WHY BUSINESSES ARE WILLING TO FACE CLOUD DATA MIGRATION CHALLENGES

Few organizations are concerned about the costs of transitioning to the cloud. But the advantages of migrating data to the cloud are exponential.

Virtually every business is willing to bear the short-term pain of migrating to take advantage of the long-term benefits of cloud computing:

• Mobility
• Cost Savings
• Flexibility
• Disaster recovery
• Scalability
• Insight
• Security
• Autonomous software updates

Though every organization’s business objectives are different, and strategies for moving data to a cloud-based environment also unique, most still face very similar challenges.

In this article, we discuss the top challenges surrounding the cloud migration process, and how you can avoid them.

TOP 8 CLOUD MIGRATION CHALLENGES AND PROBLEMS

– SECURITY & PRIVACY

The moment your data begins transitioning from physical servers to the cloud is when it’s most vulnerable. Take into account network security and potential vulnerabilities before beginning the migration process.

It’s advisable to check:

• What short-term vulnerabilities could the cloud migration process cause?
• Will systems be monitored for threats in real-time?
• Will data be end-to-end encrypted and backed up?
• How do the cloud platform’s security policies align with your own?
• Is it compliant with data security compliance standards (HIPAA, PCI DSS, CCPA, etc.)?

– DOWNTIME

When moving large amounts of data to the cloud, one of the biggest risks is network outages. If your data is not adequately backed up, interruptions can cause irretrievable data loss.

A potential workaround is creating a backup IT environment that can house and run applications until migration is complete. Note that it’s common for temporary servers to be unable to handle peak user loads.

In such situations, it’s best to manage user workloads and/or proactively inform users of limited capacity and occasional application unavailability.

It’s why handling cloud migration during hours of minimum demand is ideal.

– LACK OF STRATEGY

Many organizations make the mistake of failing to define their cloud strategy. Every business’s cloud migration needs vary, but a detailed cloud migration checklist can go a long way to mitigating issues.

Organizations need to focus on creating a change management plan that explicitly defines:

• Comprehensive cloud migration strategy
• Potential cloud migration issues
• Resources to support migration
• Methods to validate successful migration

It’s why many organizations work with experienced IT professionals to develop high-level plans and metrics for a seamless transition.

– INTEROPERABILITY

Not all apps that need to migrate to the cloud may be compatible with the cloud environment. Some applications work better on a private or hybrid cloud as opposed to a public cloud, other applications require minor tweaking, while others may require extensive recoding.

If you are conducting a lift-and-shift cloud migration, make sure to identify and address interoperability issues between on-prem systems and cloud services.

However, with the availability of cloud-based services from a large number of providers, interoperability is less of a concern. If not the major providers (Google Cloud Platform, Microsoft Azure, or Amazon Web Services), there are many specialized offerings that may suit your needs better.

– COST

Whereas shifting to cloud-based services will reduce costs in the medium- and long-term, the initial migration process does have costs associated with it.

Consider the costs to your organization:

• Direct Expenses – Contracts, hardware, and software licenses
• Operational Expenses – Maintenance and labor
• Administrative Expenses – Payroll, staff training, and internal system management costs

Make sure the cloud services you opt for don’t have extended vendor lock-in periods, which can limit your freedom to move to cloud services that are more competitively priced.

– ADAPTABILITY

Adaptability in cloud migration refers to an organization’s ability to co-op and become efficient with new systems and policies. 

Organizations unable to adapt often face cloud migration problems. When transitioning to the cloud, prepare business processes to operate hand-in-hand with the new architecture. That may mean taking a new approach to allocate:

• Technical resources
• Funding
• Staffing
• Authority
• Control procedures

– CAPABILITY

In-house IT teams have limited skill sets and resources when it comes to handling the rigors of cloud migration. If you’re in an industry where data security compliance standards are high and your IT staff lack proper certifications, you may be putting your business at risk.

Additional risks of cloud migration include data loss, extra latency, and incompatibility with the current IT infrastructure. To avoid these risks, consider working with an experienced IT partner or follow a cloud migration checklist.

– BANDWIDTH

Cloud-hosted applications should reflect similar or better performance than on-premise environments. However, failure to specify the bandwidth requirements for cloud-hosted applications can result in latency, poor user experiences, and negate the advantages of cloud migration.

