Cerberus

Profile narrative

Cerberus, operating under the alias "Cerberus," is an organisation that maintained a user base centred on Android applications or services, as evidenced by its response to a security incident affecting more than 96,500 Android users. The organisation's core activity involved handling user authentication credentials, specifically managing login data and password storage for its user accounts. In response to evolving security threats, Cerberus committed to transitioning its password storage mechanism to bcrypt, a widely recognised and more secure hashing algorithm, indicating a focus on maintaining the integrity and confidentiality of user credentials within its platform.

The scale of Cerberus's operations, based on the available information, included a user base of over 96,500 Android users affected by a single security incident in early 2014. The organisation's reach extended to individuals using legacy logging systems on its Android platform, suggesting a moderate but notable footprint in the mobile application sector. Cerberus demonstrated responsiveness to security concerns by cooperating with law enforcement during the investigation of the breach, underscoring its engagement with regulatory and legal frameworks. The organisation also took proactive steps by disabling legacy logging functionality and removing the compromised log file, which had contained login data from a three-week period, to prevent further exposure of user information.

Cerberus distinguished itself through its commitment to enhancing security practices following the 2014 incident. The organisation employed uniquely salted SHA-1 password hashes, with each hash being salted multiple times, reflecting an effort to strengthen password protection even prior to the breach. The fact that only three accounts showed any sign of unauthorized access despite the exposure of hashed credentials suggests that Cerberus's existing security measures provided a reasonable level of protection. The absence of evidence indicating that the stolen data was published further supports the organisation's effective handling of the incident. No explicit information regarding Cerberus's ownership structure, parent company, or subsidiary status is available from the provided source material.

Incidents

1 incident linked to this organisation.