MacKeeper Weakness Leaves 13 Million Customers Vulnerable

MacKeeper is under scrutiny again and this time, at a cost to the information on 13 million customers. The controversial Mac utility bundle was breached by a security researcher who was merely perusing the web for open database ports.

Regardless of the integrity or popularity of the tool, the issue is that a port used in conjunction with the MongoDB database management system was left open to the public allowing the researcher to gain access to customer names, product information, user names, and passwords.

It is recommended that all MacKeeper users change their passwords immediately. While it is never recommended to use the same login credentials on multiple online accounts, it is well known that it does happen. So, if you use the same credentials on other sites as on MacKeeper, change those too. When doing so, choose different ones from whatever you use on MacKeeper.

In fact, make sure that all of those you change are unique to that particular site. Password reuse is a common way that hackers find their way into other sites.

One tip for creating unique passwords is to make a strong baseline password that you use on all sites. It should be at least six characters and contain upper and lower case letters, at least one special character, and at least one number. Then, for each website, choose a couple of characters, say the last two of the website, and add them to your baseline password. For example, a baseline could be “uX4#a@” and the website could end in “ge.” Therefore, your password for that site would end up as “uX4#a@ge.” Another website you log into could end in “la,” making your password just for that site “uX4#a@la.”

Another method for creating unique passwords is the “dice method.” This is choosing random words that when combined, make no sense and therefore would not be easily cracked by password cracking methods. For example, “lamptearsband,” then add a number or two and a special character.

Remember not to use dictionary words for passwords and the longer they are, the better. In any case, they should always be at least eight characters.

The researcher, Chris Vickery alerted the owner of MacKeeper, Kromtech which fixed it right away without any technical details being disclosed publicly. They do not believe any information was used for fraud as a result of this and confirmed that payment details are processed by a third party and therefore not included as part of the accessed information.