Before migrating to the cloud, it’s crucial to map out your network constraints and bandwidth requirements.

Key pointers from Covid-19 impact analysis:

• Impact of Covid-19 on economic scenario at a global scale.
• Shifts in supply and demand share.
• Predictions for the long-term effects of Covid-19 pandemic on the growth matrix.

An overview of the regional landscape:

• Geographically, Database Security Software market is partitioned into North America, Europe, Asia-Pacific, South America, Middle East & Africa, South East Asia.
• Contribution of each region to overall industry growth is measured in the study.
• Analysis of revenues, sales, and growth rate for the key regions during the forecast period are also provided.

Request Sample Copy of this Report @ https://www.business-newsupdate.com/request-sample/10845

Other important takeaways from the Database Security Software market report:

• The report categorizes the product landscape of the Database Security Software market into On-premises andCloud.
• Estimates for the revenue and volume share of each product category is given.
• The study also highlights market share, growth rate, and production pattern of each product type over the projected timeline.
• In terms of application scope, the Database Security Software market is fragmented into Individual Users,Enterprise Users andGovernment Users.
• Market share secured by each application segment, along with their growth rate forecasts are thoroughly discussed in the report.
• Leading companies that define the Database Security Software market trends are HexaTier,Venustech Group,Trustwave Holdings, Inc.,Vamtoo,Thales e-Security,Imperva,McAfee, LLC,Huawei Technology Co. Ltd,Gemalto NV,Protegrity USA, Inc.,Oracle Corporation,Innovative Routines International,IBM Corporation,NSFocus Information Technology Co Ltd,Fortinet, Inc.,Huawei Enterprise andMicro Focus.
• The listed companies are analysed based on their gross margins, production patterns, product & service portfolio, pricing model, market remuneration, and market share.
• Major competition trends and their implications on businesses are elaborated exhaustively.
• Granular analysis of the industry supply chain, with details of the top manufacturers, providers, and consumers is included.
• Feasibility study of new project using several methodologies like SWOT analysis and Porter’s Five Forces analysis is furnished in the document.

Reasons to access this Report:

• Get to know opportunities and plan strategies by having a strong understanding of the investment opportunities in the Database Security Software Market
• Identification of key parameter driving investment opportunities in the Database Security Software Market
• Facilitate decision-making based on strong historic and forecast data
• Position yourself to gain the maximum advantage of the industry’s growth potential
• Develop strategies based on the latest reports.
• Identify key partners and business development avenues
• Respond to your competitors’ business structure, strategy and prospects
• Identify key strengths and weaknesses of important market participants

The key questions answered in this report:

• What will be the market size and growth rate in the forecast year?
• What are the key factors driving the Global Database Security Software Market?
• What are the risks and challenges in front of the market?
• Who are the key vendors in the Global Database Security Software Market?
• What are the trending factors influencing the market shares?
• What are the key outcomes of Porter’s five forces model?
• Which are the global opportunities for expanding the Global Database Security Software Market?

Significant Point Mentioned in the Research report:

• The market overview, market dynamics, market growth, etc. are cited in the report.
• The power and also business manufacturing of the significant manufacturers has been mentioned with the technical data.
• The study provides historical market data with the revenue predictions and forecast from 2020 to 2025.
• This report is a valuable asset for the existing players, new entrants, and future investors.

Table of Contents for market shares by application, research objectives, market sections by type and forecast years considered:

Database Security Software Market Share by Key Players: Here, capital, revenue, and price analysis by the business are included along with other sections such as development plans, areas served, products offered by key players, alliance and acquisition and headquarters distribution.

Global Growth Trends: Industry trends, the growth rate of major producers, and production analysis are the segments included in this chapter.

Market Size by Application: This segment includes Database Security Software market consumption analysis by application.

Database Security Software market Size by Type: It includes analysis of value, product utility, market percentage, and production market share by type.

Profiles of Manufacturers: Here, commanding players of the global Database Security Software market are studied based on sales area, key products, gross margin, revenue, price, and production.

Database Security Software Market Value Chain and Sales Channel Analysis: It includes customer, distributor, market value chain, and sales channel analysis.

Market Forecast: This section is focused on production and production value forecast, key producers forecast by type, application, and regions

Taking into account the trends for more and more businesses going online, the number of applications that will be used is also projected to increase in 2021, as are the web-security threats that go with them. That’s why it’s essential to protect your website, application, or any other instance that may be publicly accessible from these threats, which include the use of SQL injection attacks.

