Slashdot Mirror
Gawker Source Code and Databases Compromised
An anonymous reader writes "Passwords and personal data for 1.3 million Gawker Media readers — this includes readers of sites like Gizmodo, Lifehacker, Kotaku, and io9 — have been released as a BitTorrent by a group of hackers called Gnosis, who also managed to gain access to both the Gawker CMS and Gizmodo's Twitter account. Gawker confirms and urges readers to change their passwords: 'Our user databases do indeed appear to have been compromised. The passwords were encrypted. But simple ones may be vulnerable to a brute-force attack. You should change the password on Gawker (GED/commenting system) and on any other sites on which you've used the same passwords. Out of an abundance of caution, you should also change your company email password and any passwords that may have appeared in your email messages. We're deeply embarrassed by this breach. We should not be in the position of relying on the goodwill of the hackers who identified the weakness in our systems.'"
Perhaps this should give them a lesson about going overkill on the whole "outsourcing" thing.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
I appreciate taking this sort of thing with good nature, but that might be a bit generous. Goodwill stopped at the "released a torrent of all the users passwords and personal data". Now my email address is going to get spammed . . . .
... on their iPhone 4, which for some reason they appear to have left at the bar...
...and instead use Facebook to protect my privacy. Wait, why are you laughing?
Not sure why anyone would register with any of the Gawker sites, but why on earth you would ever give your actual email address to half of these websites is beyond me. If they require you to provide an email address to register, use a throwaway address from something like mailinator or the other sites like it. Yes, someone could take over the account if the email address is posted, but for almost all of those sites the account serves no purpose outside of being able to post.
I'm not even sure why they require email addresses. Reddit is one of the few sites I've seen get it right. They don't require an email address to register, but warn you that if you don't include one there is no way to recover the password for the account.
http://thepiratebay.org/torrent/6034669
They probably did. It's a press release, and a one-way cryptographic hash is close enough to "encrypted" and a helluva lot shorter and more understandable to a non-pedantic audience.
At least they didn't say "scrambled".
It is a miracle that curiosity survives formal education. - Einstein
We considered what action we would take, and decided that the Gawkmedia “empire” needs to be brought down a peg or two.
This is the major problem with the internet - we let children on it.
Really kids? Go play somewhere else and let the adults have peace and quiet. You don't need to piss on everything just to prove you're alive. The smell of your unwashed armpits is already ample demonstration.
There's no indication that the people who compromised Gawker were minors... but to respond to your larger sentiment...
People who have malicious intentions and do bad things exist. They exist in large numbers. It is simply not possible to identify and stop every last one of them. It's not even feasible to significantly reduce their numbers. Not even the power of law can accomplish that. Indeed, law is a tool for managing this fact of life and has no real power to completely prevent it. There's nothing anyone can do about this reality. It can only be acknowledged, accepted, and worked with. Denial and delusion are your only other options.
There's one thing we can do, however. We can harden the targets. We can secure the systems for which each of us is responsible. We can realize that compromises like this are preventable and then take steps to prevent them. We can learn from the example of those who failed to do so. At the end of the day, we can realize that we're not helpless victims completely at the mercy of random chance or luck, but rather, that there is a great deal we can do to become an extremely difficult target.
Posts like this one are written in the spirit of this understanding. It highlights that the owners of those systems acknowledge that they have failed, have accepted responsibility for that, and therefore have the fewest obstacles to learning from this experience and overcoming it. An attitude of blaming everything on "those evil hackers", though they truly have done wrong, would practically guarantee that nothing is learned and no skills are improved.
It is a miracle that curiosity survives formal education. - Einstein
I find that message from Gawker amusing because they don't even secure their login form with SSL. They're concerned about the database getting stolen with unreadable passwords that might be cracked with enough time, but they turn a blind eye to the fact that authentication information is sent in the clear from the form...
I didn't say minors. I said "children."
I chose that word carefully.
Your points are all very correct, of course. I am just screaming to an apathetic universe.
Waht? Smcrbalnig is a pfretlecy surece epoitrcyn mhtoed for prdsoaswss!
I didn't say minors. I said "children."
I chose that word carefully.
Your points are all very correct, of course. I am just screaming to an apathetic universe.
Point taken. In fact the biggest single reason why I am concerned about the long-term well-being of the USA is that most of its "adults" are petty, indulgent, overgrown children with short memories. In that spirit I can see why you had good reason to choose that word as you did.
I maintain that the more adult thing to do is to overcome such events by learning their lesson, rather than indulging in the "blame game" and making it into a 5-minute hate. Not only is that the constructive solution, it also limits the damage of this intrusion to computer systems only. The anger and hatred merely serves the intruder(s) by extending the damage into the personal realm of your own well-being.
It is a miracle that curiosity survives formal education. - Einstein
From http://pastebin.com/9rRmf6W5:
"Gawker uses a really outdated hashing algorithm known as DES (Data Encryption Standard).
