Slashdot Mirror
AOL Finally Admits They Were Hacked
pdclarry writes: "Anyone managing email servers or lists has suspected for several weeks a major hack of AOL's servers, based on a sudden spurt in spam ostensibly from AOL email addresses (but actually spoofed) and sent to the contact lists of those AOL accounts. Of course, there is a steady stream of such spam from hacked individual accounts on many services, but the magnitude and suddenness of the most recent spam attack argues against individual account invasions. Well, AOL has finally come clean. Apparently unknown individuals accessed AOL's servers and took screen names, account information including mailing addresses, contact lists, encrypted passwords and encrypted answers to security questions. And possibly credit card information. AOL claims that it affects 'only' 2% of their members, but recommends that everyone change their passwords and security questions."
2% of their members....roughly equivalent to 42 users if my math is correct.
Wait, they employ a "Digital Prophet." Why didn't Shingy see it coming?
>AOL claims that it affects 'only' 2% of their members
That guy must be pissed!
Tell me those are still okay, PLEASE!!!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
A/S/L?
Just got an email from an aol account user 20 minutes ago from "thegiggling666@aol.com." All it said was something about Scanning of class A to C IP ranges for an unlimited amount of ports and about 20 other unique features of some product. Also a youtube link that I have yet to click on.
Mark
I'm having a hard time believing this story because I'm pretty sure AOL ceased to exist fifteen years ago.
These AOLoser accounts don't represent living beings. Everyone with a pulse left for greener pastures a decade ago. All that's left are the accounts of people who died and who's estates keep autopaying the bill. I.E., they are ZOMBIE accounts.
...and so it begins
Nothing worthwhile ever happens before noon
the spammers tried to cancel their accounts via the phone but were just given more free months.
This was the only way.
Seems like 2 or 3 contacts a week with Yahoo mail accounts gets hacked every week. I really wish Yahoo would get their shit together too.
Suppose you were an idiot and suppose you were a member of Congress
AOL Still exists?!
YOU GOT HACKED GOOD BUY!
How does a surge in spoofed spam lead one to conclude AOL was hacked? I understand this was due to people using the information to spoof messages to known contacts, thus being more likely to get the evil links clicked. What I don't see is why mail admins would suspect this before the fact simply due to a spike in spoofed email. Does this sort of thing happen often? (i.e. bulk spoofed to contacts after a compromise)
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
I wouldn't call the last 20 years "sudden"...
News travel 20 years late. Spam at eleven.
"AOL claims that it affects 'only' 2% of their members, but recommends that everyone change their passwords and security questions."
Hey mom? Sorry to bother you, but AOL got hacked, so could you please change your maiden name? I need a new answer for my security question.
This Space Intentionally Left Blank
This is like finding out that Dutch East India Company servers were hacked.
Those "BASTARDS"....
AOL still exists?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Probably a publicity stunt to remind the world that they still actually exist.
I know there are a few random people who still use their AOL email account (for whatever reason), but I have to assume the vast majority of accounts are long forgotten about or were nothing but one time use "get past a registration page" accounts anyway.
This is like the 4th or 5th time they've been hacked this year, they've admitted it every time. How is this news other than that it's surprising people still use AOL mail?
For many people still using an RSS Reader on the web.. and whom loved Google Reader.. AOL Reader is the only reason to have an AOL email account. (with a simple greasemonkey script to hide the ad bar).. It is a well featured, well done product. And I will have to change my (strong, unique) password now, which is a slight bummer.
But this news brings up another issue. The main competitor in the RSS world now is Feedly, but with them deciding to forgo the risk/expense of an authentication system altogether and only allowing OAuth logins via Twitter/Facebook/Google/Microsoft ..with no login system of their own, many people are just uncomfortable giving the Feedly people access to their contacts list and other personal info that they get when using their service.. The info they get access to can be seen in screenshots here: http://imgur.com/a/jsXfT
Perhaps Feedly (and others) have a bright idea there, avoiding rolling their own auth and letting the inevitable data breach land on the hands of the likes of twitter and Microsoft instead of Feedly itself.. .. That certainly may have been a good idea for Adobe, who lost 1.2 million accounts.
Even 2% makes me a little worried about the product that is pretty great in AOL Reader.. and I am gonna probably fire up the locally run Tiny Tiny RSS reader this weekend to make sure I have a backup.
Just before Mother's Day, so many a geek can go see Grandma and kill two birds with one stone.
They haven't required payment for a decade.
AOL is a free e-mail account with a bad interface.
Does AOL let you write your own, or do they use the same seven security questions I see everywhere else?
My 78 year old boss's AOL account was hacked a few weeks ago. It started receiving 40-50 undeliverable returns every 4-5 hours in batches. I know it was using a strong password because I set it myself a few weeks before that. I was able to use the obvious breach as a way to finally get the AOL account turned off. Believe it or not, he was still paying 24.95 a month for AOL access. Nevermind the fact that we run our own email server and I can point an alias anywhere he wishes. I think for him it was like an old friend. Forget that all the people he corresponds with use his new account and he's just looking in from time to time to sift through the spam. He knew he hadn't used the account in years, but he'd had it since he'd had a personal computer. Sometimes it's hard for people to just let go.
Personally, I've had too many email addresses to get attached to one.
Were they hacked or not?
They need to be fined for not telling users immediately. They potentially put users data not on AOL alone, but everywhere because it is common for hackers to use leaked data to run it against thousands of websites.
Aol has always been pretty spammy, but they've gotten out of control lately, and as usual, ignoring the problem.
I lost patience with them years ago, and started firewalling any netblock from them that was causing problems.
Solved a lot of problems, and since no one in their right mind uses them anymore, I'm not too worried about blocking anything legit.
Lawyers, MBA's, RIAA? A jedi fears not these things!
I hope when they said "encrypted passwords" they meant "hashed passwords".