Slashdot Mirror
Database Leak Exposes 3.3 Million Hello Kitty Fans (csoonline.com)
itwbennett writes: "A database for sanriotown.com, the official online community for Hello Kitty and other Sanrio characters, has been discovered online by researcher Chris Vickery," writes CSO's Steve Ragan, who was contacted about the leak Saturday evening. The database houses 3.3 million accounts containing records including first and last names, email addresses, unsalted SHA-1 password hashes, password hint questions and their corresponding answers, along with other information. The database also has ties to a number of other Hello Kitty portals.
=(^.^)= Kawaiiiii!
What website is there with security that can't be penetrated?
Don't consider things online to be safe.
"First they came for the slanderers and i said nothing."
Can Has Hashtags.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
This is the first leak I have seen where the password hint questions are leaked too. Will be interesting to see how users in the real world link passwords and password hints, and if algorithms can be developed to uncover 99% of all passwords/answers from password hints -- I presume many password hints contain the answer or substantial parts of it (e.g. "pass + 123" = "pass123").
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
"...unsalted SHA-1 password hashes..."
Well, of course they're unsalted. Sodium is bad for Kitty.
"...password hint questions and their corresponding answers..."
Oh holy shit on a popsicle stick, I wonder how many of them aren't about cats...
Another reason not to buy the Hello Kitty microwave oven at Fry's Electronics.
... that their secret may now come out. Oh, well, it could be worse - it could've been a My Little Ponies site.
#DeleteChrome
This is what happens when you let big government control your data.
Step 1. Lay off the sysadmin, the DBA, the network admin, and the developer
Step 2. Hire a "full stack developer" and pay him one below-market salary to do 4 peoples' jobs at once
Step 3. ???
Step 4: PROFIT!!!
Goodbye Kitty
Table-ized A.I.
Everything happens to me.
You are welcome on my lawn.
Quick Lil'Joe...to the Pentagon!
Maybe you lucked out from the Ashley Madison fiasco, but if your name is on this list, exposure may cost you more than you know.
Why do people sign up for every website they come across?
This is a website about some japanese cat for crying out loud.
Why do people sign up for something like this? I guess it's the same people who sign up for safeway cards, starbucks cards and other discount cards.
I just don't get it.
You go into the store, you buy the shit you want and you leave. Just leave it at that for crying out loud. What's wrong with these people?
Bad Badtz Maru...
It would probably be more damaging to one's career - certainly as a hard talking politician - to be found on the Hello Kitty fan club's name list, than any revelations about drug taking, sexual deviancy or Communist sympathies. Ant chance that there were names of top terrorists among them?
I always found this "password hint" thing a huge security hole, sacrificing the bit of security there is in a user-chosen password for the benefit of the "service" provider.
For me, the simple password is (for unimportant things) always the result of "pwgen -n 8". My favorite's pet name is the result of "pwgen -n 16", which I write down if my account is in some way important to me (highly unlikely for one having a password hint) -- or which I forget right away.
Lost the password? lost the account. Helps me keeping independent.
When the mod system came in and AC comments were modded down it was time to sign up. Then when I forgot the password and had the account linked to a previous work address I signed up again. What's your excuse :)
The thing that will suck the most here is a pile of those users will have the same passwords out there on something else.
Script kiddies with Hello Kitty Rainbow Tables - if someone had taken that to an SF editor a while ago it would have been thrown out as too silly and too far fetched - but now it's probably real!
Obviously, there was a bug in the website's security!
Come come chitin chitin, you're so pretty pretty iridescent, don't leave stay around me! Say hello to Chitin!
now the poor cat has to go back to her day job.
Table-ized A.I.
I am so curious to learn who is behind the user name "Anonymous Coward". He is such a prolific, sleepless contributor...
3.3 milliions 10 year old girls? Since they hardly have any credit cards it's just useful for sexual predators.
I think it's highly relevant that the site that was compromised was written in PHP.
Not necessarily because there's the possibility that a PHP language or PHP community induced flaw lead to the compromise, because it could have been an inside job...
But because PHP, even though it's mainly used for things like CMSs, blogs, ecommerce, and such that have user logins, lacks a standard language-native built-in login system. Yes, there are libraries you can use, but a) these don't ship with it by default, b) the documentation doesn't tell you to use it and c) the majority of them contain severe security issues.
I THINK, THEREFORE I'M CUTE
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
can you imagine the kind of money you can raise tapping a market that 1 Cute 2 has poor impulse control 3 tends to have access to large sums of money? (oh thats right you can just look at the Sanrio tax filings [just remember to account for all the divs])
I just can't wrap my head around the fact that there are 3.3 million "hello kitty" fans. They have to have Ashley-Madison style fake accounts on there.
I am Anonymous Coward.
No, I am Anonymous Coward.
We're all individuals.
(Ha!, the captcha is 'nickname'. Must be the new Irony generator at /.)
...there is only war.
It's difficult to convince many managers that prevention is worth it. They are probably lied to by vendors and past staff enough such that they only pay for clear-cut and immediate needs rather than hard-to-verify prevention.
A lot of vendors and spinner employees claim crap like, "Oh, you need to purchase/build/install a Flux capacitor to prevent the thibble-bop from overloading and crashing the dookitron." After being burned a couple of times, they don't pay even for legitimate prevention because they cannot tell the difference, and so skip ALL prevention.
It's a problem that plagues many forms of technology and infrastructure, such as building construction, plumbing, car repair, etc. The end user cannot easily verify prevention claims.
Yes, one can google around for advice, but it could take several hours to absorb it, and still require specialized experience to evaluate. Time is money for businesses.
If it's the main line of business (primary source of profit), then managers usually know what to look for. However, if it merely supports the main line of biz, such as retail and character licensing in this case, then they are typically unfamiliar with it and skeptical.
Table-ized A.I.
We're all individuals.
I'm not.
Spartacus can kick your anonymous ass
Table-ized A.I.
Just imagine, all the possibilities, with this information.
For fucks sakes how did this submission get accepted?
- Dan
... than being on the Ashley Madison list. The Hax0rs have gone too far this time!