Slashdot Mirror
Alleged Massive Account and Password Seizure By Russian Group
New submitter Rigodi (1000552) writes "The New York Times reported on August 5th that a massive collection of stolen email passwords and website accounts have been accumulated by an alleged Russian "crime ring".
Over 1.2 billion accounts were compromised ... the attack scheme is essentially the old and well known SQL injection tactic using a botnet. The Information has been made public to coincide with the Blackhat conference to cause a debate about the classic security account and password system weaknesses, urging the industry to find new ways to perform authentication. What do Black Hat security conference participants have to say about that in Vegas?
Is just too hard....
what is the use of accumulating a billion passwords if you already can sucessfully hack into the systems to steal them?
Or is the hacker that stole my /. credentials writing this post?
Come on man
Posting as AC since I do not know if my /. account has been affected or not ...
Of course, the company which reveals this offers a $120/month breach notification service so they have a strong incentive to exaggerate. I'm not saying we should immediately discount these claims but let's make sure our grain of salt is in there.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
For those inclined to make moral equivocations between the NSA and the Russian government, both do what the NSA got caught doing. The difference is that the US Government would have the FBI kicking in this gang's door with a SWAT raid if they were Americans, whereas Putin is probably chuckling right now if he's reading about this.
Not a single mention of Windows in the article, only the term botnets which we all know is 99% Windows. The average joe needs to be educated that using Windows is dangerous, period. If they happy click in other OSs it's not impossible to get "infected", but it's certainly much more difficult. Period.
However, on the exploitation side, it's not really a Microsoft issue. It's hipsters writing crappy code in all languages who don't have the raw programming acumen to avoid things as basic as sql injections.
Is it because of a dearth of talent in the labor pool? Possibly. It's sad to see companies having to hire hipster kids who are a whiz at using fb and twitter, but their only programming experience is completing a one month crash course in Rails. Until this changes and stakeholders realize that professional code can only be written by professionals, we'll be reading these types of stories for many years to come.
Just keepin it real.
How was this even possible? Passwords should NEVER be something you can steal since they shouldn't actually be stored as clear text (or even encrypted, for that matter).
Hasn't it been common practice, for at least a decade, to store the passwords as a salted hash (using a unique salt for each user)?
You shouldn't be able to steal a password since the site shouldn't have it.
Because of the ever increasing amounts of internet insecurity, shills paid to push corporate/government agendas and rebuke/dismiss detractors, "sock puppet" and AI posters, overzealous copyright take-down operations, pay-only access to verified (ie: useful) information, spamming, spoofing, bandwidth throttling, spying, tracking, personal information gathering, legal constraints and considerations, over-suspicion of anyone not 100% politically "correct" or aligned with power, agenda based "news", "echo effect" search results, and probably some other stuff I can't think of right now, the internet is quickly losing it's ability to be much other than a channel for light entertainment.
Has the internet hit it's nadir? It's probably only a matter of time before e-commerce fails in a major way due to these security leaks. And it may also be way too late to be useful in organizing any type of real grassroots socio-political change. Let's just go watch cute kittens on YouTube.
Everything and its opposite is true. Get used to it.
A good reminder that organizations should consider adopting a storage technique that can protect against this.
For dedicated servers, we've used a hardware dongle to store a key used to encrypt password databases. It can be a PITA to move the dongle when a server crashes, but mostly works well.
For cloud services, you can leverage crypto techniques (PolyPasswordHasher) for protection. Migrating our existing password db over only took a few minutes and there doesn't seem to be any usability or performance downside.
What's the excuse for widespread issues? Are pointy-haired bosses emphasizing TPS reports and making password database protection low priority?
Just because something is written in the NYT does not mean it is true, I have seen no evidence to substantiate that claim
to change all your passwords
use something like keeppass or lastpass
YMMV
who where what when now?
I'm Confused. If the hack is SQL Injection that would mean that the password were stored in clear text in the DB. Who the hell does that anymore?
Why is it I am hearing about this on Slashdot two days later than other news sites? I used to be able to count on breaking tech news to show up here first.
-g-
...stays in Vegas.
This story seems to have no actual meat to it. They say that a lot of sites have been hacked, some big names, we knew this. Many sites are still vulnerable, we knew this. By not disclosing the sites you're making more people vulnerable, and it's bad for everyone. It's going to take something bad happening to someone to learn the importance of password security for themselves. Some people will never learn certain concepts unless they experience them for themselves.
Check out http://wiki.buanzo.org/index.php?n=Main.Wp-enigform-authentication
Wordpress Plugin for Enigform Authentication - Definitive Guide
They also made an instant messenger called jiffie
Where's the list that of breached sites?
Within the phrase 'Russian crime ring', the last two words are redundant?
Requiem for the American Dream
What does an SQL injection have to do with the alleged weakness of username/password authentication?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
> What do Black Hat security conference participants
> have to say about that in Vegas
Obviously, all passwords should be stored in Vegas.
Because what happens in Vegas stays in Vegas.
Security. That's how it works.
How many of those 1.2 billion passwords are "password"?
How come Slashdot never gets Slashdotted?
Once again proven that the IT community is not the bunch of geniuses that you guys like to paint yourselves up to be.
So what exactly was compromised? This is so vague I can't figure out what actually happened.
