A post from TV streaming company Roku has warned users that 576,000 accounts were hacked in a credential stuffing attack. And apparently there was another incident that compromised 15,000 accounts in early March:
Earlier this year, Roku’s security monitoring systems detected an increase in unusual account activity. After a thorough investigation, we determined that unauthorized actors had accessed about 15,000 Roku user accounts using login credentials (i.e. usernames and passwords) stolen from another source unrelated to Roku through a method known as “credential stuffing.”
And:
After concluding our investigation of this first incident, we notified affected customers in early March and continued to monitor account activity closely to protect our customers and their personal information. Through this monitoring we identified a second incident, which impacted approximately 576,000 additional accounts.
Now none of that is good. But at least Roku is doing two things. First they are enabling two factor authentication which should mitigate this attack. And second is that they let affected users know and reset their passwords. The post has additional steps that you can take. So I would suggest that you have a look at that so that you can protect yourself further. My advice would be to change your Roku password to something complex and unique as having unique passwords for all your online services is the best way to protect yourself from a credential stuffing attack.
UPDATE: Experts with both Approov and Horizon3.ai offer their perspective on this:
Ted Miracco, CEO, Approov Mobile Security:
“While Roku’s efforts to implement two-factor authentication (2FA) and reset passwords for compromised accounts are commendable initial steps, they are woefully inadequate in the context of modern cybersecurity demands. The reliance on traditional security measures like 2FA and merely managing credentials exposes a fundamental misunderstanding of the current threat landscape, especially concerning API security.
“Today’s digital environment, where APIs serve as crucial gateways to vast amounts of sensitive user data, requires a much more robust defense strategy than what Roku has proposed. APIs, particularly those interfaced with mobile devices, are often the target of sophisticated bot attacks that cannot be thwarted by simple credential management or basic authentication protocols.
“A truly effective security posture demands the integration of advanced measures such as app attestation and token-based access controls. App attestation ensures that only legitimate, untampered versions of an application can interact with critical backend services, effectively neutralizing many potential threats at the source. Similarly, token-based access to APIs can provide a more secure and controlled method of managing interactions between devices and backend services, ensuring that each request is authenticated, authorized, traceable and short-lived.
“Roku’s response, while a step in the right direction, falls short of leveraging these advanced protective measures. It is imperative for Roku to enhance their security architecture beyond conventional methods to safeguard against the increasingly sophisticated and varied attack vectors of today’s cyber threats. Failure to do so could not only jeopardize user security but could also erode trust in Roku’s commitment to genuinely protecting its users.”
Stephen Gates, Principal Security SME, Horizon3.ai:
“As highlighted in our 2023 Year in Review, Proactive Cybersecurity Unleashed, credentials are still the number one issue we observe as the root cause of a data or account breach. Today’s attackers don’t typically use sophisticated hacking tools and techniques like zero-day exploits to gain access to a network or user account; they simply log in with legitimate user credentials they stole through phishing campaigns or some other breach where credentials were compromised. From something as simple as a stolen credential, attackers can easily achieve domain compromise, host compromise, sensitive data exposure, critical infrastructure compromise, or ransomware exposure.”
Roku announces the launch of TVA+ on the Roku platform
Posted in Commentary with tags Roku on May 9, 2024 by itnerdRoku and TVA Group announced the launch of TVA+ on the Roku platform. Expanding the options for French-language content on the Roku platform in Canada, TVA+ brings an exciting array of entertainment, news, public affairs programming, and sports, including the NHL and MLB, to Roku users.
As TVA’s digital destination, TVA+ includes Quebec’s most popular original content – often surpassing 1 million views – as well as a catalogue of nearly 100 movies and series from here and abroad. TVA+ provides viewers with a wide range of original hit shows like Indéfendable, Si on s’aimait, Alertes, Sorcières, and Révolution, plus popular Quebec adaptations such as La Voix, Sortez-moi d’ici and Chanteurs masqués, the family-friendly variety series that has ranked #1 in Canada (regardless of language) for 3 consecutive seasons. TVA+ also features TVA newscasts, along with several public affairs and sports programs.
Included in TVA+ is TVA Sports en Direct, available with a choice of two subscription packages. TVA Sports en Direct is the exclusive French-language broadcaster of the National Hockey League (NHL), including Saturday night Montreal Canadiens games and all playoff games. The channel also offers Major League Baseball (MLB), WTA tennis, the National Bank Open, the Laver Cup, UFC galas, and much more.
TVA+ is now available on all Roku devices and Roku TVs and can be added to the home screen directly from the Channel Store.
Leave a comment »