Slashdot Mirror
What LulzSec Logins Reveal About Bookworms, and Passwords
Barence writes "Today the hacking group LulzSec posted 62,000 hacked email usernames and passwords online. PC Pro's Darien Graham-Smith has analysed the passwords stolen — which are believed to have come from a website for writers — and found some interesting patterns. Aside from 'password' and obvious numerical patterns (i.e. '12345') the most common passwords share a literary theme: 'romance,' 'mystery,' 'shadow' and 'bookworm' are all commonly used passwords. 'Clearly, this is a back-of-an-envelope breakdown of a mixed mass of unverified data,' said Graham-Smith. 'But it gives an interesting insight into the way people choose their passwords: in this case, apparently, on a theme that reflects the nature of the site they're visiting.'"
Perhaps these are their passwords for every site, and this site just over-represents people interested in books and writing. I certainly don't use custom passwords based on the type of site.
So they discovered a shadowy bookworm romance mystery? I'm guessing one participant was a librarian?
There should be laws created to impose massive fines for sites storing plaintext passwords. There's absolutely no excuse for this. I understand that you can't govern the entire internet, but I would be content with American laws governing American sites. It would be a nice start.
Guess admins should check these passwords against their server and then shake a stick at the users using them.
Easy-to-remember passwords for a site that doesn't matter at all? Color me shocked. When forced to sign up for forums to ask a question about coding or tech troubleshooting, I generally use a pretty basic password and then lie about all of my personal info. That way if someone does acquire this info (and it has happened multiple times) I don't get burned. For important things like banking and gmail, I have 2-step authentication enabled and use a strong password on top of that. Different on every site of course.
But for stuff like writers forums, tech support sites, slashdot (haha!) and the like? I don't use and don't care to use a strong password because, well, what's the point? You don't hear about individuals on these sites being hacked because of the insecure passwords they use. No, you hear about the administrators of these sites having their sites hacked and their userlists and passwords stolen. What good does a strong password serve on a site like this when there are gaping security holes in the OS hosting the forums?
And why, for Xenu's sake, are people still storing passwords in plaintext??
Do we need to change "her" password? Right now it's "Lezcyclopedia".
"Flyin' in just a sweet place,
Never been known to fail..."
I'd always be wary about all these grand "revealings" about passwords from LulzSec.
How many usernames/passwords on an innocent blogging site like that are completely throwaway?
I know that on randomblog.com if I want to make an account on the spot, I'm certianly far more likely to use "asdf123" for a username and "randomblog" as a password than I am a 16 digit alphanumeric/symbol/mixed case password that I will forget in 5 minutes.
Who cares if your blogspot account gets hijacked? What are they going to do, write angry comments using your throwaway username?
Many of these passwords are a consequence of a person not wanting to write down their passwords for fear of the written down password being found. Thus, instead of creating an effective, hard to guess (and hard to remember) password, many people simply come up with a password that is easy to remember, but that they hope is so random, or so obvious, that nobody would guess.
I teach my children, even the little ones, the old trick of coming up with an easy to remember sentence, picking the first letter of each word, and changing one or more characters to a number of symbol. They like the challenge, and create some reasonably tough passwords to guess.
http://10CentMail.com - the Amazon SES app.
And for the record, yes, I told them stop emailing around spreadsheets that included everyone's passwords (this went out to a couple dozen volunteers every few months) but they did it for at least a few years, probably longer.
Those who fail to understand communication protocols, are doomed to repeat them over port 80.
Why are we still using passwords? They will go away, sooner or later.
metageek
i've championed this before, and i don't why it doesn't get more press
instead of the same username pword for every site, make your uname/ pword a derivative of the website name or theme, and your own personal salt
the rules could be as quirky and arcane as you want
for example:
username is the first 3 letters of the website, plus your birthyear, plus the cousin whose name sounds most like the website you're visiting
password is the street you grew up on, minus the last 3 characters and plus the last 3 characters of the website, plus the songtitle from the group you like whose letter starts with the third letter of the website name, rotated 3 characters... blah blah blah
or whatever
the point being, we can't remember all your usernames and passwords, but with a quirky enough personal algorithm combining
1. a characteristic of the website, and
2. some personal arcane trivia,
all you have to do is remember your personal algorithm
and then you can get into every site you've ever visited, not worry about trying to remember anything, and not really worry about being easily tracked or cracked. as long as your personal algorithm is indeed truly quirky and personal enough that even with knowledge of 3 of your username/ passwords from 3 different sites, a potential hacker/ cracker would be utterly mystified as to a pattern
i really don't know why this idea of remembering just one personal quirky algorithm isn't more widespread
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
(Reuters) - The Pentagon is about to roll out an expanded effort to safeguard its contractors from hackers and is building a virtual firing range in cyberspace to test new technologies, according to officials familiar with the plans, as a recent wave of cyber attacks boosts concerns about U.S. vulnerability to digital warfare. http://www.reuters.com/article/2011/06/16/us-usa-cybersecurity-idUSTRE75F4YG20110616
Let's see, government ready to spend billions (more) on "cyber"-security/Internet-surveillance, intelligence agencies and a ton of private companies set to benefit. LulzSec attacks of course part of justification.
Here's a link to the passwords so you can check if your password is on there
Just search the page for your password. Chrome does a great job of this because it starts highlighting matching passwords as you type it. I just checked my passwords, none of them are on this list.
my karma will be here long after I'm gone
Fishsticks?
Well then you're a gay fish
Not sure I buy the premise. I went to a nerd college with few woman. Back then, before they shadowed PW files, I came across a lot of passwords. The two most common variants I found contained the words 'soccer' or 'jennifer.' Once again, I went to a nerd college with few women.
