Thousands of Disney+ accounts found in black market

[williamcll]

Not even a week in and multiple disney accounts have already been stolen, it is believed that it is caused by malware not linked to the service itself.

Quote

Thousands of Disney Plus accounts have reportedly been hacked and stolen — and offered for sale on underground cybercrime forums. Disney has now responded, saying only a “small percentage” of the service’s 10 million-plus users have seen their usernames and passwords compromised and that Disney Plus systems were not breached by hackers.“We have found no evidence of a security breach,” a Disney rep said in a statement to Variety. “We continuously audit our security systems and when we find an attempted suspicious login we proactively lock the associated user account and direct the user to select a new password.”The response comes after a report by tech-news site ZDNet that several thousand Disney Plus accounts were being offered for free on hacking forums or available for $3-$11 per account. It’s not clear how the credentials were poached, but the speculation is hackers “gained access to accounts by using email and password combos leaked at other sites” or by using key-logging malware, per the ZDNet report.

 

Disney pointed out that that the problem of cybercriminals stealing usernames and passwords isn’t unique to Disney Plus: “Billions of usernames and passwords leaked from previous breaches at other companies, pre-dating the launch of Disney+, are being sold on the web.”Indeed, currently, there are nearly 80,000 compromised Netflix accounts for sale from one single market, on offer for an average one-time payment of $6 per account, according to KELA, an Israeli threat-intelligence provider. Also, to put the Disney Plus hacks into context, they appear vastly smaller in scope than security breaches that have afflicted the likes of Yahoo (which said upwards of 3 billion accounts were stolen several years ago) or Facebook (which last year said hackers had accessed info on 29 million users).In the case of Disney Plus, according to Disney, “We have seen a very small percentage of users in this situation and encourage any users who are having these kind of issues to reach out to our customer support so we can help them.”

 

A big question is why hackers would purchase account info for Disney Plus or any other service — given that they would likely be disabled in short order for suspicious activity. One possibility is that cybercriminals would intend to use the login details to try to attack other services, as users often reuse the same passwords for multiple sites. According to a Google study earlier this year, 52% of consumers said they use the same password across multiple accounts — and 13% use the same password for all accounts.Meanwhile, even though Disney is telling users to contact Disney Plus customer service if they believe their accounts have been hacked, numerous users have complained that wait times remain very long for Disney Plus support. The company said Tuesday that there’s still a “high volume” of incoming help calls.The customer-service backlog appears to be holdover from the Disney Plus’ widespread technical problems on launch day, including users being unable to log in to the service at all. On Tuesday, Kevin Mayer, Disney’s direct-to-consumer chairman, said the glitches were related to “the way we architected the app,” and not because of any third-party provider.

Source:https://variety.com/2019/digital/news/disney-plus-accounts-hacked-security-breach-1203410376/
Thoughts:While I wouldn't blame Disney for this breach, the fact that so many people still use infected computers is astonishing. Another lesson in making sure to enable 2FA whenever possible.

[LAwLz]

I believe, like the author of the ZDnet article, that a lot of the accounts are people who use the same credentials on multiple sites.

If username and passwords leak from one site, and you use the same for this, then Disney+ is compromised "by proxy".

 

Moral of the story: Don't reuse passwords on multiple sites.

[Arika]

8 minutes ago, LAwLz said:

Moral of the story: Don't reuse passwords on multiple sites.

I use the same password on accounts that don't matter. Everything else, like banking, emails, paypal, anything that contains real information about me is a unique password

[D.U.F.F.]

[rcmaehl]

What to do if you are affected and don't want to wait on hold for support for 2 hours:

 

1. Check your account settings on a device you are already logged into for the current email address
2. Send a test email to the junk email set on you account (usually gmail) and see if it fails to deliver
3. Register that email account
4. Follow the normal password reset process
5. Enable the recently added 2FA
    

The current process of the account hijackers is to set a random jumble of characters as the email address as Disney doesn't require you to confirm a valid email when changing the linked email. Thankfully, this means most of the emails being set by the hijackers are invalid emails and can be easily registered with the proper email provider to regain access.

[WereCatf]

1 hour ago, williamcll said:

Diseny + already hacked

Personally, I feel the title of this thread is not only misleading, but just plain wrong: if a malicious party obtains one's credentials either via one of the billion database-leaks or via simple keylogger in some malware-package, it's not Disney+ that was hacked. Saying that Disney+ was hacked gives the impression that there is or was some vulnerability at Disney+ themselves that lead to this, but as far as I know, no such a thing has happened.

