QANTAS Cyber Incident

[MrMickeyg]

has anyone got an email yet about being directly affected?

Post automatically merged: Yesterday at 2:59 PM

has anyone got an email yet about being directly affected?

 

[DejaBrew]

has anyone got an email yet about being directly affected?

Don't think everyone has received the initial email yet, let alone the one confirming direct impact. Also, per the AFF article posted earlier in this thread, "...Qantas did not immediately have an answer to our question about how long customers might need to wait to find out directly whether or not they are impacted."

 

[kamchatsky]

Oh, I think that is harsh! I am sure they monitor the storage requirements for the collected data! How much gets read, yes that is the question. Assume a growing involvement of AI in SIEM review, but where QF are up to is anybody's guess.

Yes they can increase storage requirements, but someone would actually need to configure/program the SIEM properly to pick up unusual data in the logs for alerting to the SOC. Sending raw logs to SIEM doesn't really do much. Even with events integration, a whole bunch of filters and rules would need to be setup to identify issues from a sea of events.

 

[bussyboy]

Unless qantas decide to unilaterally stop redemptions, points transfers, etc., is anyone really "impacted"?

I trust the 2-FA to do the work and protect accounts.

 

[SeatBackForward]

Don't think everyone has received the initial email yet,

Received mine at 1:18pm AEST.

 

[bussyboy]

27% of all pins are the most common 20 numbers as can be seen on this page:

Information is Beautiful

Distilling the world's data, information & knowledge into beautiful infographics & visualizations

informationisbeautiful.net

If you guess 3 numbers from the 20 most common pins you would likely be successful compromising 243,000 of the 6 million accounts.

Very interesting - none of my PINs make either list. I would expect and hope people use different pins for different uses, one pin for secure things like financial institutions, and a different pin for say, your gym locker - may be naive thinking!

if I were guess PINs of AFF members, I'd be looking at 7474, 7879, 3303, etc...

 

[gtrod]

Waste of time, compute power and cost for such little gain. Its cost to reward ratio doesn't make as much sense.

Points definitely have value. Clearly there's some value or Qantas wouldn't have been targeted in the first place.

There's not much compute power required for a login. Distribute login requests amongst a million member botnet. Have each device try a few logins. Do one request per device per day if you want it to fade into the background.

If you were the attacker who stole this data, and also had access to the FF's e-mail address or ported their mobile numbers, and they weren't using an authenticator, and weren't stopped when iterating through 6 million accounts, sure.

I guess the issue is you only get to the SMS/authenticator verification after you've got the PIN. Getting that far in the process indicates you've guessed the PIN successfully.

I can't think of any 2FA being used when making requests via phone. Maybe it's different if you have the authenticator app installed, but for me it's only ever been FF#, pin, and then some quick verbal questions by the phone agent.

Again the importance of any one control can't be downplayed but shouldn't be exaggerated either.

Things will be fine until they aren't. Better to get ahead of it and make changes now.

 

[moa999]

Yep, Qantas need to immediately change their verification to something better than 4 digit pin.

Anyone with any significant number of points should already have setup an authenticator for QFF access

 

[DejaBrew]

Anyone with any significant number of points should already have setup an authenticator for QFF access

Irrespective of the number of points they have, I think everyone should have set up an authenticator.

 

[SeatBackForward]

Waiting for Executive Traveller's post to show how this is going to be a game changer for QFF members, like they promoted Classic plus last year

They just pushed out another email, completely ignoring the incident.

 

[DejaBrew]

They just pushed out another email, completely ignoring the incident.

Makes sense given it doesn't even rate an article on their front page. In fact, today's only articles appear to be -:

1. Photos: inside Qantas’ newest jet, the A321XLR
2. Travellers caught out by China’s powerbank battery ban
3. The last Qantas A380 returns this year

 

[Aeryn]

Makes sense given it doesn't even rate an article on their front page. In fact, today's only articles appear to be -:

1. Photos: inside Qantas’ newest jet, the A321XLR
2. Travellers caught out by China’s powerbank battery ban
3. The last Qantas A380 returns this year

It is on the home page of the website and the app:

 

[DejaBrew]

It is on the home page of the website and the app:

View attachment 454805

It was in reference to Expert Executive Traveller

Edit: Corrected

 

[MEL_Traveller]

Ha! my notification got auto placed in the spam folder

 

[shak151]

They just pushed out another email, completely ignoring the incident.

They just posted the old stock images of A321XLR

 

[Franky]

Qantas reporting a cyber incident at a call centre.

QANTAS news Room

The way things are going these days, it's probably more like who's not having a cyber incident??

 

[RSD]

Manila - who would have guessed?

 

[trippin_the_rift]

Risk management in the investment committee is remarkably straightforward—just ignore it or bump it down the priority list. After all, what’s the worst that could happen? A sternly worded letter from the OAIC and a mildly uncomfortable public apology? Hardly worth losing sleep over when there are financial targets to hit and bonuses on the line.

Until Boards and Executives start facing personal financial consequences—actual, tangible punitive damages, performative risk management will remain BAU.

I've gone through many airline security assessments, and they're insane. Much more difficult than non-airlines.
One must remember that 'safety' is a subjective concept. There is no such thing as 'safe' or 'not safe'. There are only standards, procedures, policies, training, etc. Nothing is and will ever be 100%.

Unless you want a chip in your arm.
The government might try to sell that to you next.

2030 here we come!

 

[Pushka]

They just pushed out another email, completely ignoring the incident.

We are still waiting to 'be advised' by the first email.

 

[LondonAussie]

I haven’t received an email from them yet either, not that it will tell me anything more than is in ABC news or elsewhere.

I’m hopeful I’ve got no email from them because my data wasn’t impacted by this. But it could also mean I’m in a different ‘impacted customer’ batch which will be sent a different email later…

Or perhaps because I’m based in the UK they may have to send something slightly different to comply with GDPR legislation?