But it gives an interesting insight into the way people choose their passwords: in this case, apparently, on a theme that reflects the nature of the site they're visiting.
The three most popular Slashdot passwords are 'troll', 'slacker', and 'clown'.
Sheesh, evil *and* a jerk. -- Jade
I work for an ISP that is represented in the list of emails and passwords. We determined all the addresses from domains we control are not, nor have they ever been used, on our system. I'm not saying they are all fakes, but all the addresses I'm able to verify are not legit.
Mine is all '*'s ...
Seriously. Hashing. Does nobody practice this for user account databases?
/* No Comment */
Adrian Lamo == LulzSec
how is babby formed?
my password for slashdot is "nerdporn"
Password reuse is a major problem, regardless of site. There is very little excuse not to use tools like 1Password, LastPass or KeePassX.
I've gotten my technophobic parents and wife on the treadmill (all use 1password via a family license).
I've gotten them comfortable ditching their "known good password" on their other sites, learning the strong master password by heart, and got them comortable enough to generate a good-length (default 18 characters) passwords for any site that needs it.
The best part about a password manager is that you can share (Dropbox for now, perhaps iCloud tomorrow) your credential set (which are encrypted, of course) and now you don't get bugged about the Amazon password from your spouse, she just logs in and buys the stuff.
Make sure everyone's vote counts: Verified Voting
I am really starting to doubt these stories. Generating usernames and passwords is something that can be down with even a quick script - it is not hard to generate real words using a known dictionary source.
We can't know for sure since they aren't divulging their source, but some of the services listed are too sophisticated (esp. Gmail, even if you don't believe in competency of those who run Hotmail) even to store passwords in cleartext anywhere.
If I had to guess at how they obtained these passwords, they did it by actual hacking of the accounts (or somehow got a hold of the password hashes to run faster attacks on), and in that case, the accounts with weak passwords are the low-hanging fruits; of course the list will contain many, many weak passwords subject to various dictionary attacks.
This doesn't explain everything, since looking through the password list, I do see a few that actually look randomly-generated, such as "Zt8bNOI655" (maybe they used keylogger trojans in addition to other methods), but unless use of dictionary attack of any form can be ruled out, statistically, this list is worse than worthless—it's downright misleading, unless the only claim made is that there still exist users who use weak passwords.
Any /. theories on ajcuivd289 ? I'm stumped, unless one dude has a lot of dupe accounts.
Ever sit and watch average ppl create new passwords at their desk? THey do not look into the air to think about it. Instead, they look at what is around them. I do not watch somebody enter the passwords, but I have noticed the subject's head. I believe that they are looking at the books, artwork, etc that is just around them.
Want to break into their stuff? Simply take a look around the desk and see what is important to them. Simple as that.
I prefer the "u" in honour as it seems to be missing these days.
The original list posted by LulzSec is divided in two parts. The first half has an assortment of emails from many domains. The second half contains emails of brazilians, most of them from hotmail and yahoo (many have .br at the end, or use brazilian names and words). Probably they compromised some windows live server? Looks live many of the are msn logins...
The best system I've seen is the one Steve Gibson has on his website.
https://www.grc.com/ppp.htm
People use guessable passwords because they want to use passwords that they can remember. And people that use passwords they can remember do reuse passwords. Any password I can remember probably isn't very secure. Any password used at more than one site definitely isn't secure.
It's past time that all browsers included a standard password generator with user definable salt set at first invocation, and master password prompting. Web standards should at a minimum specify support for all printable ASCII characters in passwords. If a bank isn't competent enough to hire a programmer that can write code to handle a quote in a password, you probably shouldn't be banking there.
Until then there's still PasswordMaker for which you have to salt each account separately if you not want the default unsalted hash. And there's still the annoyance of "alphanumeric only with at least one uppercase and one number" web sites.
Support SETI@home
Hope that makes sense.
That was my 1st guess too. However, here's a list of the top 45 most common passwords for that site. I've bolded the obvious literature related passwords. Others may be as well, such as person names that might be references to characters. You may be right, of course, but literature related passwords do seem overrepresented.
0.9231% "123456"
0.3157% "123456789"
0.2142% "password"
0.1417% "romance"
0.1095% "102030"
0.1079% "mystery"
0.0998% "123"
0.0998% "ajcuivd289"
0.0998% "shadow"
0.0998% "tigger"
0.0869% "bookworm"
0.0869% "dragon"
0.0853% "sunshine"
0.0837% "12345"
0.0837% "reader"
0.0805% "purple"
0.0773% "maggie"
0.0757% "reading"
0.0708% "1234"
0.0563% "angels"
0.0547% "peanut"
0.0547% "vampire"
0.0531% "booklover"
0.0515% "12345678"
0.0515% "charlie"
0.0515% "ginger"
0.0515% "michael"
0.0515% "pepper"
0.0515% "unicorn"
0.0499% "princess"
0.0483% "writerspace"
0.0467% "101010"
0.0467% "242424"
0.0467% "1234567"
0.0467% "cookie"
0.0467% "writer"
0.0451% "buster"
0.0451% "hannah"
0.0434% "bailey"
0.0434% "matthew"
0.0418% "123123"
0.0418% "library"
0.0402% "butterfly"
0.0402% "callie"
0.0402% "flower"
Anyone has a working link to the file ?
that LulzSec are worms.
Intrigued by the odd "AjcuiVd289" password, I googled it and some hits down where these kind of pages containing login-information.
http://www.firstsg.com/articles/AdminUser.asp?MemberTblOrder=Sorter_RegisteredOn&MemberTblDir=ASC
It pages belong to "First Security Group" which according to them, "Founded in 2004, First Security Group has established itself as one of the leading security services providers in the UAE with activities spanning professional security, training through to state-of-the-art technology."
The passwords work just fine. Enjoy.