[weeblord]

Disney+ is just an absolute shitstorm right now. Everybody left after the one week free trial, and now hackers getting into it shows just how unprepared Disney was for this.

[williamcll]

1 hour ago, WereCatf said:

Personally, I feel the title of this thread is not only misleading, but just plain wrong: if a malicious party obtains one's credentials either via one of the billion database-leaks or via simple keylogger in some malware-package, it's not Disney+ that was hacked. Saying that Disney+ was hacked gives the impression that there is or was some vulnerability at Disney+ themselves that lead to this, but as far as I know, no such a thing has happened.

done

[Haaselh0ff]

Thanks for the title change, a little less misleading now. It seems that this is just a result of user error in not keeping up with data breaches to know if their passwords have been leaked and constant reuse of passwords across sites. 

[TechyBen]

5 hours ago, LAwLz said:

I believe, like the author of the ZDnet article, that a lot of the accounts are people who use the same credentials on multiple sites.

If username and passwords leak from one site, and you use the same for this, then Disney+ is compromised "by proxy".

 

Moral of the story: Don't reuse passwords on multiple sites.

Lowest of market, is easiest pickings for scams/scrapers?

[dalekphalm]

5 hours ago, weeblord said:

Disney+ is just an absolute shitstorm right now. Everybody left after the one week free trial, and now hackers getting into it shows just how unprepared Disney was for this.

What does Disney's preparedness have anything to do with this news story?

 

This is caused by people re-using the same email and password as some other account/service, and their password was already leaked.

 

In other words, the "hackers" knew what the login info was. Disney+ did nothing wrong here.

 

Also while Disney+ does lack a few features, and has some odd bugs, I wouldn't call it anything close to a shitstorm. Is it feature equivalent of Netflix? Of course not - it only launched last week!

[Tristerin]

Also me: I have two kids, Disney+ is a godsend.  

 

I am actually saving some money since this came out as I was able to cancel a couple other streaming services I had specifically for my kids.  It works well (no hiccups yet) and easily worth the sub money for my use case.

 

 

 

[weeblord]

42 minutes ago, dalekphalm said:

What does Disney's preparedness have anything to do with this news story?

 

This is caused by people re-using the same email and password as some other account/service, and their password was already leaked.

 

In other words, the "hackers" knew what the login info was. Disney+ did nothing wrong here.

 

Also while Disney+ does lack a few features, and has some odd bugs, I wouldn't call it anything close to a shitstorm. Is it feature equivalent of Netflix? Of course not - it only launched last week!

Fair enough. But the title earlier (now fixed) was indeed misleading to me. Still my fault for not reading the story before commenting.

[0p3nS4uc3-l1nux]

Hmmm 

 

i wonder who watches Disney in 2019, if you have free Animes 

Spoiler

 

[mr moose]

On 11/22/2019 at 8:00 AM, Caroline said:

Disney: blocks people from the third world from using their service

People: use stolen accounts and pirate their content

Disney:

What's any of that got to do with this?

 

A stolen account still can't be used from countries that are geo/VPN blocked.  Disney doesn't block countries for no reason, who decides not to sell a product?  No one.

And finally the accounts being sold isn't even motivated by anything other than a criminal wanting to make money of some else's (in this case a private individual) personally paid for product. It has nothing to do with distribution issues in the slightest and nor are they stealing from Disney, they are stealing from users like you and me. .

 

[amdorintel]

On 11/21/2019 at 6:19 AM, WereCatf said:

I feel the title of this thread is not only misleading

agreed but the op wants lots of clicks and get linus to read it and hopefully put it up on wan show

 

however the title simply states the accounts have been hacked, not disney itself, so i can see how the reuse of pw's and lead to their accounts being hacked into, very simply

[captain_to_fire]

Use a password manager people. It's not that expensive. 

[Trik'Stari]

On 11/21/2019 at 7:21 AM, LAwLz said:

I believe, like the author of the ZDnet article, that a lot of the accounts are people who use the same credentials on multiple sites.

If username and passwords leak from one site, and you use the same for this, then Disney+ is compromised "by proxy".