Because DES has a maximum of 8chars using a password like "abcdefgh1234" only the
first 8 characters "abcdefgh" are encrypted and stored in the database. If your
password is longer than 8 characters you only need to enter the first 8 characters
to log in! "
The LM hash generated two hashes using DES from two 7 byte parts of a 14 byte password.
Basically they use each individual 7 byte part as a DES key to encrypt a fixed string.
Repeat this twice for each 7 byte part, and concatenate the results, and you get the LM hash.
After looking through the package released through BitTorrent, not everybody's password has been compromised. Gawker does appear to store passwords in an encrypted form and only particularly weak passwords have been cracked. My username, for instance, does appear in their raw DB dump (with an encrypted form of my password) but not in a separate file which lists the passwords they were able to crack. I have a fairly strong password and I believe that's why. Real examples of passwords weak enough to be cracked include "may1404" and "122190". Nothing like, for instance, "STux_s7a" (an old password of mine) appears in unencrypted form, and that isn't even a very strong "strong" password.
and by "encrypted" do they mean "we're idiots and stored something other than a salt + hash of the passwords"?
They used crypt(), which means it's going to be relatively easy to crack everything in the file even if the users' passwords were strong. Why anyone would use crypt() for password hashing is beyond me.
The real value here is that we'll get to see who has been astroturfing one of the "most popular" blog networks...and dumb enough to use obvious personal or work email addresses. In fact, it wouldn't surprise me if Gawker copywriters were 'turfing their own stories too, given how much emphasis Gawker places on story viewcounts.
Please help metamoderate.
The salt just complicates the rainbowtable lookup method. It's not supposed to be super secret. It makes every password require a expensive brute force lookup rather than a O(1) operation.
It's nice to see a bit of karmic justice after Gawker falsely accused EasyDNS of cutting off Wikileaks (it was EveryDNS), then acted like jackasses when called on it.
http://blogs.villagevoice.com/runninscared/2010/12/gawker_refuses.php
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Given the contempt they apparently hold for their own users, I don't think they're concerned all that much with protecting those users' data in the first place.
I took this as a sign to change all my passwords. It's been a pain in the ass honestly, and provided a nice overview of who is is good at letting you change passwords and who sucks. ICQ so far is by far the worst, you can't change it through their website, so you have to download their client, plus they don't allow special characters. Ebay's was really hard to find where to change it as well.
I just went through my bookmarks, starting with the imporant stuff and working my way down. Unfortunately, there are surely some sites i've forgotten. I'll have to change them as they come up, but are mostly throwaway accounts anyway.
You don't even need to register a throwaway address for Hulu or sites like it. Enter bugmenot, savior of the net.
Bugmenot unfortunately lost their courage a few years ago when they changed the way they function. I suspect they were threatened by a lawsuit. Now, any domain or site owner can request that bugmenot exclude their site from participating, and I've found that so many of the popular ones do that it's lost all practical value for me.
I now use mailinator for all my throwaway registrations, then if I care in the least I change the password just in case someone else reads from the same random email name that I did. I usually don't. For more "durable" sites where I'm likely to participate over a longer time, I'll create a unique sneakemail address and keep them around forever. When something like the Gizmodo breach happens I simply flag them as spam, and they plonk all the email from them for me. I've had to do that a couple of times now. I find their service is well worth the $24/year.
John
Having people reinvent it constantly is counterproductive to your goal. What we need are a few people who actually know what they're doing to design it, and for everybody else to use that.
How about Kerberos, versions 1-4? Oh, wait. Bad example.
My point is that MIT has the people who not only know what they're doing, but are the ones who often define the very security practices the rest of us rely on. And even they needed to get to version 5 before they got it right (for current definitions of "right").
I'm certainly not saying that ShmooCMS is going to do a better job than MIT did with kerberos at defining an unhackable protocol. They're not. I am saying to "be mindful of what you rely on", because even the best systems are not likely to remain secure forever.
John
I now use mailinator for all my throwaway registrations, then if I care in the least I change the password just in case someone else reads from the same random email name that I did.
I put common e-mails @mailinator into the "forgot password" field when i need a login.
It works more often than not.
[Fuck Beta]
o0t!
https://addons.mozilla.org/en-US/firefox/addon/3282/
Think up a new password. Just one.
Pass = "PcbEn!"
The mnemonic for that password is "Passwords Can Be Easy Now!"
Now use that one simple password to create stupidly complex passwords for the sites you visit by using Password Hasher.
Every site you go to will have it's own unique mix of 26 upper, lower, numbers, symbols (if it supports it) that can be easily recreated in seconds without ever being written down or stored electronically.
All you have to remember is that passwords can be easy now.
Example password for Slashdot using this example is "nRP2zGk56sYN8IMUyFR/XpIx45" which is out of the brute force range this year and probably next year too.
Do not meddle in the affairs of geeks for they are subtle and quick to anger