Few details are provided in the email. The breach was discovered through "standard security monitoring." The issue was identified and, says the email, "we are in the process of upgrading and restoring the community." It stresses that the breach did not affect NASDAQ's trading or commerce platforms.
But, it warns, "we regret that some of your account information – username, email address and password – may have been affected." It goes on to add that existing passwords have been 'expired' by the admins, and that users will need to create new ones.
Whenever an organization provides only limited information about a breach, security experts and commentators are tempted to fill in the gaps. Graham Cluley surmises that "the servers running the NASDAQ community messageboard software had not been properly configured or not kept updated against vulnerabilities, and this allowed hackers an open window to access sensitive information." More worryingly, he adds, "there is no mention of passwords being securely encrypted suggesting that the site could have been storing users’ passwords in an insecure fashion up until now."
Yahoo's finance blog, The Exchange, suggests that the attack is a fairly typical attack against a seemingly low-value target, and was designed simply to steal the password list. "Such lists can be compiled into software that speeds up the process of breaking into more secure sites that may contain valuable information."
But talking to V3, F-Secure analyst Sean Sullivan warns that it all depends on how forthcoming the NASDAQ community admins have been. What, he asks, if the breach hadn't been to steal the passwords, but primarily to compromise the site and use it as a water hole attack.
Context Information Security recently highlighted that water hole attacks are increasingly replacing spear-phishing as the weapon of choice. "You thought the Twitter, Facebook, Apple, Microsoft watering hole attack compromises via the iPhone Dev SDK forum was bad? Well," says Sullivan, "I think that would be nothing compared to the kind of damage that could be done via NASDAQ."