Slashdot Mirror
Spotify Denies User Details Hacked After Passwords Show Up Online (mashable.com)
Not long ago a list of hundreds of Spotify subscribers was dumped on Pastebin. The list included email addresses, usernames, passwords, account type, and plenty of other details. Also, TechCrunch independently confirmed that some of the credentials listed were indeed legit. The music streaming service is now assuring users that there was no "large-scale" hack. Samantha Murphy Kelly, reporting for Mashable:It appears that some accounts were compromised in the past few days. According to the report, some Spotify users discovered their passwords and email addresses attached to accounts were recently changed without authorization. Others spotted new songs saved to playlists they didn't manually add. Despite users reporting shady activity, Spotify told Mashable it denies it is a part of a large-scale hack. "Spotify has not been hacked and our user records are secure. We monitor Pastebin and other sites regularly. When we find Spotify credentials, we first verify that they are authentic, and if they are, we immediately notify affected users to change their passwords."
so people can know if their credentials are out there.
the ne'er do wells are going to find it anyway ffs.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
When we find Spotify credentials, we first verify that they are authentic, and if they are, we immediately notify affected users to change their passwords
This assumes that the cracker has not changed the contact info for the affected account.
---
[cracker]: I've cracked Joe Blow. Change contact to haxx0r@evil.com
[Spotify]: To: haxx0r@evil.com. Dear Joe Blow, please change your password.
[cracker]: Mwa-ha-ha!!!
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Based on the redacted pastebin data, its not clear to me what the source is. This looks like output of a script.
What if the scenario really is, account information stolen from other sites is being tried against spotify accounts with the same email address, and scraping account information when it hits? That looks easily as likely to me.
If that is whats going on, then spotify is right, they are not being hacked at all, their users are being comproimised based on data taken from somewhere else.
"I opened my eyes, and everything went dark again"
You have to admire the fucking singularity-like balls it would take to make a claim like that with a straight face. I suppose they have a separate employee checking every subreddit, every Slashdot post and every other corner of the Internet for evidence of their shoddy security?
There is no reason an article about less than 250 obviously phished accounts should be on the front page of slashdot.
https://www.youtube.com/watch?...
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Also, for anyone not making the connection:
> The unknown party reset their email address, deleted a playlist, saved music to their device, and started following a new playlist.
Key.... started following a new playlist. So they are listening to it. Good.
Does anyone else not see how this situation is what the Hampster Dance was made for.
"I opened my eyes, and everything went dark again"
Because computers can't be used to automate repetitive tasks.
Either they were hacked, or this is just another instance of password re-use similar to the supposed gmail hack a couple years ago that was nothing more than a combination of other compromised password lists grep'd to only show gmail addresses for sensationalism. The passwords that worked were only because of password re-use.
Surely there are some spoofed emails with fake login pages floating around. You could phish usernames and passwords without having to actually hack the official site or service. I'm with Spotify on this one. Leaked usernames/passwords does not necessarily mean the service was hacked.
Depending on the breach or hack, a hit and run they got passwords. If they set themselves on the server for a period of time (by Spotify's very nature) it could cause unforeseeable damage to the users.
From the ToS
7 Rights you grant us
"In consideration for the rights granted to you under the Agreements, you grant us the right (1) to allow the Spotify Service to use the processor, bandwidth, and storage hardware on your Device in order to facilitate the operation of the Service"
https://www.spotify.com/us/leg...
As open as they were about this breach, they may never take or mention any steps taken to protect it's users.
Based upon the pastebin data, I doubt that any sort of breach has happened to spotify unless the leaker specifically chose the people with the least complex passwords to reveal.
Look at the data. only 1 user with a 13 character password. Something along the lines of . Most are under 10 characters long. Only 3 passwords used a hyphen in them. The REST all only used alphabet and numbers 0-9. This sounds like bruteforce or dictionary attacking of spotify, as others have said, probably with a cross list from another actual breach.
To log in to all these accounts and replace all the songs on all their play lists with Rick Astley?
Apparently not, seeing as how they admitted themselves they have someone checking the site manually.
What point were you trying to make, exactly? Besides pointing out that you're a pedantic little wank-stain who should have stayed in his daddy's sock drawer?
On the bright side, we now have free access to many more good playlists...
I was hacked, and I found out when Spotify told me my music was playing in "Luke's Van". These guys had been listening to gangsta rap by the truckload. The worst thing is that my Discover Weekly recommendations are all screwed; this was the single feature I liked the most about my account - good music recommendations. An email to and response from Spotify customer support says that there's nothing they can do about resetting my tastes. Thanks Spotify - I now hope google or Amazon comes and eats your cake
Artificial intelligence is no match for natural stupidity
FTA:
"Spotify has not been hacked and our user records are secure. We monitor Pastebin and other sites regularly. When we find Spotify credentials, we first verify that they are authentic, and if they are, we immediately notify affected users to change their passwords."
Soo, if the site has not been hacked and user accounts are secure, then how are the credentials getting onto pastebin? Is Spotify giving them away voluntarily?
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
We monitor Pastebin and other sites regularly.
Really?
Oh ya, we have a whole fleet of guys just sitting there hitting F5 all day and night.
This lady must think were pretty stupid.
If it ain't broke, don't fix it.
I was on that list. They did NOT notify me, in fact they told me they wanted my account details AFTER they shut me out of my account. They refused to call me. They refused to discuss the hack. If they do monitor Pastebin, they do zero when there is a breach. As of noon today, my login information was still available on Pastebin. Not only is their security horrible, but they LIED about their response to affected customers. I canceled my account, and if you value your identity, you will too.
Here are some of my favorites this far:
asdasd
orgasm1
3634
notmuch
imac12
more10
please123
welcome1
Even if these fabulous passwords were hashed, it must have taken negative five seconds to brute 'em...
The response that they check pastebin regularly indicates a poor level of security. Doesn't that compare to using Kijiji to see if you've been robbed recently?
Oh, and the password complexity... As someone who works in IT and has seen the passwords real people use, the ones I saw in the pastebin are about right for the length, complexity, etc. These are just people listening to music, not IT workers or similar with better practices.