Slashdot Mirror
LinkedIn Password Hashes Leaked Online
jones_supa writes "A user in a Russian forum is claiming to have hacked LinkedIn to the tune of almost 6.5 million account details. The user uploaded 6,458,020 SHA-1 hashed passwords, but no usernames. Several people have said on Twitter that they found their real LinkedIn passwords as hashes on the list. The Verge spoke with Mikko Hyppönen, Chief Research Officer at F-Secure, who thinks this is a real collection. He told us he is 'guessing it's some sort of exploit on their web interface, but there's no way to know.' We will have to wait for LinkedIn to report back to be sure what exactly has happened."
An anonymous reader tipped us to related news: The LinkedIn iOS application harvests information from your calendar and transmits it to their servers unencrypted.
Haven't you always wanted to forge closer ties with the dynamic marketing and legal-arbitrage entrepreneurs at the Russian Business Network? Now, LinkedIn is proud to announce your exciting, and mandatory, chance to do just that!
This sort of vulnerability is exactly why I avoid storing passwords in hash form. I always store passwords in plain text form. It's much more secure.
Maybe I can find mine, I can't remember it!
Dark Reflection
If you install any app on your mobile device - especially those which thrive off of your data - don't be surprised if it's actually siphoning it off in the background. If groups like Facebook and LinkedIn simply wanted you to access the service remotely, they would just stick to HTML5. Instead, apps give them unfettered access to your contacts, calendar, location, and everything else on your personal device, regardless of platform.
Just remember, it has never been about convenience to the user, and always profitability to the provider.
Password changed and I don't use iOS. I'm all good... until next time. :P
Well, as long as the source of the leak is unknown, how do you know they cannot access your new password?
Greetings comrade,
Try the following password: 12345
Sincerely Boris
If he has the password hash, then he most likely also has the username. He just didn't share them with the rest of the world and is likely trying to sell them.
"Harvested" -- I love it!
"Bernie Madoff harvested money from his investors."
"H.I. harvested diapers from the convenience store."
"LinkedIn harvested private data from my phone."
They're doing you a favor by "harvesting". Because it's not doing anyone any good if it remains "unharvested".
the growth in cynicism and rebellion has not been without cause
As an IT/security guy reading about these seemingly constant ongoing password change requests, I can't help but think that the problem lies not only with how many special characters we're using in our passwords, or whether or not we're using our pet's name, but more so in how the infrastructures of all of these magically eutopian social networks are storing this information. Correct me if I am wrong, but haven't the majority of the recent problems that have forced us all to change our passwords, whether it is LinkedIn, World of Warcraft or whatever been due to leaks from the back-end, not poor Johnny at the keyboard giving it to Ivan the hacker (no offense to the real Ivans or Johnnys)? Kind of like having to keep replacing the car tires because the roads are made of broken glass. Its not my fault, but I have to suffer. It would seem we need to put more PCI/SOX/whatever-like standards in place to better protect and mandate how our information is stored as more and more encouragement is put in place to unzip our metaphorical zippers online.
And for the record, I am not an anonymous coward, but I forgot my password and my email isn't the same as it was 8+ years ago when I set up my slashdot account...
ignorance is bliss in this case :)
Thank you Boris, but that is my luggage combination, not my linkedin password.
Admittedly my luggage is more important to me than my linkedin account, but...
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
This would seem to raise two questions. the first is whether or not usernames can be tied to their corresponding hash. Even if they can't that's not a hugely difficult problem to overcome though.
The more serious question is how good is SHA 1 then. A database like this (a table of hashes) is what you'd expect someone could hack from a reasonably secure system (although you would have wanted to see some salting as well as hashing but either way). Having a hash of a password doesn't mean you can regenerate the password. If your password is subject to a simple dictionary attack then sure it can be regenerated, you're pretty much doomed, but you're not much more doomed than you were before. A strong password... now that's where this gets interesting. The question is whether or not there are vulnerabilities in SHA 1 that will let you regenerate good passwords (or even bad passwords that aren't dictionary attacks).
If you had a strong password, and SHA 1 is robust enough you could die of old age before anyone manages to figure it out. If SHA 1 has meaningful holes in it... well that's not so good.
Also, linkedin has 160 million users (or at least accounts) if not more than that. So their full database would be significantly larger than this. It will be interesting to know if this is a particular subset of the data (all iOS users, all android 2.3.2 users, all chrome users, that sort of thing) or something else. Purely hypothetically this could be all of the really early linked in users that haven't changed passwords since they implemented SHA 2 if they ever did for example, or it could be a particular version of the website fails.