 

Moral of the story: Don't reuse passwords on multiple sites.

What I'm getting from this: Don't use these streaming services at all, because they take security about as seriously as they want to provide a good value for the money they ask for.

 

Honestly, I'm wondering when some executive is going to get caught selling the credentials on the black market just to try to increase quarterly profits.

[LAwLz]

2 minutes ago, Trik'Stari said:

What I'm getting from this: Don't use these streaming services at all, because they take security about as seriously as they want to provide a good value for the money they ask for.

 

Honestly, I'm wondering when some executive is going to get caught selling the credentials on the black market just to try to increase quarterly profits.

What? Why not use streaming services?

The credentials aren't stolen from streaming services, they are stolen from everywhere (and probably from things like keyloggers).

The problem is that a lot of people reuse the same passwords everywhere. For example they use the same password and login info on Disney+ as they did on their xXxNoScopeVidsxXx.info website.

This is not at all a problem you can push on to streaming services.

[TechyBen]

On 12/7/2019 at 1:09 AM, mr moose said:

What's any of that got to do with this?

 

A stolen account still can't be used from countries that are geo/VPN blocked.  Disney doesn't block countries for no reason, who decides not to sell a product?  No one.

And finally the accounts being sold isn't even motivated by anything other than a criminal wanting to make money of some else's (in this case a private individual) personally paid for product. It has nothing to do with distribution issues in the slightest and nor are they stealing from Disney, they are stealing from users like you and me. .

 

I'd assume "country of residence" fails to allow an account from that country. Only partially sensible, as true leet PC users know to VPN *before* setting up the account. The unwashed masses less so. 

 

(But IIRC billing address etc can also prevent sign up/payment, so a stolen account is still partially more desirable to some, that and just $$$ cheaper if black market)

[Trik'Stari]

1 hour ago, LAwLz said:

What? Why not use streaming services?

The credentials aren't stolen from streaming services, they are stolen from everywhere (and probably from things like keyloggers).

The problem is that a lot of people reuse the same passwords everywhere. For example they use the same password and login info on Disney+ as they did on their xXxNoScopeVidsxXx.info website.

This is not at all a problem you can push on to streaming services.

Fair enough, but I could make the argument that the fewer accounts I have the less likelihood I have of a breach occurring with my information in it.

 

I'll admit I hate the streaming services for becoming exactly what people did not want them to become. I'll give it maybe 5 years before they start including advertising because "we need it to continue existing".

[BuckGup]

That’s what you get for supporting Disney+ and anti consumer practices 

[dalekphalm]

2 hours ago, BuckGup said:

That’s what you get for supporting Disney+ and anti consumer practices 

Do you understand what you just said? Did you read the article or at least the summary of what happened?

 

Disney+ is fantastic value, btw. Even more so for those who have kids.

[BuckGup]

2 hours ago, dalekphalm said:

Do you understand what you just said? Did you read the article or at least the summary of what happened?

 

Disney+ is fantastic value, btw. Even more so for those who have kids.

I understand what happened the point being Disney+ is just another channel to subscribe to with your internet cable subscription. Now all of Disney's content, which they are getting crazy big, is going to be pulled from competitors or they will be forced to pay insane royalties causing the prices of the other services to increase. Disney+ wouldn't exist if the consumers boycotted it

[dalekphalm]

4 minutes ago, BuckGup said:

I understand what happened the point being Disney+ is just another channel to subscribe to with your internet cable subscription. Now all of Disney's content, which they are getting crazy big, is going to be pulled from competitors or they will be forced to pay insane royalties causing the prices of the other services to increase.

And?

Quote

Disney+ wouldn't exist if the consumers boycotted it

Yes this is key. Welcome to capitalism. Consumers have decided that Disney+ is a good service well worth their money.

 

Disney owns the rights to their own content. They can largely do with it as they so please.

 

Unless you're suggesting that the US Government (and other worldwide ones) step in and force new regulations on Disney+ forcing them to share their content licenses at a "reasonable cost"?

 

I wouldn't be opposed to that, necessarily. But it would definitely take away a lot of the rights and freedoms corporations currently enjoy.

 

Point being, you can't single out Disney+. Any streaming site with exclusives are all equally "bad" (which is... yep, just about all of them).

 

Hell, Netflix started this trend with their first streaming exclusives back in 2013.