Slashdot Mirror
You Can Now Browse Through 427 Millon Stolen MySpace Passwords (mashable.com)
Stan Schroeder, writing for Mashable:An anonymous hacker managed to obtain an enormous number of user credentials in June 2013 from fallen social networking giant MySpace -- some 427 million passwords, belonging to approx. 360 million users. In May 2016, a person started selling that database of passwords on the dark web. Now, the entire database is available online for free. Thomas White, security researcher also known by the moniker "Cthulhu," put the database up for download as a torrent file on his website, here. "The following contains the alleged data breach from Myspace dating back a few years. As always, I do not provide any guarantees with the file and I leave it down to you to use responsibly and for a productive purpose," he wrote. The file is 14.2 GB in size; downloading it might take some time. It is password-protected, but White made the password available on Twitter and his site.
More like a criminal. Why are you people okay with this behavior?
going through MySpace's password recovery feature. Now, maybe I will be able to update my MySpace page for the first time in ten years!
What? No "in unrelated news" link at the bottom of the story? What if I can't remember how to scroll down? I'll never hear about "Why Twitter Can't Even Protect Tech CEOs From Getting Hacked".
Tuning John the ripper to crack passwords more effectively? Or just wasting some computer cycles watching it crack them.
What is MySpace?
When sites post about these things, they are basically advertising the location of stolen goods. eh?
So many passwords in the file are the exact combination to my luggage!
I forgot my password anyway
sometimes, nothing.
What the heck is MySpace?
WTF?
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Anyone have the torrent link and password for the archive?
Wow, it's been so long since I've seen a site get slashdotted that I almost forgot about the term!
The site:
https://haveibeenpwned.com/
tells me that my MySpace account has been pawned, but I don't remember creating a MySpace account.
I have a hard time remembering passwords. I'll just go through the list until I get one that works.
I mean, he's in possession of stolen property, so I presume yes.
captcha: entangle
The site is slashdotted. Would like to snag this.
Silence is a state of mime.
Enjoy the obsolete password suckers!
http://wayback.archive.org/web/*/https://myspace.thecthulhu.com/ (The original was slow for me, but did eventually load.)
There's a Magnet link on the page, but the Torrent file itself didn't get archived. I put a copy at http://www.invisibill.net/Myspace.com.rar.torrent.
I opened up my trusty torrent client, Vuze, to download this and it asked to install an update. I let it, and then bad craziness broke out. I visibly opened all my browsers up, opened up their preference settings, downloaded an installed extensions, and set their default pages and search engine to Yahoo.
Vuze is now malware. beware.
Some drink at the fountain of knowledge. Others just gargle.
If you go to the Vuze support forum theres multiple posts yelling about vuze as mal ware. In the fearliest one the moderator denies this. Then in the others the moderator has posted how to change your settings back to another search engine. They fail to mention the extensions (like quickview) that Vuze installs in all of your browsers.
the company can no longer be trusted.
So far as I can tell, this dump contains only the SHA-1 hashes of passwords and no one has figured out how to invert SHA-1.
The SHA-1 hashes of common, already-known passwords are available, so it's possible to invert hashes for these passwords. But, claiming that you can recover any of the passwords is wholly different from being able to confirm that a few well-known passwords were used by a segment of the population. Case in point: Of the ~420 million passwords in the leak, only about 7 million are in the top 55 board on leakedsource.com/blog/myspace, i.e., 1.6%.
It would appear that, if anything, this is really a list of email addresses from circa 2013. It could also be interesting to look at the distribution of passwords by looking at frequencies of specific hashes.
Same thing happened to me. It appears Vuze installs the Spigot adware infection into your computer.
For Chrome there's some hope of disinfecting your computer. Don't know how to fix safari or Firefox.
navigate to /Users/YOUR_COMPUTER_USERNAME/Library/Application Support/Google/Chrome
YOUR_COMPUTER_USERNAME must of course be replaced with your computer username
grep -rnw '.' -e 'spigot' and grep -rnw '.' -e 'api.mybrowserbar'
get in there and remove that shit.
In the most annoying case, their genius software made itself the default restart page for whenever chrome unexpectedly crashes. This little tidbit is located deep inside a sort of huge JSON blob at ./Default/Preferences, inside Chrome directory
Here's a spigot representative stating that VUZE does install Sigot malware by default, apologizing for the inconvenience, then offering no way to remove it. He says the opt-out is hidden from site under the "custom" install tickbox of the Vuze install.
http://forum.vuze.com/Thread-m...
Spigot malware contains features that actively resist de-installation. It hits every browser on your computer.
I've been looking at it myself and it appears to be a mixture of hashes and plain text... 15GB is a bitch to grep through so i'm trying to find what data they have on me, but it seems the majority of the accounts are hashes, a minority have plain text passwords, and for some reason, for many accounts, the password field is set to the same as the database entry ID.
I could be interpreting this incorrectly, but it's interesting all the same.