Slashdot Mirror
Alleged Massive Account and Password Seizure By Russian Group
New submitter Rigodi (1000552) writes "The New York Times reported on August 5th that a massive collection of stolen email passwords and website accounts have been accumulated by an alleged Russian "crime ring".
Over 1.2 billion accounts were compromised ... the attack scheme is essentially the old and well known SQL injection tactic using a botnet. The Information has been made public to coincide with the Blackhat conference to cause a debate about the classic security account and password system weaknesses, urging the industry to find new ways to perform authentication. What do Black Hat security conference participants have to say about that in Vegas?
Apparently writing itself is hard, much less writing propet software.
Or propet sentences, even.
Or is the hacker that stole my /. credentials writing this post?
Come on man
The use is that you now have a database of 1.2 billion passwords that can be fed into a brute force cracker and used to make "educated guesses" to crack passwords.
Of course, the company which reveals this offers a $120/month breach notification service so they have a strong incentive to exaggerate. I'm not saying we should immediately discount these claims but let's make sure our grain of salt is in there.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
The wisdom of the propets is written on the subway walls.
And tenement halls.
I think the Anonymous Coward account is compromised. Look over his posts, it's mostly complete crap.
-- Make America hate again!
a) Because hacking isn't just a case of having access to everything or nothing. What if you can only hack the password database, but you can't hack the system that those logins are used for?
b) Because, lazy as people are, you now have some very likely candidate email/password combinations to try on all the systems you can't hack into.
systemd is Roko's Basilisk.
How was this even possible? Passwords should NEVER be something you can steal since they shouldn't actually be stored as clear text (or even encrypted, for that matter).
Hasn't it been common practice, for at least a decade, to store the passwords as a salted hash (using a unique salt for each user)?
You shouldn't be able to steal a password since the site shouldn't have it.
Because of the ever increasing amounts of internet insecurity, shills paid to push corporate/government agendas and rebuke/dismiss detractors, "sock puppet" and AI posters, overzealous copyright take-down operations, pay-only access to verified (ie: useful) information, spamming, spoofing, bandwidth throttling, spying, tracking, personal information gathering, legal constraints and considerations, over-suspicion of anyone not 100% politically "correct" or aligned with power, agenda based "news", "echo effect" search results, and probably some other stuff I can't think of right now, the internet is quickly losing it's ability to be much other than a channel for light entertainment.
Has the internet hit it's nadir? It's probably only a matter of time before e-commerce fails in a major way due to these security leaks. And it may also be way too late to be useful in organizing any type of real grassroots socio-political change. Let's just go watch cute kittens on YouTube.
Everything and its opposite is true. Get used to it.
to change all your passwords
use something like keeppass or lastpass
YMMV
who where what when now?
This story seems to have no actual meat to it. They say that a lot of sites have been hacked, some big names, we knew this. Many sites are still vulnerable, we knew this. By not disclosing the sites you're making more people vulnerable, and it's bad for everyone. It's going to take something bad happening to someone to learn the importance of password security for themselves. Some people will never learn certain concepts unless they experience them for themselves.
Actually, why bother if nothing happens to those "losing" this data? Far cheaper not putting any protection in place.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
With an SQL injection you possibly can fetch the password out of the DB.
You would be surprised how many data bases for a certain business has a table called USERS with fileds like uname, real_name, email, password ...
By simlly putting "something ; select password from USERS where uname = 'user'" you can enhance every input field of a website with the stuff behind the semi colon. Even if somehow you cause an error on the server it is possible that the html returned containes the password you are seeking.
Or you add behind the semicolon " ; select * from Users sort by email first 1000" don't remember how 'paging works in SQL'. Replace the 'first 1000' with the approbriated statement.
So instead of a list of items you are looking for on ebay, you have an additional bunsh of text at the bottom of the list holding an extract of the USERS table.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Because if you can hack into a system and get a billion passwords, you can sell those to "interested parties" for a penny each and retire.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Yeah, it is an odd article.
It seems like they are talking about 2 real problems:
1) SQL injection (which could be solved by only using prepared statements)
2) storing cleartext passwords on the server (which could be solved by storing as hash with per-user salt)
Both of these techniques have been old hat for around a decade so the real news is that so many sites could apparently be compromised this way (of course, the entire article sounds invented, so who knows if that is even true).
The "alleged weakness of username/password authentication" seems to be just a "conclusion" they invented for click-bate purposes.
I completely agree with you that their derivation makes no sense. These problems are independent of each other and neither directly implies the conclusion they want to state.
If the NSA now wanted to apologize their domestic spying with "but the others do it too", we should get off the high horse of "we're the shining beacon of freedom in this world", too.
Have your cake or eat it. Either you're entitled to doing what the crooked states do, or you are entitled to look down your nose at them. Choose. You can't have both.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Writing proper sentances is also hard.
So is spelling, apparently.