite. in the sense that it doesn't get clipped to the image extents. In GIMP, the layers are of a fixed size, and anything pasted into them is clipped to the image size.

          Also, if I move a layer so that it's partially off the image, I now can't draw into parts of that layer.

          Madenning.

          • Layers have their own size, potentially distinct from the image size. You can make the layer larger than the image boundaries.

            • I know that, it's just an unnecessary imposition of an implementation detail on my workflow. Why should I have to bother? Photoshop's layer's have never behaved like this, and neither have the layers in any image editing application I've ever used (Corel Paint, Paint.NET etc).

              it's just another example of Gimp's problems, that it seems unlikely will ever be fixed. And I find it hard to imagine a scenario in which Gimp's fixed size layers would ever be anything other than annoying.

      • Yes, but now that the Photoshop source is leaked they could just copy-paste the CMYK code into their project and hit compile.

    • That's a good idea. Hopefully, it will turn out like *BSD/ATT/Linux - while Adobe spends 10 years suing GIMP over the source code, a better image program will be developed by an asshole Finn with terrible body odor.

    • While I fully realize that it would be both wrong

      Illegal perhaps, but there's nothing wrong about it.

  • That way when there's a breach your creative suite files can rain on 50 different countries at the same time, all at the speed of light.
  • Bring it! :D

  • Why was the sourcecode even on the server? (Score:5, Insightful)

    by Nyder ( 754090 ) on Tuesday October 29, 2013 @06:23PM (#45274017) Journal

    Anyone else wondering why the sourcecode was even able to be accessed? Seems like a stupid thing to have on a web server, or able to access from a web server.

    That's like leaving a laptop sitting on a seat in car while you are out shopping/whatever.

    • Didn't the article say that they stole a ton off usernames and passwords?

      You could try to use those username-password combinations as your dictionary and try to connect to a server that you believe provides access to the source... All it takes is one developer with source access who's sloppy with his passwords.

      • That would still leave tens of millions of usernames that do not have access. Any half-way decent security software should see failed login attempts from a certain range of IPs and blacklist it - or at least flag that server's admin and Adobe's Information Security team.Source code should also not be kept on a server in the DMZ. So either
        1) Adobe was a complete idiot and had zero security
        2) Adobe's VPN system got compromised and the internal network has little security (possible)
        3) it was an inside job (my

    • Re:Why was the sourcecode even on the server? (Score:5, Funny)

      by Anonymous Coward on Tuesday October 29, 2013 @09:32PM (#45275575)

      You think that's bad? GIMP puts all of their source and even the bug tracker on publicly accessible web servers.

    • Re: (Score:2)

      by Gogo0 ( 877020 )
      after penetrating the webserver, you use that as a staging area to launch attacks on other parts of their internal network that are now visible to you.
      oftentimes admins use the same credentials across many different assets, so information gathered from penetrating their webserver can be used to gain access to other systems.
      of course, this is what DMZs, ACLs, and other security measures are meant to mitigate.

    • Have we gotten a full accounting of what kind of breach it was or how it happened? They may have compromised an internal system.

  • Such is the beauty of the cloud to cybercrooks. (Score:3)

    by Dega704 ( 1454673 ) on Tuesday October 29, 2013 @06:29PM (#45274097)
    Even the best of security practices does little to dissuade them when all of the eggs are in one basket.

  • Organisation-wide failure - /. hubris spot-on? (Score:3)

    by Bearhouse ( 1034238 ) on Tuesday October 29, 2013 @06:56PM (#45274349)

    I know it's popular to rubbish Adobe here, but this report, if true, would seem to justify the Adobe-hate.
    And I say this as someone who has happily used many of their products over the years, (although less so, lately).

    Yes, we all know security is hard, but if you're a leading tech company with internal safeguards so lax that one breach can leak both user IDs and source code well, frankly, you're shit.

    • Re: (Score:2)

      by DMJC ( 682799 )
      Actually if I was a major tech company, I'd buy a second fibre line that's not connected to our website/internal systems for hosting stuff like the sourcecode. Sure Adobe.com is a target but I bet picturepaintingdev.com would be left alone.http://it.slashdot.org/story/13/10/29/2047228/adobe-breach-compromised-over-38-million-users-photoshop-source-code#
  • Wow, and Adobe is so into security. It's practically their specialty. By the way, this isn't a commonly known fact but their user support forums make 4chan look sincere, civil, and helpful by comparison.

  • I understand this is /. but I don't understand why every "insightful" post is against Adobe. Adobe has marketed to to their users. Their market is not an opensource market. Their market is people who want something that works. Their IP is priceless and I believe their "Cloud" platform has been correctly. Up until they offered Creative Cloud I never had a licensed version of an Adobe product. I now have a licensed adobe product on my home and work computers. They are not evil by any means. My subscri

    • Your subscription can lapse and you can still work with it? I don't think you read the fine print. You can no longer buy it nor can you license it. You rent it. You stop paying, you stop playing.

      • By "lapse" I meant "failure to have funds to pay on time" And "still work with it" I meant, you don't instantly loose access to the product. You don't need to be connected to them 24/7 for access to the product. A common misconception because they call it a "Cloud".

        It really isn't a "Cloud" based product. It is just a monthly licensed product. They do offer "Cloud" based storage, but you do not have to use it. It is merely a convenience for those that want it.

        Yes you are "renting" but I believe in thei

  • I was hoping some civic minded cog from Adobe would release some of the good code for the rest of us to study, reverse-engineer, and add to some libre software. Once knowledge is 'out there', it is hard to suppress. Adobe uses their powers to control and enslave users to a so-called cloud to force users to pay a 'tribute'. The barber cannot buy but must rent scissors. I want to see a libreoffice version of adobe suite soon.

Slashdot Top Deals

Love may laugh at locksmiths, but he has a profound respect for money bags. -- Sidney Paternoster, "The Folly of the Wise"

Close