Slashdot Mirror
Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
First time accepted submitter radudragusin writes "IEEE suffered a data breach which I discovered on September 18. For a few days I was uncertain what to do with the information and the data. Yesterday I let them know, and they fixed (at least partially) the problem. The usernames and passwords kept in plaintext were publicly available on their FTP server for at least one month prior to my discovery. Among the almost 100.000 compromised users are Apple, Google, IBM, Oracle and Samsung employees, as well as researchers from NASA, Stanford and many other places. I did not and will not make the raw data available, but I took the liberty to analyse it briefly."
Someone got served... ieeeeeeeeeeeeeeeeee
Some actual news for nerds, and from the horse's mouth. And graphs and everything. Love it.
systemd is Roko's Basilisk.
Does this make plaintext password storage an IEEE standard now?
That could save an, er, friend of mine, a lot of work...
when are we going to all start hashing and salting passwords? It takes virtually no effort to do.
in combination of the website it is used for
Why do we need to learn this from the newspaper?
In addition to setting correct permissions, there are several FTP servers that suppress passwords in their logs. (e.g., Serv-U: Server Limits | Password | Mask received passwords in logs)
Even on anonymous FTP servers, you should hide passwords in the logs; otherwise someone who gets the logs can mine email addresses. (Anonymous users frequently sign on as "anonymous" and are asked for their email address as a password.)
I was going to make a joke between IEEE and Internet Explorer, but I couldn't think of one. But web browsers do store users' passwords for various sites, which got me thinking:
For passwords used to authenticate users to this system, hashing should be the standard. But for passwords used to authenticate a system to another system, such as authenticating an online store to its payment processor, the password has to be encrypted reversibly and the key stored somewhere.
I mean, PLAINTEXT passwords AND publicly available on their FTP.
Does he/still have the job?
You'd think that people involved with the IEEE are a group that should know better, and yet the most common passwords according to the analysis reads like the usual suspects list from other breaches. They're still common, easily guessable passwords. Hashing wouldn't have protected them very long, as these are on the short list for any cracking program to test.
It should be a wake up call that our current methods of trying to get users to pick secure passwords are a total failure. We need to go back to the drawing board and figure out a better way to get the message across, including tools to make it easy for people to get it right.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
As a member of the IEEE I have to admit we have the worst web site you can imagine. It constantly asks for login information as you try to browse and it is hard to find most information online.
It is like having super duper security behind the passcode access panel. But leaving a security camera looking at the people using the panel recorded and making it public.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
One has an uppercase 5. The other is all lowercase.
Password hashing doesn't matter when the login password is conveyed in a URL and the URLs fetched are logged.
From the article, its clear that this is what happened: the login process creates a URL with the username & password in it, and since the URLs were logged and accessible, the login passwords could be obtained in the clear.
Test your net with Netalyzr
You could, you know... look in the logs to find out?
Ah, arrogance and stupidity, all in the same package. How efficient of you. -- Londo Mollari
Breach gives the connotation, some one or something broke into something that was protected. Here it looks like IEEE, quite stupidly, left valuable data unguarded.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Maybe this ACM vs. IEEE thing is staring to getting out of hand?
"Beware of bugs in the above code; I have only proved it correct, not tried it." -- Donald Knuth
This may be a case where the *smart* users chose passwords like 123456 rather than a "real" password. That's because people tend to use the same passwords on multiple accounts, let's say for one's ISP email and online shopping accounts. If an attacker gets hold of one of those, chances are they'll try to impersonate the user on other sites.
As above, maybe release the usernames so those affected know to change their passwords?
Now that you've analysed your copy of the data, please delete it.
I just called and got a refund on my $185 dues. I'm not paying money for this kind of incompetence.
After taking a look at the original article (I know, I know) it has an interesting plot about the prevalence of particular browsers. It looks as though there is a clear dip in the use of the site at weekends (at least the two weekends shown), but what's more interesting is that the browser use proportions also seem to change at the weekends, with a drop in the proportion of IE users. Is this a known thing generally?
Korma: Good
Out of the 100k passwords how many were unique? Could we have a graph of how many passwords were used how many times? Something that could be analysed to say that in your case about 85% of people used a unique password and 10% used a password in the top 10 or top twenty whatever. This could be used to compare to other datasets to extract a level of cluelessness/cluefulness.
I must sadly post AC. I maintain a website which uses plaintext passwords. We know that it's both insecure and also (since so many users re-use passwords) makes the users insecure at other sites.
And yet, AFAIK we never intend to fix our website.
