Abstract

We will often keep an eye on current events to find practical examples to use as evidence in support of our recommended best practices, but a relatively recent Spotify hack has given us a special opportunity. We now have the opportunity to use this one story to reinforce not one, but two such practices. Let’s dive in, shall we?

Lesson One: Don’t Reuse Your Passwords

Basically, hackers were recently able to access 350,000 Spotify accounts without needing to infiltrate the streaming service. Rather, the hackers responsible used login credentials from other sites and services that had been exposed in other data breaches.

By taking the credentials from these other websites, these hackers simply went down the list and tested them out on Spotify. Known as credential stuffing, this is a very simple tactic that hackers will often use.

This kind of thing is what takes the already-bad password breach and makes it terrible, only getting worse with each platform secured by the recycled credentials. Practices like credential stuffing are precisely why the prevailing wisdom to have a unique password for every account you have—particularly work accounts or those with sensitive or financial data—exists. It also doesn’t hurt to have these passwords locked away in an encrypted password management tool if you need help remembering them.

Lesson Two: Keep Your Data in a Safe Place

The second lesson actually comes from the actions of those responsible for the breach. From them, we can learn how important it is to secure any data you are in possession of.

After all, their failing to do so led to the discovery and mitigation of this breach in the first place.

Two security researchers were conducting a simple Internet scan for unsecured data, including some which was present in the attacker’s cache. The hackers had chosen to store their stolen credentials on an unsecured cloud database. In doing so, anyone who happened to stumble upon the collection could gain access without a password. Hypothetically speaking, this meant that other hackers and cybercriminals could have located the stash and copied them for their own nefarious purposes.

Fortunately, this discovery allowed Spotify to be alerted and prompt a password reset for all affected users… for Spotify specifically, that is. There’s still the potential for those credentials to be used elsewhere on the Internet for unauthorized access.

Therefore, the real lesson here is to make sure that your cybersecurity standards are up to par. NetMGM can help you do that. Reach out to us at 888-748-2525 to learn how our managed services can assist your cybersecurity without negatively influencing your productivity.

ABOUT THE AUTHOR

Cybersecurity Lessons to be Learned From a Spotify Hack

Rafiq Masri

With over 25 years of experience in Information Technology, Rafiq is one of the most accomplished, versatile and certified engineer in the field. He has spent the past 2 ½ decades administering and supporting a wide range of clients and has helped position Network Management, Inc. as a leader in the IT Managed Services space.

Rafiq has built a reputation for designing, building and supporting top notch IT infrastructures to match the business objectives and goals of his clients.

Embracing the core values of integrity, innovation, and reliability, Rafiq has a very loyal client base with some customer relationships dating back 20+ years.

Rafiq holds a bachelor’s degree in Mechanical Engineering from the University of Michigan and has completed graduate programs in Software Engineering and Business at Harvard and George Mason University. Rafiq is a former founder and CEO of Automation, Inc. in Ann Arbor, Michigan as well as a valued speaker on entrepreneurship and technology at industry events such as ExpoTech and others.