Slashdot Mirror
5 Million Gmail Passwords Leaked, Google Says No Evidence Of Compromise
kierny writes After first appearing on multiple Russian cybercrime boards, a list of 5 million Google account usernames — which of course double as email usernames — are circulating via file-sharing sites. Experts say the information most likely didn't result from a hack of any given site, including Google, but was rather amassed over time, likely via a number of hacks of smaller sites, as well as via malware infections. Numerous commenters who have found their email addresses included in the list of exposed credentials say the included password appears to date from at least three years ago, if not longer. That means anyone who's changed their Google/Gmail password in the last three years is likely safe from account takeover.
So where do we go to find the actual "list of exposed credentials" ?
America needs COMMUNISM!
Also a note to idiots who babble about "true capitalism" versus "corporate capitalism" and crap like that. Listen, idiots! "true capitalism" is a fairy tale that real capitalism (the actual existing, historically developed society based on private property in the means of production and pervasive commodity exchange, the division of society into the classes of proletariat and bourgeoisie, etc.) tells about itself. It is a democratic fable that is contrary to al the laws of capitalist economi development. It is a pathetic excuse for an indefensible system in its death throes that must be overcome by WORKERS REVOLUTION! FOR A SOVIET AMERICA!
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
Google allows you the ability to enable per-device passwords plus the GoogleAuth Two-Factor system to lock it down.
Interesting how that seems pretty close to when google enabled the 2 factor auth?
Their security is deplorable and Apple should be legally responsible for any losses people incur as a result of this!
http://www.reddit.com/r/netsec/comments/2fz13q/5_millions_of_gmail_passwords_leaked_rus_most/
More directly:
https://mega.co.nz/#!rgFDDRSD!QyyLxZNnR8i9fF_aNkKI-wUIUV3fjX5o0dxdl-bE3zQ
From 123456 to abc123. There, I'm safe from Soviet hackers now.
Do you old people still use that stuff?
I'll bet you use FB too ...
Hey, maybe you should buy an Apple Watch to tell time .... instead of look at the time display ON YOUR CELL PHONE that you have to have to make your Apple Watch work ...
-- Tigger warning: This post may contain tiggers! --
Here is a link to the ascii text file.
https://mega.co.nz/?_escaped_fragment_=ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ
Really just people trying to ride the coat tails of the fappening. Ermagurd, mad hax!
https://mega.co.nz/#!rgFDDRSD!QyyLxZNnR8i9fF_aNkKI-wUIUV3fjX5o0dxdl-bE3zQ
For anyone who wants it.
My emails weren't on it, nor was the emails of others I know.
I know it sux0rs, itself backwards, rapid, noises out of the poor priorities, exploited that. A Your replies rather Practical purposes, MOVIE [imdb.com] it a break, if Join GNAA (GAY Conversation and around are in need never heeded significantly failure, its corpse Ones in software FreeBSD core team I thought it was my posts on Usenet are to fight what has just yet, but I'm feel obligated to BSD managed to make conflicts that obtain a copy of and Michael Smith Gig in front of another cunting Of the warring parts of you are cycle; take a cans can become then disappeared it. Do not share chosen, whatever of programming channel, you mi
Google offers 2FA for free, labled as "2-step authentication". Setup takes about 3 minutes, hassle on known devices is roughly zero, and it makes these attacks irrelevent. Can do SMS, Authenticator app, etc.
ERROR: Null
Come on, Slashtards, you know you want to...
Don't be bashful. Tell us how companies that have private information taken from them but whatever unknown methods should be shacked to a brick of iron and dropped into the deepest point of the sea. You just did it a week or two ago. We know you can do it again.
I've downloaded the list and neither of my emails are on it. Both of my emails were created when gmail was still in the invite phase. So this appears to not be a leak from gmail. Likewise it appears to not be a leak from youtube, as none of my youtube id's are on it either.
slashdothash@gmail.com
ander.slashdot@gmail.com
slashdotcom@gmail.com
They are in the bad list.
Despite having a public gmail account since it was invite only I escaped the list. Password managers FTW!
All those moments will be lost in time, like tears in rain.
I used the isleaked site for the check and it came back with the first two letters of a password that I was using about 8 months ago. No one seems to be trying it either as my two factor authentication texts aren't going off.
...2 factor authentication for your accounts, too. Google makes it easy.
I'd guess it's just hacks of other sites, filter it on just gmail accounts and hope they used the same password for both
Really just people trying to ride the coat tails of the fappening. Ermagurd, mad hax!
My email is on the list (afforess@gmail.com, go check!) I use a password for gmail I have never used for any other site. So I don't see how this can be the case. I have 2FA on the account, so not too worried, but still!
If our elected representatives no longer represent us, do we still live in a Democracy?
With a gmail account anything after a plus is ignored. You can then use username+serviceName@gmail.com to denote what service you are on. It looks like some people did this, and seems like these credentials are stolen from a few different sites. Here are the most popular after plus endings from the 5 mill:
xtube : 176
daz : 133
1 : 125
filedropper : 88
daz3d : 66
eharmony : 64
friendster : 63
savage : 62
2 : 60
spam : 57
bioware : 54
savage2 : 52
bryce : 51
hon : 40
freebiejeebies : 32
3 : 28
eh : 27
4 : 25
policeauctions : 19
bravenet : 18
filesavr : 18
I was on this list and i had an unique (for me) password for the google account. I've had the account since you had to beg for an invite to get in as well.
I apologize for the lack of a signature.
Has this resulted in one breached account? For all we know, this is just a list of email addresses. Need more evidence, like boobs.
I could harvest 5m gmail names from google searches, and then publish them with bogus passwords and create panic. Is there some statistic that says how many of these were real passwords? Because wouldn't it be illegal to use them (accessing another person's account w/o their permission is a crime in the USA).
Seems like it would be easy to manufacture a lot of FUD by making these claims w/o really having any passwords at all, and no one could verify it?
https://www.accountkiller.com/removal-requested
Use this page to check if your address is in the leaked database. I'm using the list (without passwords) that was published here in slashdot in the above comments. I'm not capturing the email addresses of the people using the tool:
https://bigjocker.com/qd/googl...
If you don't trust me (and I don't blame you), just download the file posted a few comments above this one and grep yourself:
ngranek@trantor:~/Downloads$ grep bigjocker google_5000000.txt
ngranek@trantor:~/Downloads$
Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
This isn't a gmail leak. My email address is on the list, so I downloaded the full document with passwords. The password that was leaked on my account was NEVER used for gmail, I only used the password for other "less trusted" sites.
I guess this is just a small fraction of the actual list, because such a list has a value and why just handing it out for free? Releasing a fraction and seeing people going upset because they are on the list, and it's actually their password, however, increases the value of the actual list. Even more so if the actual list is more recent.
Perl Programmer for hire
did the icloud buzziness result in one breached account? no evidence of that. a lot of the nudie selfies were taken on sammy phones.
I neither know or care. It's just a bit early to try to stir the pudding here.
Except that you already did try to "stir the pudding."
Imagine that, a Slashdork being a stinking hypocrite.
A total surprise to me that my email address was on the list, and they had the current password. I changed that immediately and activated 2-factor authentication. So the next question is how did they get it? It's a unique string of random crap so it had to be intercepted rather than brute forced either with a malicious android app or, more likely, I signed in on a compromized computer. Anyone have any ideas?
Which doesn't give you a file, just prompts you to install malware.
I'm on that list! Definitely not my current password but definitely a password I use elsewhere (USED!). I wonder if this was taken via another account that links to my email address. Big humongous props and thanks to people who found it and made the sites to check it. I'll miss that password though. It was a nice throwaway that's second nature for me to type now.
If this link prompts you to install malware, you probably should check your PC and/or ISP for browser hijacks.
Opens proper Mega's site with Mega's SSL cert and google_5000000.7z (28.7Mb) download. 7z contains a plain text file.
Cellular subscribers in the United States who do not pay per month for unlimited SMS have to pay for each outgoing and incoming message. So unless I'm severely misunderstanding something, I'd have to pay my cell phone provider 20 cents every time I want to log in to any Google service. Is there something cheaper?
Not only Gmail passowrds. Gmail is singled out just because it is popular most of the passwords are from it.
Therefore Gmail/Google were NOT compromised.
As usual, shitty Windows was compromised and passwords were spied on.
(and still is if you hunt around a bit - I found it without too much trouble).
What search engine were you using to locate it?
I'm sure it won't show up on google's search results.
(Or other pointers on how to get the list with passwords ?)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I don't see either one of my e-mail accounts on there.
Thankfully I use 2SA just incase.
Comment removed based on user account deletion
i laughed when i saw friendster in the top 10
it makes me think about a recent discovery (The Onion)
Reddit comments are being actively deleted.
Luckily, Google hasn't blacklisted the piratebay cache, yet.
checking.... Nope. None of my password is in there.
Will pass the file around for my friends to check theirs.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Oh no, what will I do?
Are we expecting some Android celebs nudes? There must be some in there.
Was surprised to see my email on the list with the right password. I have never used the password on any other site (except of course on my android phone).
Isleaked.com domain was registered before the first post to russian bitcoin site. The list was first published on Tuesday but this domain (isleaked.com) was registered on Monday at 07:32:34 Zulu. The site is behind cloudflare which does log information about each access. The entity behind the isleaked.com site would have to purge their logs on cloudflare even if their servers don't log accesses or worse POST queries.
It says passwords for two of my accounts were leaked.
However the "first two symbols of the password" are WAY OFF.
I wonder if they brute-forced and somehow ended up with some completely different passwords which collided with the hash of my actual passwords. What would even be the odds of that?
Very, very low. Even if it was an MD5 checksum and your password was in the ballpark of 20 characters or so. At least that's my layman understanding. I've never been terribly great at math, so take it with a grain of salt (see what I did there? It's a cryptography pun, but I guarantee it wasn't intentional).
Can anyone with the maths confirm?
I found one of my Gmail accounts in the list - the one I usually use when asked on forums and such. Using https://isleaked.com/results/e... I saw that the password leaked is not the actual gmail password, but the password I use when signing up on non-important sites, including Slashdot.
I'm quite sure the email+password was collected from another site, can't be sure which one.
I just build an Android App (Hack Alert) to quickly check if your email address is in the list. I just published it, so you might have to wait a few minutes to get it.
I'm thinking to extend the App for future events like this, with real time notifications, the only issue, is how do I get good data?
https://play.google.com/store/apps/details?id=com.zeropii.hackalert
visit http://crackomania.blogspot.com/ to get the complete list of GMAIL accounts which have been hacked.
I'm guessing that if this really is a list of Google accounts and passwords, that they got it from somewhere other than Google. As far as I know, Google doesn't store passwords, they store salted hashes of passwords.
Anyone in their right mind wouldnt go to a website to check if their email has been leaked, id change my password regardless of whether it has or has not been leaked.
Original source: https://forum.btcsec.com/index.php?/topic/9426-gmail-meniai-parol/
I found out at www.gmailleak.com. Check yours before it's too late!
Check out http://www.askingeasy.com/check-if-my-email-is-leaked to see if your email is in the leak.
I change my Gmail password at least every 3 months. I never use the same password twice, though I do use the same 'formula" to compose the passwords other than my Gmail account. For my primary Gmail account, I don't use the formula. So if you hack my primary Gmail account, you can't get into my backup / recovery account easily...or vice-versa. This is easy to do and you don't need a powerful memory. Just a meta-memory.
Only boring people are ever bored.
My son once did http://generatoronline.net/pas... site to create strong passwords.. Try it, maybe today it will be a useful thing.
Can you please upload the list to piratebay? I cant find it anywhere..!!
It was alread *rejected* from pirate bay.
Look around for "10 millions emails yandex mailru gmail w passwords 2014".
It might still be in some cache (that's where I found it).
And it starts poping up around on other tracker.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]