In this blog, we’ll explore the topic of SQL injection attacks — what it is, how an SQL injection attack occurs (using a basic example), and why these attacks are so devastating. We’ll also share some SQL injection prevention tips you can use to keep your data safe.

Let’s hash it out.

What Is SQL Injection (or an SQL Injection Attack)?

If you try to Google “What is an SQL injection attack,” you will probably see a lot of results for tech-savvy people and talking about the syntax change within the SQL queries to perform authorized commands. But let’s try to explain it in simpler terms.

Imagine that you’re going to the bank to perform the wire transfer to your friend and need to give written instructions. You go to the accountant, verify your identity and give them the paper with instructions. But after you leave, some cons have modified your instructions. They added the line that apart from the mentioned transfer, one more transaction of $700 should go to some account you don’t know.

Since your identity was verified, the accountant takes your instructions and performs the two transactions — both the legitimate and fraudulent ones.

But what does all of this mean in terms of an SQL injection attack? Being a human, you will probably check the instructions before giving them to the accountant to make sure that everything is fine. Unfortunately for you, however, a web application does not have this capability, and if the server is not protected, the attack is successful. So, if we translate it to the context of SQL injection, it’s about “injecting” an SQL query (also known as a “true statement”) via the input data from the client to the application.

A successful SQL injection exploit can:

Although these types of attacks are nothing new, they still pose major threats to businesses and users alike. According to the U.S. Computer Emergency Readiness Team (CERT):

“One reason for the persistence of these problems is that their underlying causes can be found in almost any web application, regardless of implementation technology, web framework, programming language, or popularity.”

When analyzing OWASP’s Top 10 Web Application Security Risk publication, you’ll notice that SQL injection was listed as the #1 web application security risk back in 2013. It’s stayed in the #1 spot even four years later in 2018 when the Top 10 list was last republished. It would be interesting to see where it will fall on the list in the future when the list gets republished again.

How Does an SQL Injection Attack Happen?

Understanding how an SQL injection attack works is crucial to being able to identify any exploitable vulnerabilities within your web apps and forms.

Let’s break down how this attack works. We’ll start by exploring how a user’s information is added and retrieved from a database. From there, we’ll break down how a threat actor uses SQL injection attacks to gain access to sensitive information:

How to Add and Retrieve Information from a User Database

On the account creation page, once a user is created, their information is stored in a database along with all the other users. With that being said, whenever a new user is created, an insert query is running to add the user to the database as shown below (take note of the table and columns names):

After understanding how the data is inserted into the database, let’s see how it is read from the database by looking at the login screen. On the login screen, users will be able to log in to the application using the username and password combination supplied in the account creation step. To display this information, a select query is run to retrieve the appropriate user’s information from the database as shown below where user JohnDoe12 is trying to login (take note of quotations):

How an SQL Injection Attack Works

This is where SQL injection comes into play. If you notice in the query above, we return information about the user if their username and password are contained in the database. Based on how that query was written, the user’s input was directly inserted into the query statement, which is a no-go. Because of this, an attacker can insert query-altering information to get the query to return unexpected results (as shown below):

Instead of typing in JohnDoe12, the attacker types in “‘ OR 1=1 —” as the username. The single quotation to begin the attacker’s query ends the username parameter, making the query search for users where their username is ‘’ or blank.

After the single quotation, the attacker types OR 1=1. Using common math, we know 1 will always equal 1. With that being said, this expression evaluates to true. The double hyphen (—) tells the query to comment out and ignore the remaining text, hence the green color.

Understanding these parts of the attacker’s query, the query would search for users with no username or where TRUE. Because True will always evaluate to true, the query would return all (*) users from the Users table.

Here’s a great video from Hacksplaining, which is a demonstration that breaks down a simple SQL injection attack:

Example: An SQL Inject Attack Scenario

Let’s go through a basic example together to show how a SQL injection attack would happen. In this scenario, you’re an employee for a credit monitoring company. Your company’s main product is a website where users can sign up for free credit monitoring.

To get started with the basic tier, users have to create an account where they give their name, current address, email address, username, password, and social security number. For those customers that would like to set up a premium tier, they have to give the same information as basic users, plus their banking information for Pro charges.

