Vice (Motherboard): Tools for breaking into Disney+ accounts have been online for months.

[Deleted member 33]

Vice posted this article.

One of the takeaways is that users should avoid using the same password across multiple services (Netflix, Uber, Hulu, Disney).

But this should not come as a surprise. Motherboard found that, for months, hackers have been giving away so-called "configs"—files that control special software for breaking into accounts en masse—designed to crack Disney+.

"DISNEY+ CONFIG," one thread on a hacking forum focused on breaking into online accounts reads. The author created the thread and shared the config itself two months ago, according to the forum.

Click to shrink...

Hackers load a config into a tool such as Sentry, which churns through combinations of email addresses and passwords in the hope that a user has shared one password across multiple services. Configs exist for all sorts of online services that may be attractive to hackers, such as Uber or Netflix. Hackers will typically use the software in conjunction with proxies, which route their traffic through different points before arriving at the Disney+ login portal, so Disney doesn't block the hackers.

Click to shrink...

Disney did not immediately respond to a request for comment.

Click to shrink...

Source: https://www.vice.com/en_us/article/zmjdwa/config-to-hack-disney-plus-accounts

 

[Deleted member 33]

Also, thousands of Disney+ accounts are already for sale on hacking forums.

https://www.zdnet.com/article/thous...ounts-are-already-for-sale-on-hacking-forums/

 

[SoH]

Nothing about this is specific to a lacking of security with Disney+, but if we are taking the sudden rise of a popular streaming service to remind people not to share passwords across services then I'm on board.

 

[Maximus]

It is only a concern if you have reused passwords and your data has been breached on another platform.

 

[Musubi]

Common sense wins the day. Use unique passwords for all of your accounts.

 

[Finale Fireworker]

Nothing about this is specific to a lacking of security with Disney+, but if we are taking the sudden rise of a popular streaming service to remind people not to share passwords across services then I'm on board.

Click to shrink...

It is only a concern if you have reused passwords and your data has been breached on another platform.

Click to shrink...

The article emphasizes that it is affecting people with unique passwords.

Two users who spoke with ZDNet on the condition we do not share their names admitted that they reused passwords. However, other users said online that they did not, and had used passwords unique for their Disney+ accounts.

This suggests that in some cases hackers gained access to accounts by using email and password combos leaked at other sites, while in other cases the Disney+ credentials might have been obtained from users infected with keylogging or info-stealing malware.

Click to shrink...

But having a keylogger isn't Disney's fault, I guess.

 

[jediyoshi]

"Hackers load a config into a tool such as Sentry, which churns through combinations of email addresses and passwords in the hope that a user has shared one password across multiple services."

Eh

 

[tangeu]

Soooo....the same tools to break into any online account?

 

[Arctic Chris]

A different simple password for every site is still a simple password. I do recommend something like 1Password to generate complex and unique passwords for every site.

Disney could help matters by making 2FA available for users interested in additional account security.

 

[SoH]

The article emphasizes that it is affecting people with unique passwords.



But having a keylogger isn't Disney's fault, I guess.

Click to shrink...

Good eye. Didn't click through the referenced ZDnet article. Though agreed, still no sign of any failing on Disney's part.

 

[Skyejack]

Are hackers really that desperate to watch cartoons and men in tights?

 

[MPrice]

"Hackers load a config into a tool such as Sentry, which churns through combinations of email addresses and passwords in the hope that a user has shared one password across multiple services."

Eh

Click to shrink...

Lmao not even Brute Force but a dictionary attack? Vice should be ashamed for even posting this.

 

[ReAxion]

Are hackers really that desperate to watch cartoons and men in tights?

Click to shrink...

a) they're giving them away and b) if for personal use, what is your impression of a hacker's entertainment consumption?

 

[Skyejack]

a) they're giving them away and b) if for personal use, what is your impression of a hacker's entertainment consumption?

Click to shrink...

What you're describing isn't a hacker. It's sounds more like a kid running a script.

 

[Krauser Kat]

use a different password for everyservice. last pass or 1 password is your friends

 

[ReAxion]

What you're describing isn't a hacker. It's sounds more like a kid running a script.

Click to shrink...

i mean, I'm not describing anything, Vice is, but you probably already know media outlets never make a distinction - everything is hacking.

 

[Falcon511]

Thank god for password managers.

 

[Syriel]

It is only a concern if you have reused passwords and your data has been breached on another platform.

Click to shrink...

 

[Ashhong]

Wait why don't they have 2FA?

 

[TarpitCarnivore]

This is just a brute force tool aimed at Disney+. Vice trying to go all "WOO TOOLS TO HACK" when this shit is nothing special.

 

[Barls]

Wait why don't they have 2FA?

Click to shrink...

Yeah I would love to see this, but watching the backlash to "Disney blocking account sharing" would be quite funny.

 

[Ashhong]

Yeah I would love to see this, but watching the backlash to "Disney blocking account sharing" would be quite funny.

Click to shrink...

Would people say that? Lol it wouldn't even block any sharing

 

[Spectromixer]

Wait why don't they have 2FA?

Click to shrink...

They should have it but Amazon is the only streaming service with 2FA.

 

[mrmoose]

Wait why don't they have 2FA?

Click to shrink...

Why don't they have a progress bar for stuff you're watching?

They don't even have near feature parity to Netflix, let alone putting in something Netflix, Hulu, etc. don't have.

The only reason I think Amazon has it is because you're reusing your amazon store account which has it.

Even so, it is way, way better to learn that you are using a password that's been compromised because someone logged into this service then, say, a bank or something. A great reminder for everyone to change all their passwords while not directly harming something essential.

 

[Barls]

Would people say that? Lol it wouldn't even block any sharing

Click to shrink...

They would, even though you are right, it wouldn't.
It wouldn't block it, but almost any implementation of 2FA would make logging in without access to the phone, email or authentication app incredibly annoying. Imagine having to text your friend, "Hey, just got a new Roku, can you send me that Disney code in the next 5 minutes?"
Then Disney decided to make you re-auth every device every week or something in the name of security...

 

[Falchion]

Yikes, I'm pretty sure I have a different password but I'll double check now.