Slashdot Mirror
LinkedIn Password Hashes Leaked Online
jones_supa writes "A user in a Russian forum is claiming to have hacked LinkedIn to the tune of almost 6.5 million account details. The user uploaded 6,458,020 SHA-1 hashed passwords, but no usernames. Several people have said on Twitter that they found their real LinkedIn passwords as hashes on the list. The Verge spoke with Mikko Hyppönen, Chief Research Officer at F-Secure, who thinks this is a real collection. He told us he is 'guessing it's some sort of exploit on their web interface, but there's no way to know.' We will have to wait for LinkedIn to report back to be sure what exactly has happened."
An anonymous reader tipped us to related news: The LinkedIn iOS application harvests information from your calendar and transmits it to their servers unencrypted.
If he has the password hash, then he most likely also has the username. He just didn't share them with the rest of the world and is likely trying to sell them.
As an IT/security guy reading about these seemingly constant ongoing password change requests, I can't help but think that the problem lies not only with how many special characters we're using in our passwords, or whether or not we're using our pet's name, but more so in how the infrastructures of all of these magically eutopian social networks are storing this information. Correct me if I am wrong, but haven't the majority of the recent problems that have forced us all to change our passwords, whether it is LinkedIn, World of Warcraft or whatever been due to leaks from the back-end, not poor Johnny at the keyboard giving it to Ivan the hacker (no offense to the real Ivans or Johnnys)? Kind of like having to keep replacing the car tires because the roads are made of broken glass. Its not my fault, but I have to suffer. It would seem we need to put more PCI/SOX/whatever-like standards in place to better protect and mandate how our information is stored as more and more encouragement is put in place to unzip our metaphorical zippers online.
And for the record, I am not an anonymous coward, but I forgot my password and my email isn't the same as it was 8+ years ago when I set up my slashdot account...
ignorance is bliss in this case :)
The surprising thing is not that Social 2.0 Mobile Enterprise BuzzCloud App-centric bullshit is shoving everything that it can get its sticky little fingers on to every 3rd party with questionable security and a dire privacy policy that it can find; but that they seem to be so incompetent at it.
Exfiltrating the data in the clear is certainly easy enough(luckily 'mobile' frequently means 'even if I were competent enough, my crypto-crippled appliance wouldn't let me control outbound traffic anyway') but it makes it likely that, sooner or later, somebody is going to sniff some packets at their router and we'll get a little story about exactly how much exfiltration your ghastly little app is doing.
It's like corruption. Even when everybody knows that it is happening, it is still considered crass to get caught with your hand in the cookie jar. You are supposed to pretend to care.
People use these kinds of leaks to generate statistically sorted dictionary files for password breaking. The most commonly used (in the real world, as evidenced by these leaked databases) passwords are put at the front so you try all the more likely ones before moving on to the random guessing.