People on twitter finding their password doesn't mean a whole lot, unless you know the password was strong and unique, and where those users are from, and when they joined linkedin.
Comment removed based on user account deletion
i can only see ******
Can I light a sig ?
How strong strong passwords are doesn't really matter. Enough people on linkedin will have weak passwords that spammers will be queuing up to get their hands on a new "trusted" delivery mechanism for their wares.
People use these kinds of leaks to generate statistically sorted dictionary files for password breaking. The most commonly used (in the real world, as evidenced by these leaked databases) passwords are put at the front so you try all the more likely ones before moving on to the random guessing.
Replying to myself, in this case you can only get information about passwords that you are actually able to break (i.e. the easy ones), but it can also be useful as an academic analysis of password complexity in real applications.
Link me out
{ Actual quote: Include me out }
try { do() || do_not(); } catch (JediException err) { yoda(err); }
LinkedIn uses e-mail addresses as usernames. Getting access to a crapload of valid e-mail addresses to test against is trivial.
Learning HOW to think is more important than learning WHAT to think.
I can clearly see that it's hunter2.
Bill Clinton: Pimp we can believe in. - The Shirt!!!
In cases like these, I feel like whoever is in charge of security over there needs to be held responsible for not following best practices and salting the damn password hashes. This has been security standard since PKCS #5 v2.0 -- and you know security professionals don't publish these standards just for their own health. And this is not a new fangled thing, it was finalized in 2000 12 years ago.
Failure to do so is malpractice ...
http://www.mediafire.com/?n307hutksjstow3
When checking for your password, check both for its SHA-1 hash and for the SHA-1 hash with the first five chars zeroed. Quoting:
Some observations on this file:
...
0. This is a file of SHA1 hashes of short strings (i.e. passwords).
1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.
Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters set to 0 is.
5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present
Same story for 'secret':
e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present
And for 'linkedin':
7728240c80b6bfd450849405e8500d6d207783b6 is not present
0000040c80b6bfd450849405e8500d6d207783b6 is present
2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.
3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.
4. This may well actually be from LinkedIn. Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword,
5. The file does not contain duplicates. LinkedIn claims a user base of 161m. This file contains 6.4m unique password hashes. That's 25 users per hash. Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file. Evidence against that thesis is that password of one person that I've asked is not in the list.
Just how many nails does this here cloud's coffin take ?
Legally mandated opening EULA clause:
"Your data is no longer private....".
I changed my LinkedIn password a while back (about a month ago or so) my old password shows up in the Hash not my new password.
I mean, seriously. This is something that has been known since, what, the time of Robert H. Morris?
Salt has to be added after it's hashed. Then it tasts better.
The hash file here. I could find my password in there (after changing it). Who uses unsalted hashes? Is it 1991? https://mail.yandex.ru/disk/public/?hash=pCAcIfV7wxXCL/YPhObEEH5u5PKPlp+muGtgOEptAS4=
If the hackers have great control of the site, just logging in to the site could give them access to your password _plaintext_.
So use different passwords for different sites.
Good link. The file seems legit. My hash is in there. Fucking Idiots at Linkedin.
bah.
I've occasionally daydreamed a fun academic paper would be to collect sets of password hashes, rub them up against a rainbow table, and make graphs and correlations and wild assumptions about the correlation coeff of IQ and rate of easily cracked pwd vs site etc etc. Sounds like fun so its probably been done before.
Yes, it's been done on 70 million passwords. See http://www.cl.cam.ac.uk/~jcb82/doc/B12-IEEESP-analyzing_70M_anonymized_passwords.pdf
The wonderful thing about having 6.5 million password hashes to play with is that a simple dictionary attack will probably get you a couple of million plaintext ones within hours. No need to look for weaknesses in SHA 1, just like there is no need for the cheetah to catch the gazelle at the front of the pack when there are plenty of easy pickings at the back.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
What's with all the LinkedIn bashing? I have been using it for years and have never gotten any spam from them. It's a great resource and has gotten me more than one job.
You already know the answer. You just don't like it.
You say that using a different password for every site is not practical. Is it less practical than having to deal with Site A getting hacked and your bank account being emptied? For me, I'm perfectly willing to deal with the hassle of separate passwords.
What I'd suggest is that your "strong" category should all have distinct, strong passwords. I'm fond of 16+ random characters including numbers, caps, specials, etc. It's crazy to trust Amazon and eBay, both giant companies which big targets on their back filled with employees who may or may not be honest, with your bank password. Write 'em down if you have to. You can keep them in your wallet with no note about what they are or usernames, encrypted on your phone, whatever. If that's not good enough, lock them in a safe at home.