Normal log in mechanisms do not store passwords, but instead store hash codes.
A hacker can not log in using a hash code.
A hacker can only log in using text that converts to a matching hash code.
Good luck trying to figure that out.
I worked on project at a telco a little under 10 years ago and much of the provisioning code was written in Moscow. I couldn't help but think even back then what would happen if Putin really got out of control. It was already apparent that he had overwhelming nostalgia for the CCCP. Sooner or later we'd be in some sort of conflict with him; was it really a good idea to allow this kind of software to go to a potential belligerent. Never mind code for financial and payment systems. Same with China. It probably isn't the case here, but maybe we should think about these things more.
-- I ignore anonymous replies to my comments and postings.
Most people with Gmail accounts are not familiar with the "Last Activity" on the lower right. Clicking "Details" will bring up a list of the recent IP addresses that accessed the account. Unless someone logs in and changes your password, you can monitor for unauthorised account access by checking the location and address of recent logins. I monitor my account. Some people would have no clue someone is regularly logging in to capture info. It even shows when two are logged in at the same time. Try it. Log in at work, and lock the screen. Go home and log in again. It will show the two as logged in.
The truth shall set you free!
This may be a hoax; but it is certainly not impossible for this sort of thing to happen.
What governments and businesses need to know/do is:
1) Understand that there is no such thing as ABSOLUTE security - every castle, system, etc can (arguably will) be compromised. The dilemma is whether the cost/effort needed to compromise the system is worth the reward/gain.
2) They should only keep the essential information - don't keep what you don't need. Besides, what they don't store can't be stolen - in the long-run it's cheaper for them and better for the user/customer. Legally speaking, businesses/agencies that store personal/private information is assuming a fiduciary duty to the customer/user - particularly in protecting their data.
3) They should keep the data as atomic/discrete (ie separated) as possible. Instead of housing everything in one mega-database, user information should be kept separate from credentials (passwords), which should be kept separate from banking data, and that should be kept separate from transaction data.
4) All data access should require credentials (certificates and/or passwords) - preferably, the credentials should only provide limited and/or one-time access to the data.
5) Particularly sensitive information should be encrypted within the database, and all access should be logged on a separate system.
6) Credentials and certificates should NEVER be stored on the same system they access.
7) They should use randomly generated unique IDs for each segment of the data - preferably, these IDs should be changed on a regular basis (like passwords).
8) Government issued ID numbers should only be used by the government agency that issued the ID, just like bank account or credit card numbers should only be used by the bank that issued them. Employers should NEVER use the employee's SSN, driver's license, bank info, etc as an employee ID.
9) They should ONLY aggregate the data as needed (at transaction time) - if possible, they should even avoid having more than one segment within the same code.
10) They should make an effort (ie spend time & money) to protect user/customer information data - like it was their own.
A) They should have their entire system audited by certified external analysts - I wouldn't be opposed to (random) government audits of corporate data.
B) They should spend more time and money resolving the issues/findings, and then have their systems audited again.
C) They should also regularly update the system. Over time, the cost/effort to overcome any security system decreases while, in most cases, the value (ie gain) increases.
11) If they aren't willing or able to spend the time/money to protect the data, then they should NOT be allowed to store personal data on their systems.
12) If they do store a user's/customer's information, the user/customer should be able to request certified proof that the system was audited - to verify that their information is safe.
13) All parties should utilize up to date encryption, virus/malware, and security technology to secure their and/or the customer's information.
14) No matter how much effort/money is spent, there is no such thing as ABSOLUTE security.
Personally, I believe that what most businesses are doing with customer's data is reprehensible - and should be outlawed. A person's private information is just that, PRIVATE. Outside of storing financial transactions, user's/customer's information shouldn't be kept to do market research/analysis. They certainly should not be able to profit off of the data - that's a violation of their fiduciary duty. If you think of every worker as a little private enterprise and their employer is effectively "the customer", imagine how much information each of us could collect from every "customer" we've had. Then imagine if every worker started analyzing and selling/sharing "trends" with other "private enterprises", or using that information for their personal benefit. How
We recently changed our Internet service with Swisscom (details unimportant, but it involved installing a different router). I received a letter in the mail confirming the user name and password in plain text. The password hadn't changed - it is the same one that I chose years ago when we originally selected Swisscom as our ISP. Which, of course, means that they have not hashed the password, but have stored it in a retrievable fashion.
Now, this is fairly minor, because the password isn't good for much beyond logging the router into the ISP. However, so many people use the same password for multiple things that it is still lousy security practice. When I challenged Swisscom about this, their explanation was that it enables them to provide better technical support. Meaning, I suppose, that lots of people forget their password, and this way they can be told what it is, rather than having to reset it.
It's still lousy security practice, and pretty shocking from a major company.
Enjoy life! This is not a dress rehearsal.
As far as I am concerned, either post the list of sites that have been compromised, or STFU!
...because Verizon can!
Looks like they have started selling email addresses. I just got email from multiple spam runs for my email addresses from:
netfirms.com
joker.com
sys-con.com
mixonline.com
livedesignonline.com
Spam does not bother me so much. But the first two email addresses do. They are my domain registrars. So they have my account information and could change my domain registration. Time to change some passwords.
RLH