Why would someone want to attack a credit monitoring company you may ask? One word, data! Your company is a virtual gold mine for attackers. Not only does your company have customer emails and home addresses, but they also have social security numbers and banking information.

Why SQL Injection Attacks Are So Devastating

The consequences of SQL injection attacks may be disastrous. Personal information, passwords, and other internal sensitive data can be used to commit various crimes starting from identity theft to financial fraud. Moreover, it affects not only people whose info was stolen but also the company that was a victim of a security breach. Apart from frustrated customers, lawsuits, and compensation expenses, companies face significant reputation loss that may lead to getting out of the business.

Cybercriminals hunt personal information due to the reason that the social security number, also known as an SSN, never gets old and it’s easy to commit crimes in several months or years after stealing this information. This differs from other types of sensitive information, such as bank info and credit card details, which require more timely action on the part of criminals who wish to use this information to commit fraud or to sell the obtained data to someone else. In the hacker community, there are ecommerce stores in Darknet where people are selling the stolen information to be able to act on the received info with malicious intentions.

Now that we understand what an SQL inject attack is and why it’s so devastating, let’s dive deeper into the precaution measures that can help to avoid these attacks.

4 SQL Injection Prevention Tips to Mitigate an Attack

In order to make your web application secure and unexposed to SQL injection attacks, there are certain actions that need to be performed to defend your server:

1. Say No to Dynamic SQL and Yes to Prepared Statements

Do not include users’ inputted data directly into SQL queries. In order to achieve that, it’s necessary to disable “data interpretation” so that once data is entered into the database, it is not processed. Even if it’s written in the SQL query format, the system will not start executing it but will place the data as it is.

2. Sanitize User Input

Make sure that the special syntax recognized by SQL is restricted from embedding the commands containing different data inputs. Some data that are safe to input into the JSON files may be harmful to SQL queries and SSH commands.

3. Limit Database Permissions

Practice the principle of least privilege (POLP). When a user works on the website, for sure to do some modification, the highest-level access is required. But think twice before putting a checkmark near the “all privileges” option that grants unlimited access. Instead, you must make sure that the person who requires the highest-level access actually needs it to perform their duties.

4. Limit the Display of Specific Errors

With some login screens, if a user inputs the wrong username, an error will pop up saying “User ‘JohnDoe123’ was not found.” Being this specific opens the door for attackers to brute force logins. In other words, attackers can continue inputting random usernames until the banner no longer shows. To prevent this, you will need either limit the error display or turn it off completely. This ensures that only your internal users have access to the error log to be able to troubleshoot issues when they occur.

In addition, it’s also possible to implement the procedure on SQL injections prevention within your company, so that every time the new updates are planned, you can instruct the employees on what aspects are worth attention.

Final Thoughts on SQL Injection Attacks

While the number of SQL injection attacks is increasing, luckily for us, detection technologies are becoming smarter, which makes such attacks easier to stop. First and foremost, before starting the development:

• Make sure to outline the security requirements;
• Initiate regular code reviews by system architects; and
• Don’t forget to conduct security penetration testing before releasing to production.

If you only make changes to SQL, the vulnerabilities of other systems hosted on the server may lead to a successful attack. So, it’s necessary to take care of server-level security by:

• Installing the Firewall,
• Having anti-malware protection, and
• Performing regular updates to the Operation System, SQL, PHP, and other components as soon as they are released.

The same goes for maintaining current software versions and different themes/plugins, if applicable.

Last but not least, use only licensed software from authorized vendors as backdoors may be included in it even at the purchase stage. Also, if you’re the one who operates the service, make sure to closely follow industry news to keep an eye out for new attack methods.

Stay safe!

This article was co-written with Hardy Chichery, principal program manager at Intelnet Networks. Hardy is the founder Coin Group

Cybersecurity protection for work at home employees

Overnight, all over the world, users are staying at home – and working from home. This requires new devices and new software licenses – but what about support?

In most organizations work-from-home has many positive consequences. The employees are working hard, and they continue evenings and week-ends to get the job done. Even after the Corona-virus we now expect that work-from-home will continue on a much higher level than before the crisis. The hardware and software is in place, but the users still need support from the central IT service help desk.

Expect to see higher load, and tasks you can’t support today. Expect to see more load at unusual times like nights and weekends. If the support isn’t available, then the employees can’t do their job, and our companies will lose productivity.