I do agree with having a throwaway class of password. I will reuse passwords across sites if they're sites I really don't care about. I don't really have a medium. If having it compromised would be bothersome, it gets its own password.
Try Keepass (keepass.info). It's an excellent, free password manager. There are others as well (LastPass is one that comes to mind). No excuses for not having a different password for each site you visit. As far as LinkedIn goes, changing the password is about all you need to do. You might want to monitor it for the next few days for any suspicious behavior. Evidently the password leak was via iOS so if you're not logging in with an iPhone or iPad then you're probably not affected. Does't hurt to change your password though.
You generate hashes until you match the target hash. It's possible that your original value is different than the actual password. But they hash the same so it doesn't matter : )
http://soylentnews.org/~tibman
"Rainbow Tables" attack: https://en.wikipedia.org/wiki/Rainbow_tables
If the site uses a single salt for all passwords, then as soon as you crack user A's password, you have user X, Y & Z passwords because they have the same account hash. (In fact, you would specifically target any hashes which appear more then once.)
The initial break of the hash is either done via a pre-gen rainbow table (which contains pairs of passwords and their hashes) or by brute-force approach (work through possible passwords, hash them, compare against the list of hashes, spit out the matches).
Also, since you have the hashes, and checking random passwords against the hashes is an embarrassingly parallel problem you can throw as many cores, machines, GPUs at the problem as you want. That lets you try millions of passwords per second. Which is fast enough that you can go through all 8-character passwords plus more advanced schemes like word-word-number-symbol.
Wolde you bothe eate your cake, and have your cake?
Wow, the LinkedIn hacking looks a lot worse as the hours roll by. There is no indication that the security breach has been fixed yet, so logging into LinkedIn to change your password might be futile - the hackers might still be in there and now they've got your new password too.
But thats not the worst, no not by a long shot. The 6.5 million password hashes that were uploaded to the Russian hacker forum are unique - i.e. any duplicate hashes are filtered out. Assuming some users pick the same "easy" passwords, it means the 6.5 million passwords could easily be a very significant chunk of the LinkedIn user base.
And lets take that a step further - until we know any better, we have to assume that the group who hacked LinkedIn and stole those passwords got away with at least your LinkedIn username too. Which is your email address. You didn't use the same password for your email account as you did for your LinkedIn account did you? Oh wait you did.. Better go change your email password too. This list of email addresses alone is very valuable to the dark side of the internet as it's a huge list of confirmed, valid emails addresses.
Its never great to be the bearer of bad news, but what was that - yes, that was it. LinkedIn also allows you to link your profile to your social media accounts - Facebook, Twitter, your private blog, etc etc. If you used the same email address and password to log into those accounts as you did for LinkedIn, you better get moving quick to change all of those passwords too (please, please use a different password for each site this time!) as at this point we have to assume the worst and that the hackers got the details about your linked profiles too.
For some users, your credit card information may have been stored too so you could "upgrade" your LinkedIn account. Oh and your profile probably has your address on it.
Finally, this opens up LinkedIn users to massive identity theft - generally LinkedIn users have uploaded their full CVs. That might even include your birthday and for married people your maiden name. It could easily show your first high school, where you went to college, the name of your first employer, etc etc. What are all those sort of details used for? Accessing your bank account, resetting passwords via security questions, you know, proving your identity online. Ouch.
This hack has potential to be bad. Really really bad. And until we know the size of the breach we have no idea how far reaching it could ultimately end up.
You must make the assumption that the attacker knows both your salt(s) and how you apply the salt(s) to the password to create the hash.
Assuming otherwise allows you to do foolish things like use the same salt across multiple (or all) accounts. Which makes it trivial for an attacker to compute a single rainbow table and attack multiple accounts in one shot.
Having separate salts (at least 8-bit and preferably at least 16-bit or 32-bit) for every individual user gives you a last line of defense in the event that your password database is stolen and your salts/methods are exposed. With individual salts, the attacker is forced to brute-force attack every single account as a separate problem. Breaking one account doesn't automatically mean that other accounts are also broken.
Wolde you bothe eate your cake, and have your cake?
I'm retired but I do have a LinkedIn account and am "connected" to a lot of people in my old profession. Several people I know got very nice jobs through LinkedIn. One got a job as Director of Global Quality for a large Chinese company (and this person is from India) and has quite a nice salary.
I'm not much for social networks, and I don't spend time on LinkedIn but I use it and I personally think it's a good tool for many professionals. I have never gotten any spam from LinkedIn or LinkedIn "members'.
http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised/