Slashdot Mirror
5 Million Gmail Passwords Leaked, Google Says No Evidence Of Compromise
kierny writes After first appearing on multiple Russian cybercrime boards, a list of 5 million Google account usernames — which of course double as email usernames — are circulating via file-sharing sites. Experts say the information most likely didn't result from a hack of any given site, including Google, but was rather amassed over time, likely via a number of hacks of smaller sites, as well as via malware infections. Numerous commenters who have found their email addresses included in the list of exposed credentials say the included password appears to date from at least three years ago, if not longer. That means anyone who's changed their Google/Gmail password in the last three years is likely safe from account takeover.
So where do we go to find the actual "list of exposed credentials" ?
Google allows you the ability to enable per-device passwords plus the GoogleAuth Two-Factor system to lock it down.
Interesting how that seems pretty close to when google enabled the 2 factor auth?
Their security is deplorable and Apple should be legally responsible for any losses people incur as a result of this!
http://www.reddit.com/r/netsec/comments/2fz13q/5_millions_of_gmail_passwords_leaked_rus_most/
More directly:
https://mega.co.nz/#!rgFDDRSD!QyyLxZNnR8i9fF_aNkKI-wUIUV3fjX5o0dxdl-bE3zQ
From 123456 to abc123. There, I'm safe from Soviet hackers now.
It's funny that you say "true capitalism" is a fairy tale... and yet communism (I'm assuming you mean the "true" kind) is your goto.
Maybe somebody should mod you funny.
Here is a link to the ascii text file.
https://mega.co.nz/?_escaped_fragment_=ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ
Really just people trying to ride the coat tails of the fappening. Ermagurd, mad hax!
https://mega.co.nz/#!rgFDDRSD!QyyLxZNnR8i9fF_aNkKI-wUIUV3fjX5o0dxdl-bE3zQ
For anyone who wants it.
My emails weren't on it, nor was the emails of others I know.
Google offers 2FA for free, labled as "2-step authentication". Setup takes about 3 minutes, hassle on known devices is roughly zero, and it makes these attacks irrelevent. Can do SMS, Authenticator app, etc.
ERROR: Null
Come on, Slashtards, you know you want to...
Don't be bashful. Tell us how companies that have private information taken from them but whatever unknown methods should be shacked to a brick of iron and dropped into the deepest point of the sea. You just did it a week or two ago. We know you can do it again.
I've downloaded the list and neither of my emails are on it. Both of my emails were created when gmail was still in the invite phase. So this appears to not be a leak from gmail. Likewise it appears to not be a leak from youtube, as none of my youtube id's are on it either.
slashdothash@gmail.com
ander.slashdot@gmail.com
slashdotcom@gmail.com
They are in the bad list.
Despite having a public gmail account since it was invite only I escaped the list. Password managers FTW!
All those moments will be lost in time, like tears in rain.
I used the isleaked site for the check and it came back with the first two letters of a password that I was using about 8 months ago. No one seems to be trying it either as my two factor authentication texts aren't going off.
...2 factor authentication for your accounts, too. Google makes it easy.
I'd guess it's just hacks of other sites, filter it on just gmail accounts and hope they used the same password for both
Really just people trying to ride the coat tails of the fappening. Ermagurd, mad hax!
My email is on the list (afforess@gmail.com, go check!) I use a password for gmail I have never used for any other site. So I don't see how this can be the case. I have 2FA on the account, so not too worried, but still!
If our elected representatives no longer represent us, do we still live in a Democracy?
With a gmail account anything after a plus is ignored. You can then use username+serviceName@gmail.com to denote what service you are on. It looks like some people did this, and seems like these credentials are stolen from a few different sites. Here are the most popular after plus endings from the 5 mill:
xtube : 176
daz : 133
1 : 125
filedropper : 88
daz3d : 66
eharmony : 64
friendster : 63
savage : 62
2 : 60
spam : 57
bioware : 54
savage2 : 52
bryce : 51
hon : 40
freebiejeebies : 32
3 : 28
eh : 27
4 : 25
policeauctions : 19
bravenet : 18
filesavr : 18
you mean you still actually take your cell phone out of your pocket to use it?
How quaint.
What's a pocket?
This is the 21st Century.
We all wear form fitting science uniforms and have jetpacks and flying cars.
-- Tigger warning: This post may contain tiggers! --
I was on this list and i had an unique (for me) password for the google account. I've had the account since you had to beg for an invite to get in as well.
I apologize for the lack of a signature.
Has this resulted in one breached account? For all we know, this is just a list of email addresses. Need more evidence, like boobs.
I could harvest 5m gmail names from google searches, and then publish them with bogus passwords and create panic. Is there some statistic that says how many of these were real passwords? Because wouldn't it be illegal to use them (accessing another person's account w/o their permission is a crime in the USA).
Seems like it would be easy to manufacture a lot of FUD by making these claims w/o really having any passwords at all, and no one could verify it?
https://www.accountkiller.com/removal-requested
Use this page to check if your address is in the leaked database. I'm using the list (without passwords) that was published here in slashdot in the above comments. I'm not capturing the email addresses of the people using the tool:
https://bigjocker.com/qd/googl...
If you don't trust me (and I don't blame you), just download the file posted a few comments above this one and grep yourself:
ngranek@trantor:~/Downloads$ grep bigjocker google_5000000.txt
ngranek@trantor:~/Downloads$
Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
This isn't a gmail leak. My email address is on the list, so I downloaded the full document with passwords. The password that was leaked on my account was NEVER used for gmail, I only used the password for other "less trusted" sites.
Who needs a pocket my computer displays on my contacts and blast audio through a bone phone.
i thought once I was found, but it was only a dream.
I guess this is just a small fraction of the actual list, because such a list has a value and why just handing it out for free? Releasing a fraction and seeing people going upset because they are on the list, and it's actually their password, however, increases the value of the actual list. Even more so if the actual list is more recent.
Perl Programmer for hire
did the icloud buzziness result in one breached account? no evidence of that. a lot of the nudie selfies were taken on sammy phones.
I neither know or care. It's just a bit early to try to stir the pudding here.
...sez the guy whose homepage is facebook.
Never trust an atom. They make up everything.
Except that you already did try to "stir the pudding."
Imagine that, a Slashdork being a stinking hypocrite.
A total surprise to me that my email address was on the list, and they had the current password. I changed that immediately and activated 2-factor authentication. So the next question is how did they get it? It's a unique string of random crap so it had to be intercepted rather than brute forced either with a malicious android app or, more likely, I signed in on a compromized computer. Anyone have any ideas?
Which doesn't give you a file, just prompts you to install malware.
I'm on that list! Definitely not my current password but definitely a password I use elsewhere (USED!). I wonder if this was taken via another account that links to my email address. Big humongous props and thanks to people who found it and made the sites to check it. I'll miss that password though. It was a nice throwaway that's second nature for me to type now.
If this link prompts you to install malware, you probably should check your PC and/or ISP for browser hijacks.
Opens proper Mega's site with Mega's SSL cert and google_5000000.7z (28.7Mb) download. 7z contains a plain text file.
hah, the optic nerve is SO last gen. my I.queue directly stimulates my visual and aural cortices.
Cellular subscribers in the United States who do not pay per month for unlimited SMS have to pay for each outgoing and incoming message. So unless I'm severely misunderstanding something, I'd have to pay my cell phone provider 20 cents every time I want to log in to any Google service. Is there something cheaper?
My point stands
-- Tigger warning: This post may contain tiggers! --
How quaint. When I need to know something, my computer travels back in time and alters history so that I always knew it.
Not only Gmail passowrds. Gmail is singled out just because it is popular most of the passwords are from it.
Therefore Gmail/Google were NOT compromised.
As usual, shitty Windows was compromised and passwords were spied on.
(and still is if you hunt around a bit - I found it without too much trouble).
What search engine were you using to locate it?
I'm sure it won't show up on google's search results.
(Or other pointers on how to get the list with passwords ?)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I don't see either one of my e-mail accounts on there.
Thankfully I use 2SA just incase.
Comment removed based on user account deletion
As the Doctor uses pockets, and is quite proud of them, we can be assured that they'll stay useful till the end of time.
i laughed when i saw friendster in the top 10
it makes me think about a recent discovery (The Onion)
Reddit comments are being actively deleted.
Luckily, Google hasn't blacklisted the piratebay cache, yet.
checking.... Nope. None of my password is in there.
Will pass the file around for my friends to check theirs.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Oh no, what will I do?
Not funny at all. Capitalists love their own brand of communism, benefit from it, support it, make money off of it, and mandate it
when it is the most profitable choice.
They are not opposites. Communism is something "capitalists" leverage and utilize when it suits them.
Private property and never-ending billion-dollar taxpayer-funded bailouts and communism for those on top,
the "free market" and "capitalism" for everyone else. The "capitalists'" favorite plan, and it always works on idiots like you:
Parent is a troll or young and naive. Ideologies are practically always complementary. You will never get anyone on board.
The goal is to get yourself in power, not to change anything. It doesn't matter what people pretend to believe, what matters
is you are on top and they are not. Who cares if you call yourself a communist or a capitalist? Thoes are little kid's theories
who have no clue.
People in power divide and conquer, nothing amazing
or surprising or revolutionary about that.
Hook, line, and sinker AC. Way to be a moron.
They could not care less what system you think you live in, it is simply "what can we call things to keep you so you don't
kill us?" Some places you call it "communism" and you stay in power, other places you deceive people and tell
them they have a "free market" as you loot from them left and right endlessly.
Parent is pathetic, but you are just doing an ad hominem.
Refute what they actually said, affirm their points, offer something new, or shut the fuck up please.
Your "goto" is old and pathetic. You are just aiding communism with your tripe.
They "goto" gether you fucking brainwashed moron.
Are we expecting some Android celebs nudes? There must be some in there.
Was surprised to see my email on the list with the right password. I have never used the password on any other site (except of course on my android phone).
Isleaked.com domain was registered before the first post to russian bitcoin site. The list was first published on Tuesday but this domain (isleaked.com) was registered on Monday at 07:32:34 Zulu. The site is behind cloudflare which does log information about each access. The entity behind the isleaked.com site would have to purge their logs on cloudflare even if their servers don't log accesses or worse POST queries.
It says passwords for two of my accounts were leaked.
However the "first two symbols of the password" are WAY OFF.
I wonder if they brute-forced and somehow ended up with some completely different passwords which collided with the hash of my actual passwords. What would even be the odds of that?
Very, very low. Even if it was an MD5 checksum and your password was in the ballpark of 20 characters or so. At least that's my layman understanding. I've never been terribly great at math, so take it with a grain of salt (see what I did there? It's a cryptography pun, but I guarantee it wasn't intentional).
Can anyone with the maths confirm?
I found one of my Gmail accounts in the list - the one I usually use when asked on forums and such. Using https://isleaked.com/results/e... I saw that the password leaked is not the actual gmail password, but the password I use when signing up on non-important sites, including Slashdot.
I'm quite sure the email+password was collected from another site, can't be sure which one.
I just build an Android App (Hack Alert) to quickly check if your email address is in the list. I just published it, so you might have to wait a few minutes to get it.
I'm thinking to extend the App for future events like this, with real time notifications, the only issue, is how do I get good data?
https://play.google.com/store/apps/details?id=com.zeropii.hackalert
visit http://crackomania.blogspot.com/ to get the complete list of GMAIL accounts which have been hacked.
I'm guessing that if this really is a list of Google accounts and passwords, that they got it from somewhere other than Google. As far as I know, Google doesn't store passwords, they store salted hashes of passwords.
Anyone in their right mind wouldnt go to a website to check if their email has been leaked, id change my password regardless of whether it has or has not been leaked.
Ahh, you guys are funny. Time travelling from 18th century, but pretending to be time travelling from 23rd century. Go and check actual 21st century and you will weep.
Bingo Dictionary - Pragmatist, n. A myopic idealist.
Original source: https://forum.btcsec.com/index.php?/topic/9426-gmail-meniai-parol/
I found out at www.gmailleak.com. Check yours before it's too late!
Check out http://www.askingeasy.com/check-if-my-email-is-leaked to see if your email is in the leak.
I change my Gmail password at least every 3 months. I never use the same password twice, though I do use the same 'formula" to compose the passwords other than my Gmail account. For my primary Gmail account, I don't use the formula. So if you hack my primary Gmail account, you can't get into my backup / recovery account easily...or vice-versa. This is easy to do and you don't need a powerful memory. Just a meta-memory.
Only boring people are ever bored.
My son once did http://generatoronline.net/pas... site to create strong passwords.. Try it, maybe today it will be a useful thing.
Can you please upload the list to piratebay? I cant find it anywhere..!!
It was alread *rejected* from pirate bay.
Look around for "10 millions emails yandex mailru gmail w passwords 2014".
It might still be in some cache (that's where I found it).
And it starts poping up around on other tracker.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]