Wiggle says customers’ login details were obtained externally by hackers to access accounts

One common trick is to have the orders mailed to addresses in blocks of flats, etc. with a common mail delivery area. Then they just loiter around the area and collect the parcels before the real occupants of the addresses turn up to check their mail.

Another is to rent space somewhere using fake details, place a large number of orders all in one go to be delivered to that address, then disappear after a few days before the police turn up (and without actually paying the rent).

Of course it doesn't really matter to them whether they actually take delivery of all the packages (if some are delayed, or the real address owner gets to them first) since they're not paying for them in the first place.

You'll notice that none of the affected individuals have stated they *do not* reuse passwords, quite the opposite, they're defending the practice.

Oh, who is defending the practice of using shared passwords?

You, in a "well people will just keep doing it" sort of way.

I don't.

I think you misunderstand me, perhaps deliberately. I am looking at this from the perspective of the Wiggle. Implementing a system for use by humans, known to be wide open to common human failure, is poor practice. They could know in advance what percentage of customers will come a cropper using it, it's a forgone conclusion. Presumably, as has been mentioned, they just figure it yields better business returns that way, even accounting for bailing them out.

Secret_squirrel wrote:

Hmm if this is true Wiggle should explain who the external provider is, and why there appears to be a significant overlap with Wiggle customers.

Has road.cc checked to see if there's been any suspicious activity on their servers? 

Quite possible that the breach is elsewhere. On this forum we would hear about users with shared passwords who buy bike parts. Maybe there is a forum out there where users are complaining their favourite hi-fi online store is hacked, and somewhere else that someone is buying expensive designer clothes. We just happen to be focussed on the wiggle users.

Easyjet was hacked a while ago, maybe those are the source of the stolen passwords.

Meanwhile I've changed mine and deleted my card (I use PayPal anyway)

I think you have the right idea.

Here's what I think happened.

1. People complain about suspicious orders to Wiggle

2. Wiggle InfoSec dept (probably very small and understaffed) do some triage and can find no evidence of a hack, yet people continue complaining

3. Out of their depth, they call an external Cyber Forensics team in (Mandiant or someone of that ilk)

4. The first thing Mandiant will do is ask for the 'hacked' userid/email addresses so they can compare them against compromised accounts (Mandiant and other companies are well connected and will be privy to compromise data that me and you don't get to see). They do this first because if they get a match, it saves a whole heap of investigative work which might take months to finish.

5. Mandiant tell Wiggle there's a match

Usually, Mandiant (or whatever company) won't tell them the source of the compromise, so Wiggle probably won't even know where it came from.

Wiggle's investigation lasted about 48 hours, which is about right when they get a match on a set of credentials elsewhere. Don't expect Wiggle to say "yeah, we got it from easyjet/linkedin/whatever" because they probably won't have been told.

If there was a security vulnerability on Wiggle's site, you can bet there won't have been just the odd victim, it would have been a fireball and you'd read about it everywhere, they'd also close the site.

Edit to add: We must also not exclude the possibility of a key logger/virus on the 'victims' machine.

Last post on this!

I agree its entirely possible, but thats not relevant. 

If I have evidence they have provided access to my PII without my explicit consent they are liable under GDPR unless they can prove otherwise.   If I have reasonable evidence of a Wiggle PII leak, I'm not required to go around trying to prove it came from somewhere else - thats Wiggles job, and its the job of the ICO to hold them to account for it.   If Wiggle can show that all the breaches were external to the satisfaction of the ICO all well and good and fair play to them.  Just Wiggle sayin' its so isnt good enough.

On a lighter note - what if the "external provider" is CRC?  I'd lol. 

How many times do retailers need to be told not to use simple username/password systems?

What do you expect them to do? Implement 2FA and Conditional Access? When people can't even be trusted not to re-use passwords because it's not convenient for them?

I expect them to stop pissing in the wind. Two thirds of people reuse passwords, according to:
https://www.infosecurity-magazine.com/news/google-survey-finds-two-users/
Telling them they should not is futile. Admonishing them like you were their witless parent is even less useful.

People will reuse passwords, that's just a fact. But not implementing 2FA or 3d-secure, and not asking for confirmation of an email change on a service that allows you to make purchases with saved cards,  is a explicit decision Wiggle have made somewhere along the line. 

Indeed. And orders placed from novel devices on novel IP addresses simultaneously requesting novel delivery addresses - all secured by a username/password system which everybody knows fosters poor security hygiene, and no one knew it could happen. Sure, blame your customers, sounds like a business plan.

It's all about stopping buyers from ending transactions prior to checkout. Amazon do it too - saved cards, no CVV requirement, able to send to any address. They're willing to take the hit because making checkout harder would impact sales much more than the occasional fraudulent transaction.

Sriracha wrote:

Indeed. And orders placed from novel devices on novel IP addresses simultaneously requesting novel delivery addresses - all secured by a username/password system which everybody knows fosters poor security hygiene, and no one knew it could happen. Sure, blame your customers, sounds like a business plan.

If you block novel IP addresses, you also prevent people shopping on mobile phones connected to a mobile network and laptops in cafes/on trains etc.

When a driver close-passes a rider on a section of narrow road, do you blame the council for not widening it?

I think it was the 3 way novel combo that was being flagged as a security issue for further checks.

Sriracha said nothing about blocking.   You just put additional security confirmations in place.

srchar wrote:

When a driver close-passes a rider on a section of narrow road, do you blame the council for not widening it?

Actually, yes - you nailed it. Good road design accounts for human failure. Where a poor layout leads to repeated accidents you can point your finger at drivers not driving appropriate to the conditions, and keep enlarging the cemetry, or you can fix the road layout.

Sriracha wrote:

srchar wrote:

When a driver close-passes a rider on a section of narrow road, do you blame the council for not widening it?

Actually, yes - you nailed it. Good road design accounts for human failure. Where a poor layout leads to repeated accidents you can point your finger at drivers not driving appropriate to the conditions and keep supplying the coffins, or you can fix the road layout.

We'd better rescind every driving penalty ever issued and sue the councils then.

Abandon personal responsiblity all ye who drive here.

srchar wrote:

Sriracha wrote:

srchar wrote:

When a driver close-passes a rider on a section of narrow road, do you blame the council for not widening it?

Actually, yes - you nailed it. Good road design accounts for human failure. Where a poor layout leads to repeated accidents you can point your finger at drivers not driving appropriate to the conditions and keep supplying the coffins, or you can fix the road layout.

We'd better rescind every driving penalty ever issued and sue the councils then.

Abandon personal responsiblity all ye who drive here.

Responsibility isn't all or nothing - it can be shared around.

In this analogy, the close-passing driver would be most akin to the fraudsters / hackers, the council / planners to the website developers and the banks, and the customers to the people cycling.

Blaming the customers is like critcising people for riding too close to the kerb and not further out to discourage the passes. There might be some truth to it, but they're just responding as humans do, and it's a distraction from addressing the real problem.