Dangdang risked damage to goodwill of significant risk throughout the network to freeze accounts of decision-making, has been the result of Congress give consent. 74 hours, what happened? On March 23, dangdang, Senior Operations Director Liang Jianpeng was surprised to find, from the 19th to the 22nd, 74 hours, dangdang, all of the user accounts were frozen only 6-bit call dangdang reflect account exception.
Another Liang Jianpeng more catch. 19th dangdang on approximately 500,000 accounts have balances and gift card issued to users of the SMS, the message. In accordance with their own ideas, you must have at least 80% customers to modify their own password. But in fact, these three days of data display, only 5% users cannot change their passwords.
Dangdang risked damage to goodwill of significant risk throughout the network to freeze accounts of decision-making, has been the result of Congress give consent, it was a miscalculation of the crisis? What prompted the dangdang CEO Francis Chan emergency made the decision, 74 after what happened in hours?
Signs
Dangdang abnormal user accounts as early as a month ago, there have been signs of the phenomenon.
According to dangdang Liang Jianpeng memories, head of customer service center, there are several sporadic user complaints in February, saying his password or login will not go on.
Dangdang temporary developed a number of targeted measures to help user return to normal use. But because of the distance from CSDN account was stolen two months have passed, the two most of the users of the Web site contact ratio is not high, and CSDN is user weapons leaks, exception occurred when dangdang was just a few users, dangdang and therefore cannot conclude that exception must CSDN event-related user accounts.
When dangdang analysis concluded that there may be users usually are not careful disclosure of your account information online-for example in public, or is revealed to his friends and family, disclosure of account number and password. Therefore only take Home notice reminding users on, due to a CS-DN event, requests the user to change the password to ensure your account security.
“Quiet”, in the first week of March, almost nothing happened.
But in the second week of March, suddenly began to have many users complained to dangdang, reflecting their account exception, unable to log in, the amount is wrong, or is there a strange order, sometimes as many as twenty or thirty complaints a day. Dangdang, customer service and technical staff have been aware that things are not so simple, much more serious than expected.
They urgently measures to dangdang, head of programmes at the same time the first time CEO Francis Chan reports on this matter.
Freeze all user account in the of balance and gift card, is 19th morning dangdang CEO Francis Chan convened of a times more sector meeting Shang made of decided–this by customer service center, and Technology Department, and method works Department and operation Department all sector responsibility who total seven people participation of emergency meeting actually in day morning and afternoon held has two times, morning of meeting by Francis Chan personally decided, decided freeze all has gift card and balance of account, by SMS and message of way notification all user Internet modified password, all user loss Dang Dang to compensation And alarm to the public security organs.
19th afternoon, Francis Chan meets again, summarizes the implementation of the decisions, and immediately set out to arrangement payment process improvements–before making payment to receive a verification code. Francis Chan to see the data is, freezing from mid-February to March 19 before user accounts, account exception reports a total of 197 cases, losses ranged from dozens of accounts amount to hundreds of, only a very high amount of individual accounts.
Dangdang subsequently issued a public statement recognized the fact that some user accounts being stolen. Francis Chan indicates, to by SMS, and message, all way notification all user quickly to dangdang up change password, and check themselves of account is has is piracy, to reduced user and Dang Dang themselves of loss–despite method works Department think Dang Dang may does not needs burden full responsibility, but Francis Chan adhere to loss of account to full, and batch compensation, plans time period is two week, course, to in verified the user does was has loss zhihou.
Francis Chan and his team to face at this time is the first difficult problem, how many user accounts being stolen, lost what? For the Internet company, only through their own website news, SMS and email reminders for users logged in your account, change your new password and check gift card balances, account for exceptions. In fact, they are most concerned about is that the user was stolen but have not yet noticed.
Another thorny issue is that the stolen money and loss of what-if is the order that has already occurred, dangdang, not only loss of the goods, compensation to the users, equivalent to twice the loss.
Francis Chan believed that although dangdang may not need all of the responsibility on the legal, but in reasonably dangdang, it cannot live up to the user’s trust, must be compensated in full – even millions of dollars.
Francis Chan in the hope that in three days time, most users updated their own password. He so much commitment to freeze all funds, gift card account and cost reasons, perhaps due to Chinese users on the importance of password security as if A4 paper color light.
Blame weak passwords
According to dangdang, judgment, are some criminals steal the account and password of the user to operate. In fact on some slightly more technically speaking this is easy, now that many users on different sites using the same account name and password, to leave the criminals a chance to steal.
The largest manufacturers of network security 360 Safety Center at the end of 2011 has published a guide to the password security, according to the national list of popular dictionary of password cracking software break, finishing up 25 most commonly used among Chinese Internet users “weak”.
According to the 360 security experts to provide this information, Chinese Internet users commonly used TOP25 “weak”, there are 9 identical to foreign Internet users habits. Which, with the exception of password, abc123, ILOVEYOU, QWERTY, the world’s definitive “weak”, the rest are digital combination.
Simple number combinations, seems more is the most loved Chinese Internet users, account for nearly half of the list. For example, “666,666″ and “888,888″ auspicious number, almost all Chinese hackers of passwords in the dictionary, and “5,201,314″ (I love you forever) apparently placed by people of strong feelings, for Chinese characteristic “weak”.
Common Internet users “weak” mainly includes the order of simple number combinations, combinations of characters, combination of adjacent character combinations and special meaning, the four categories. And from the Chinese version of “weak” list, domestic Internet users accustomed to setting 6-character password. TOP25 18 6-bit characters, are up to 72%. In addition, “a1b2c3″ and “p@ssWOrd” password of such combination may seem complex, is also in the hackers to focus in the password list.
If the system account or other Accounts using these “weak” password can easily be exploited by hackers dictionary automatically “Mongolia”, resulting in leakage of personal information, and even property damage.
Francis Chan accounts frozen for three days in an attempt to 80% the dangdang users to set a strong password for their account. However three days down and exception report 6 user accounts and user to change the password of the 5% was not only the fact that Congress give consent.
What causes so that customers do not care about their property in the account?
Perhaps it is because the amount of money in the account is less, probably because some users have not received messages from dangdang accounts can be stolen, may be obtained because the gift card does not work, maybe-they don’t care about why, exactly what a dangdang staff unwilling to believe that one reason, but the possibility is very high – Francis Chan “full compensation” commitment. Also not lost if lost, why would you bother to change a password? (Text/economic observer)