It has also been reported that the cyber-criminals exploit the situation. It is more difficult for the central support team to verify if someone calling in is a real employee, or a criminal impersonating a real employee.

New tools are needed to get the support done without increasing the costs and risks for the organizations.

More calls

Many users will have new experiences and surprises. How do I print, how do I scan, where is this service, etc.? With more calls comes increased stress for the service desk; queue time for users will increase and general productivity will deteriorate for the users and the IT-team.

We hear of increases of the magnitude of 15% more calls. Look for tools to help the service desk, those that provide fast solutions through self-service, to see the total number of calls go down. On average in the industry 20% of all calls are password related. With an efficient user-friendly password self-service tool, then you can cut the number of calls back to the normal level.

The key to self-service success is that at least 80-90% of all users will and can use the self-service.

Password reset

One trivial incident will not change – users forget passwords and call for password recovery and resets. A simple question: “Can your service desk reset a password at a remote company PC?” Even when you use VPN for security, the service desk can’t access a “dead PC”.

Today for most companies the only solution is for someone to transport the PC back to company premises, so that the PC-cache password can be synchronized with the AD-password, and the user can get the PC back. This is very expensive.

What the users want is a solution where they, in a simple way, can verify their identity to a self-service, and then the PC works again. This will help the user carry on even when it happens in week-end or night time. There are out of the box solutions that solve this important technical issue.

Identity verification

When a criminal calls someone over the phone and impersonates another person to achieve something it is called vishing (Voice based phishing). When working from home this risk increases many folds.

New security issues: In “the old days,” people called the service desk from local company phones, meaning that we could verify who they were, but working from home doesn’t give us much with which to verify the user’s identity. If they ask for a password reset, how can we verify that the person is the user they claim to be?

We need a process, but even that is not enough. Social engineers, hackers, know how to use emotions to get the service desk supporters to help them. The emotions might be fear, greed or just the desire to be an empathetic person. This is what “Help desks” are for! To win this battle with the criminals we must introduce an IT-workflow that controls the entire verification process. This will take emotions out of the verification.

Controlling the ID verification should include a verbal identity “test” by the service desk. Using knowledge about what computers the real employees’ use, the location they work from, and a lot of confidential information, the test questions will be impossible for a hacker to answer. For important employees, the test can even include approval from managers in the process. It takes more time to include new persons in the process, but the cost of failure is much higher.

Just the above 3 changes to your support team will mean dissatisfied management and concerns from IT security management. It’s time to reduce the burden on the service desk and let users give themselves a better service than the service desk can. And don’t forget IT security – the hackers don’t take a break – they’re increasing their efforts right now.

A solution

With work-from-home we see how companies struggle with costs and security issues. The solution (cloud or on-premise) – can immediately help companies reduce the load on the service desk, make employees more productive, and prevent criminals from using the service desk to get access to important applications.

The basic objectives of the solution should be to reduce calls to the service desk; reset passwords for remote PC’s through a company VPN and provide rock-solid, unbreakable, user identification.

The report covers the comprehensive cybersecurity services market, and showcase a need for a collaborative approach from enterprises and service providers to make their people, processes, and technologies secure. This also explores the double threat owing to more varied and sophisticated attacks and the expansion of risk perimeter with the inclusion of next-gen technologies such as cloud, IoT, and Mobility. It helps guide enterprises around the changing dynamics in terms of identifying, selecting, and engaging with third-party outsourcers to drive resiliency.

The report features highly detailed, comprehensive AnunnakiView Profiles of the top 28 service providers and their assets and experience in combating the ever-growing security and privacy threats. This is also a good reflection of how service providers are expanding their security portfolio, and collaborating with their partner network and tying-up with academia to co-innovate and develop talent respectively to address growing business needs.

Why read this AnunnakiView ?

Anunnaki’s ongoing interactions with enterprise digital leaders indicate that data privacy and cybersecurity, especially as they transition to cloud and integrate disruptive technologies to generate new revenue streams, are a Board concern now. They also realize that security is a moving target, and the right service provider is critical for them to secure themselves in today’s dynamic environment.

This report is designed to help enterprise leaders draw out their cybersecurity strategy and adopt best practices for organizing the people, processes, and technology within an enterprise. Also, service providers can use the report to re-align their product and service development investments, their go-to-market approach, and have an update on the competitor’s cybersecurity practice.

