DreamHost and other password breaches show weaknesses in the way passwords are stored

The recent hack against a database full of FTP passwords held by Los Angeles-based web hosting firm DreamHost highlights a growing database breach trend that’s seeing password stores exposed by the boatload. Though these databases contain sensitive authentication information, they’re often left far less protected than databases containing PII. Experts warn that if organizations are truly serious about their security and compliance programs, they need to either find better ways to secure the passwords in the databases they’re distributed in across the network or look for alternatives that will ditch this method of storage altogether.

First brought to light last week, the DreamHost breach exposed FTP credentials of all its shared hosting accounts when hackers broke into a database that contained a legacy table storing passwords in plain text.

“This particular breached database contained customer credentials to the FTP server. This allows potential hackers to use these credentials in order to impersonate customers when accessing the FTP server,” Noa Bar-Yosef, senior security strategist, Imperva says. “The impact of which is to access customer documents, download the documents and even upload their own documents.”