Part of the desired behavior of our site, is that we have to be able to tell users what their password is. I think the boss is convinced that users would be unhappy with having some kind of random password reset thingie. So we the admins need to be able to look up what someone's password is, without changing it, so that we can tell that value to an (unauthenticated!) user.
You can't argue with people when they are completely convinced religiously that their way is the one right way and the other 99.999% of the world is wrong. It's not about difficulty of fixing it; it's that a "fixed" system would be judged by to be inferior.
I remember a particular product created by a co-op student enrolled in an EE program which has the following data structure for the main table: Column1, Column2, Column3 etc.... The resulting code was difficult to maintain. It also had a hardcoded backdoor password.
The IEEE web site has annoyed me for 15 years... it is the lamest, backwardest, hardest to use, most idoidocally designed web site of any of the professional societies involved with computing. It is an embarrassment. Perhaps now the morons that are resposible will be seen for the morons that they are. Or not. I'm not holding my breath. This is the IEEE.
we all know how easy it is to recover Windows passwords.
While the Windows NT-style passwords database is trivial, and it is trivial to "blank" a password to enable logging into an account with an unknown password, 21st-century versions of Windows have a strong password database. Well, strong from the point of view of "cracking" a Windows password database offline and assuming there are no weak passwords.
like most password-based systems, it is still the "brute force" method if the password is weak or if you have something to go on like "this user always uses a month plus a word out of the dictionary plus the name of a family member." It's also somewhat vulnerable to the rubber-hose/"tell me or you are fired"/intimidation method but only against an adversary who can be intimidated and who believes you can carry out your threat.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The passwords were not stored in plaintext.
However, the web server access logs logged the passwords entered in plaintext. That was what was downloaded from a publically access ftp folder.
I think you meant to say:
The passwords were not stored in plaintext in the place normally used for storing passwords.
However, the web server access logs logged the passwords entered in plaintext and in doing so, stored the passwords in plaintext. That was what was downloaded from a publically access ftp folder.
OBmeme: There, fixed that for you.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If some future update to Unicode results in oh, say, 70 or 80 unique unicode characters that look like *, you will be able to store and play back most US-typewriter-letter+number+symbol passwords and have them look like * to the untrained eye.
Imagine a hacker taking over a web server so it stored passwords in this format instead of replacing them with *'s, then sent the file containing them back to the hostile intruder at a later date. To a naive human being eyeballing the logs, things will seem normal. Of course, such a change is easily detected, but it is one more thing administrators will have to check for if they suspect intrusion.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The least these idiots could have done is to send a short mail and notify IEEE members about this...
What?!? That's the same combination as my luggage!
Science advances one funeral at a time- Max Planck
I'm saddened that it came to this, but I'm happy they were gracious enough to refund your dues.
I have strong faith that they will be spending at least some of everyone else's dues on fixing this problem.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
For all the money an IEEE membership costs, not to mention the ENDLESS reminders they send you about how great it is to be a member, you'd think they could administrate their FTP a little better.
Suddenly enduring 100s of e-mails from an incomplete sign-up attempt a few years ago seems justified.
"You IEEEdiots!!"
Now we know that firefox users wake earlier, and chrome users go to bed later.
Ieee!
I'm not a lawyer, but I play one on the Internet. Blog
After all, you must be a terrorist hacker. I'd keep an eye over my shoulder if I were you.
So you discovered a breach in the IEEE website and for a few days you were uncertain what to do? Maybe call them up and tell them?
they made me change my username and password when I logged in the other day.
This was done, according to them, to be more secure. Even before I found out about this nonsense, I told them that tieing a password to a specific identifiable person, using a tag that was nearly publicly accessible, was absolutely less secure than letting someone pick a username that appeared noplace except in the login database. I pointed out that everyone in IEEE now knows my username, because IEEE uses it to send out email notices and deal with customer support requests.
I also made a comment about how I would not be surprised to find out that they were storing this information in the clear. That was yesterday. Today I read /. and find out that not only is it kept in the clear, it's kept on a publicly accessible FTP site.
Gawd. If you tried, you just couldn't make this stuff up.
Oh god the splines! They should not be used for discrete data.
//TODO: signature
Who knew Wichita was such a practical HOTBED of IEEE membership?
I said no... but I missed and it came out yes.
Michael kors handbags are among the most sought after bags in the market today. This is mainly because of the high quality material and the unique style that they portray. The fact is quite evident in the increased sales of the bags among fashion icons, movie stars and celebrities. The umichaelkors companyhas invested its resources towards meeting customer needs as is the trend nowadays.