Also how many customers on which products - some graphs will top out at 4Mb and some at 25Mb, etc.
And it implies there wasn't a thorough security review on that server-which-has-access-to-customer-data, so any malicious attacker might turn more attention to it for a way into more access.
Cperciva says the access required a valid login, it's plausible that login could be customer number + password, which would make brute forcing easier with a list of current customer numbers.
Hmm
If they're big enough to have customers across Canada, usage patterns could reveal timezones. And whether the residence is unoccupied during work hours / what typical work hours are.
Longer term usage patterns could reveal if they tend to go out at nights, on weekends, over holiday seasons.
What else... maybe usage drops correlate with major sports events for some profiling?
Also how many customers on which products - some graphs will top out at 4Mb and some at 25Mb, etc.
And it implies there wasn't a thorough security review on that server-which-has-access-to-customer-data, so any malicious attacker might turn more attention to it for a way into more access.
Cperciva says the access required a valid login, it's plausible that login could be customer number + password, which would make brute forcing easier with a list of current customer numbers.
Hmm
If they're big enough to have customers across Canada, usage patterns could reveal timezones. And whether the residence is unoccupied during work hours / what typical work hours are.
Longer term usage patterns could reveal if they tend to go out at nights, on weekends, over holiday seasons.
What else... maybe usage drops correlate with major sports events for some profiling? Maybe
I'd be surprised if this constant chatter isn't visible on the graphs.
That means: The attacker can track rather well whether the person is at home or not. Or at least make informed guesses. They plan a robbery during a holiday. Or, much more malicious: some attack on the persons other web properties like their iCloud and Amazon account, as presented a while ago.[1]
Case B: Consider that the attacker doesn't have the account number. Another leak in their platform allows them to link personal information with account numbers. In itself, that info is also not very interesting and would also not be "dangerous".
Because the leak of the traffic graphs exists, they go on and plan the biggest heist in Toronto ever :).
A good exploit is often the combination of multiple seemingly innocuous flaws. [1] is also a good example of that.
[1]: http://www.emptyage.com/post/28679875595/yes-i-was-hacked-ha...
Elaborate, sure, but plausible. The more important part of the leak is all the account numbers anyway :).
You're leaking information that you aren't supposed to.
There is no benefit or legitimate use case for this leak; it is a leak.
You gotta plug it.
"I don't see why this was a security problem in the first place. No personally identifiable data was disclosed. What does it matter if you can view anonymous traffic graphs from other customers?"
I hate it when people say this sort of thing. That just indicates they can't see a potential exploit, not that it won't be one potential aspect of an attack. Honestly, attackers - regardless of their morality - will tend to look at things from a viewpoint others haven't imagined. It's best to give them as few avenues as possible.