Slashdot Mirror
Android Forums Hacked: 1 Million User Credentials Stolen
An anonymous reader writes "Phandroid's AndroidForums.com has been hacked. The database that powers the site was compromised and more than one million user account details were stolen. If you use the forum, make sure to change your password ASAP. From the article: 'Phandroid has revealed that its Android Forums website was hacked this week using a known exploit. The data that was accessed includes usernames, e-mail addresses, hashed passwords, registration IP addresses, and other less-critical forum-related information. At the time of writing, the forum listed 1,034,235 members.'"
Was it run on... Linux? BWAHAHAHAHAHAH!
Linux = FAIL.
Windows or OS X are the only secure solutions.
Androids forums had a million users!!!!! Take that Apple!
It's the third major hack in two days. Summer break boosts hacking?
My knee-jerk reaction was that there's a new, unknown exploit out there but from the summary I see there's a "known exploit".
At least I don't have an account there and now I am sure I never will...
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
I use a unique email address and randomly generated password for every single website to which I register. I don't know if I am a member on this forum but even if I am, I'm not going to bother with changing credentials because frankly, if somebody wants to impersonate me on a forum I may have joined simply for advice on a particular product I say go for it.
Like this comment? I accept Bitcoin! - 153sc8UUBXyp12ofQqfAWDmJrzyiKCYC1x
This serves as yet another reminder of the value of using a password manager that can generate unique passwords for each and every site and then store them securely. That way, when the inevitable happens, as it did here, only that one password is compromised, and it comes at no hassle to you.
I've been using 1Password for years, but a number of folks here seem to like KeePass, and I'm sure a few kind folks will reply with more suggestions below.
Link to forums... (Thanks for making me add more than just the link, /.)
Most websites are "NOT SECURE" enough, so pretending that they are is simply dangerous. Wanna know how secure that website is? The Login is not on a SSL connection. Nuff Said!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
i'd love to use keepass, but i am too fucking stupid. i am going to try again right now. fucking complicated shit.
You hear that, Slashdot? Now you know how to get rid of this guy!
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Some low budget Android site gets hacked and we feel the need to talk about it? It's a fucking PHP based site. I'm surprised not being hacked in between each restart to recover from memory leaks.
Shouldn't forums just need a digital signature?
androidforums.com runs on a cluster of old phones. A simple android root program injected into the php was all that was needed :P
Silence is a state of mime.
That sounds less secure to me, since a simple rubber hose and some pliers applied to you can result in the recovery of those passwords. In contrast, I don't even know the vast majority of mine, offering me plausible deniability. You'd have to not only gain access to me, but also my encrypted database of passwords in order to get access to mine (and since the company behind 1Password has demonstrated a willingness to update and improve their encryption in the past, I expect that they'll continue to keep up with the times, such that no one will be able to simply crack the encryption and gain access to my passwords).
It appears that the change password page is Slashdotted - I can't get more than one character into the form before it freezes up.
Good thing it's still using the old password that I used for forums before the great LinkedIn password crisis!
Three Squirrels
Hacking sites to leak 100 thousands of passwords? This is the fourth recent case I know of.
I just wanted to mention that KeePassX runs on UNIX systems.
That is all.
AccountKiller
Here is the original source, with more information and less sensationalism. They aren't sure if any user information was downloaded, but are treating this as a full breach. To their credit, they at least hashed the passwords, and chose to inform their userbase rather than sit on it until they figured out if any user data was actually stolen or not.
Lets just make everything public.
That's great, but who remembers the one password to your encrypted database of passwords?
They open sourced the passwords? :-P
Paranoid Androids?
The best passwords are those hiding in plain sight. I like to keep a few pictures of things at my desk that instantly remind me of the password. For example it could be a picture of a big fat guy for password 300#FatGuy. That way you're unlikely to forget and still nobody would ever guess the actual password.
I do, of course, but as I said, they'd have to grab both me and the database in order to use the rubber hose method, whereas AC's technique requires no database, since the palace he's talking about is a memory retention technique, meaning that grabbing him would mean grabbing the database at the same time. I'm not suggesting mine is immune to rubber-hosing, just that it requires one more step to be possible, making it a bit more secure.
That sounds less secure to me, since a simple rubber hose and some pliers applied to you can result in the recovery of those passwords. In contrast, I don't even know the vast majority of mine, offering me plausible deniability.
"Plausible deniability" is a piece of legal weaselling, not a way of stopping someone slicing your balls off with a cheesewire..
To have a right to do a thing is not at all the same as to be right in doing it
Sure...but it keeps my passwords secure! ;)
Yep, and KeePassDroid on Android.