A massive database storing tens of millions of SMS  text messages, most of which were sent by businesses to potential customers, has been found online.

The database is run by TrueDialog, a business SMS provider for businesses and higher education providers, which lets companies, colleges, and universities send bulk text messages to their customers and students. The Austin, Texas-based company says one of the advantages to its service is that recipients can also text back, allowing them to have two-way conversations with brands or businesses.

The database stored years of sent and received text messages from its customers and processed by TrueDialog. But because the database was left unprotected on the internet without a password, none of the data was encrypted and anyone could look inside.

Security researchers Noam Rotem and Ran Locar found the exposed database earlier this month as part of their internet scanning efforts.

TechCrunch examined a portion of the data, which contained detailed logs of messages sent by customers who used TrueDialog’s system, including phone numbers and SMS message contents. The database contained information about university finance applications, marketing messages from businesses with discount codes, and job alerts, among other things.

But the data also contained sensitive text messages, such as two-factor codes and other security messages, which may have allowed anyone viewing the data to gain access to a person’s online accounts. Many of the messages we reviewed contained codes to access online medical services to obtain, and password reset and login codes for sites including Facebook and Google accounts.

The data also contained usernames and passwords of TrueDialog’s customers, which if used could have been used to access and impersonate their accounts.

Because some of the two-way message conversations contained a unique conversation code, it’s possible to read entire chains of conversations. One table alone had tens of millions of messages, many of which were message recipients trying to opt-out of receiving text messages.

TechCrunch contacted TrueDialog about the exposure, which promptly pulled the database offline. Despite reaching out several times, TrueDialog’s chief executive John Wright would not acknowledge the breach nor return several requests for comment. Wright also did not answer any of our questions — including whether the company would inform customers of the security lapse and if he plans to inform regulators, such as state attorneys general, per state data breach notification laws.

The company is just one of many SMS providers that have in recent months left systems — and sensitive text messages — on the internet for anyone to access. Not only that but it’s another example of why SMS text messages may be convenient but is not a secure way to communicate — particularly for sensitive data, like sending two-factor codes.

Read more:

• A leaky database of SMS messages exposed two-factor codes
• Mixcloud data breach exposes over 20 million user records
• StockX was hacked, exposing millions of customers’ data
• DoorDash confirms data breach affected 4.9 million users
• Stop saying, ‘We take your privacy and security seriously’
• Capital One breach also hit other major companies, say researchers
• Macy’s said hackers stole customer credit cards — again

Data security is a top concern not only for enterprises and small business, but for everyday consumers as well. With widespread data breaches exposing everything from customer login credentials to credit card information to personal health records, consumers must be savvy about data security and take steps to protect their own information. Fortunately, there are many ways individuals and families can take extra precautions to ensure their personal data is safe and secure from hackers and malicious criminals. While few security measures can guarantee that no data security breaches will affect you, implementing multiple layers of personal data security protections substantially reduces the likelihood that your data will be compromised. Educating yourself on what to do should your identity be stolen or your personal data exposed will help you take the proper steps to minimize damage after the fact.

To that end, we’ve compiled a list of 101 informative quotes on data security, ranging from quotes about the state of modern data security to useful tips on protecting your family’s personal information, how to teach your children proper data security measures and keep them safe online, identifying hoaxes and scams, and more. The following 101 data security quotes are categorized for simple perusing and are not listed in any particular order of importance.

Table of Contents:

• General Computer and Device Security
• Securing Your Mobile Devices
• Email Security Quotes
• Identifying Hoaxes and Scams
• Password Security
• Phishing Attempts
• Identity Theft
• Malware, Spyware, and Viruses
• Secure Browsing
• Security on the Social Web and in the Cloud
• Data Security Quotes for Parents, Teens, and Kids

Posted by: Nate Lord

It was a good plan, as far as frauds go: rip off fans of live performances while simultaneously fleecing some of the internet’s biggest ticket vendors, such as Groupon, Ticketmaster and TickPick. The fraudsters create accounts with the ticket sellers and use stolen credit card information to make their purchases. Then they turn around and resell the tickets to fans, who might not be able to use them if the fraudsters resell them multiple times or the original sale is voided.

The well-laid plan fell apart, however, when a simple cybersecurity mistake revealed the scam. The reason: the apparent fraudsters forgot to password-protect their cloud database.

Security researchers Noam Rotem and Ran Locar last month found an unsecured database containing records of 17 million emails received by accounts made with the three ticket vendors, as well as a handful of local venues. Groupon says the records show similarities to a scam the company identified in 2016. The database is no longer online. The researchers don’t know who created the database, but believe it was used for criminal activity.

“We’ve worked on many similar database breaches, and certain aspects of this one didn’t add up,” the researchers wrote. “After contacting Groupon with our concerns, the full extent of what we’d uncovered was revealed.”

In a report published Wednesday with software review site vpnMentor, Rotem and Locar outline how they found records of emails, the email addresses and names used to buy the tickets, and other details that would make it simple to identify and remove fraudsters’ accounts from a ticket vendor’s systems. Anyone visiting the correct IP address could see the data.

DATABASE EXPOSURES

• Your most sensitive data is likely exposed online. These people try to find it

The data exposure is more evidence — if any were needed — that everyone, even criminals, struggles with cybersecurity. Improperly secured databases have led to the exposure of caches that include children’s information, vast swaths of demographic data and health records. The problem usually starts when an organization misconfigures its cloud server, failing to select more private settings when it puts data online.

In this case, the data appeared to be the blueprint of a crime.

At first, Rotem and Locar thought they’d found information owned by a legitimate business, like a third-party mailing service used by multiple ticket companies. But soon they saw hints that something was off. First, they realized there was no website for the mailing service. Then they saw that the email addresses in the database didn’t appear to belong to real people.

Finally, Groupon told the researchers that the data they’d come across was similar to what they’d seen in the 2016 fraud. Almost all of the records in the database were marketing emails from Groupon, which sends frequent emails on deals of the day to users. Groupon said there were about 20,000 email addresses in the exposed data set, but the total number of emails that related to the purchase of tickets was at most 673.

Groupon declined to confirm whether it was taking any action based on the findings. Ticketmaster didn’t respond to requests for comment.

Jack Slingland, vice president of operations at TickPick, didn’t comment directly on the researchers’ findings but said the company is continually on the alert for fraud activities. He said customers who purchase tickets resold through TickPick are guaranteed comparable tickets if they arrive at the venue and find they’ve been sold a fraudulent ticket.

However, the guarantee doesn’t apply if fraudsters buy tickets from TickPick and then resell them on another ticket-selling site.

Alert Logic SIEMlessly connects an award-winning security platform, cutting-edge threat intelligence, and expert defenders
to provide the best security and peace of mind for your business 24/7.

“Our machine performed the target computation in 200 seconds, and from measurements in our experiment we determined that it would take the world’s fastest supercomputer 10,000 years to produce a similar output,” Google researchers said in a blog post about the work.

The news, which leaked into the limelight in September with a premature paper publication, offers evidence that quantum computers could break out of research labs and head toward mainstream computing. They could perform important work like creating new materials, designing new drugs at the molecular level, optimizing financial investments and speeding up delivery of packages. And the quantum computing achievement comes as progress with classical computers, as measured by the speed of general-purpose processors and charted by Moore’s Law, has sputtered.

Google’s Sputnik moment

Google got to pick its speed test, but Hartmut Neven, one of the researchers, dismissed criticisms that the result is only a narrow victory.

“Sputnik didn’t do much either. It circled the Earth. Yet it was the start of the space age,” Neven said at a press conference. He spoke at Google’s quantum computing lab near Santa Barbara, California, next to the site of an actual Space Race milestone — the development of the Apollo missions’ lunar rover.

But it’s not the beginning of the end for classical computers, at least in the view of today’s quantum computing experts. Quantum computers are finicky, exotic and have to run in an extremely controlled environment, and they’re not likely to replace most of what we do today on classical computers.

Instead, quantum computers will function as accelerators for classical machines, useful enough to be essential. “It will be a must-have a resource at some point,” Neven said.

Quantum computing researcher Scott Aaronson likened the step to landing on the moon in terms of momentousness. And in a tweet Wednesday, Google Chief Executive Sundar Pichai called it a “big breakthrough.” Exemplifying how hard the work is, though, the quantum supremacy paper has a whopping 77 authors.

A vast industry is devoted to improving classical computers, but a small number of expensive labs at companies such as Google, Intel, Microsoft, Honeywell, Rigetti Computing and IBM are pursuing general-purpose quantum computers, too. They’re finicky devices, running in an environment chilled to just a hair’s breadth above absolute zero to minimize the likelihood they’ll be perturbed. Don’t expect to find a quantum computer on your desk.

Google’s speed test has applications to computing work like artificial intelligence, materials science and random number generation, the paper said.

And already, Google’s quantum computing researchers are talking to Google security team members about how the random number technology could be used to generate encryption keys, said Dave Bacon, leader of the quantum computing software effort.

Google’s first customers — the US Department of Energy and automakers Daimler and Volkswagen — will be able to use the machine in 2020, Google said. As with IBM’s quantum computing effort, it’ll be available as a cloud computing service over the internet.

However, physicist Jim Preskill, who came up with the term “quantum supremacy” in 2012, dashed some cold water on that idea. Google’s chosen test is good for showing quantum computing speed but “not otherwise a problem of much practical interest,” Preskill said in October after the paper’s premature release.

Quantum vs. classical computers

Nearly every digital device so far, from ENIAC in 1945 to Apple’s iPhone 11 in 2019, is a classical computer. Their electronics rely on logic circuits to do things like add two numbers and on memory cells to store the results.

Quantum computers are entirely different, reliant instead on the mind-bending rules of physics that govern ultrasmall objects like atoms.

Where classical computers store and process data as individual bits, each a 1 or a 0, quantum computers use a different foundation, called a qubit. Each qubit can store a combination of different states of 1 and 0 at the same time through a phenomenon called superposition. Told you it was weird.

Not only that, but multiple qubits can be ganged together through another quantum phenomenon called entanglement. That lets a quantum computer explore a vast number of possible solutions to a problem at the same time.

Exponential speedups

In principle, a quantum computer’s performance grows exponentially: add one more qubit, and you’ve doubled the number of solutions you can examine in one fell swoop. For that reason, quantum computing engineers are working to increase the number of qubits in their machines.

“We expect that their computational power will continue to grow at a double-exponential rate,” the Google researchers said in their paper. That’s even faster than the single exponential improvement charted for classical computer chips by Moore’s Law.

Google’s machine had 54 qubits, though one wasn’t working right, so only 53 were available. That happens to match the number in IBM’s most powerful quantum computer.

But qubit count isn’t everything. Unavoidable instabilities cause qubits to lose their data. To counteract that problem, researchers are also working on error correction techniques to let a calculation sidestep those problems.

IBM challenges Google’s quantum results

IBM is a major quantum computing fan, but it questioned Google’s prematurely released results in a blog post Monday.

“We argue that an ideal simulation of the same task can be performed on a classical system in 2.5 days and with far greater fidelity,” the IBM researchers wrote. They suggested different algorithms and a different classical computer design in a preprint paper of their own.

Google said it welcomes improvements to quantum computer simulation techniques but said its overall result is “prohibitively hard for even the world’s fastest supercomputer, with more double exponential growth to come. We’ve already peeled away from classical computers, onto a totally different trajectory.”

And you can try for yourself if you like. Google released its quantum computer’s raw output to encourage others to see if they can do better at simulating a quantum computer. “We expect that lower simulation costs than reported here will eventually be achieved, but we also expect that they will be consistently outpaced by hardware improvements on larger quantum processors,” the Google researchers said.

Intel didn’t offer an opinion on Google’s results, but did say quantum supremacy is “a strategic benchmark.”

“We are committed to moving quantum from the lab to commercialization,” said Jim Clarke, Intel Labs’ director of quantum hardware, in a statement.

Cracking your encrypted communications? Not yet

One quantum computing ability, mathematically proved with an idea called Shor’s algorithm, is cracking some of today’s encryption technology.

However, that will require vastly larger quantum computers and new technology breakthroughs to deal with error correction.

“Realizing the full promise of quantum computing (using Shor’s algorithm for factoring, for example) still requires technical leaps,” the researchers said in their paper.

And at the same time, the US government and others are working on “post-quantum” cryptography methods to withstand quantum computing cracking abilities.

So for now at least, quantum computing, while radically different, isn’t blowing up the tech industry.

First published Oct. 23 at 2:15 a.m. PT.
Updates at 3:09 a.m., 7:41 a.m., 10:13 a.m., 11:09 a.m. and 4:50 p.m. PT: Adds more detail, photos, comment from Google CEO and comments from a Google press event.