Slashdot Mirror
You Can Now Browse Through 427 Millon Stolen MySpace Passwords (mashable.com)
Stan Schroeder, writing for Mashable:An anonymous hacker managed to obtain an enormous number of user credentials in June 2013 from fallen social networking giant MySpace -- some 427 million passwords, belonging to approx. 360 million users. In May 2016, a person started selling that database of passwords on the dark web. Now, the entire database is available online for free. Thomas White, security researcher also known by the moniker "Cthulhu," put the database up for download as a torrent file on his website, here. "The following contains the alleged data breach from Myspace dating back a few years. As always, I do not provide any guarantees with the file and I leave it down to you to use responsibly and for a productive purpose," he wrote. The file is 14.2 GB in size; downloading it might take some time. It is password-protected, but White made the password available on Twitter and his site.
More like a criminal. Why are you people okay with this behavior?
going through MySpace's password recovery feature. Now, maybe I will be able to update my MySpace page for the first time in ten years!
BeauHD is the editor who does that crap. This story was posted by manishs, so it doesn't have unrelated news. I'd be happy if Slashdot replaced BeauHD by bringing Timothy back.
Information wants to be free.
This is why most people simply can't keep their mouths shut.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
They're not stolen. The original users of those passwords still have them. ;)
GeekNights!
Late Night Radio for Geeks!
I forgot my password anyway
sometimes, nothing.
What the heck is MySpace?
One productive use I see is to run this password database against the company logins to check if one is in this list to ask the user to change it. Because sooner or later, and most probably sooner, a hacker will do the same...
WTF?
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Wow, it's been so long since I've seen a site get slashdotted that I almost forgot about the term!
The site:
https://haveibeenpwned.com/
tells me that my MySpace account has been pawned, but I don't remember creating a MySpace account.
What? No "in unrelated news" link at the bottom of the story? What if I can't remember how to scroll down? I'll never hear about "Why Twitter Can't Even Protect Tech CEOs From Getting Hacked".
At least it's not "One weird trick to read 427 million passwords!"...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
I'd be careful with doing this. It can create a legal liability, if InfoSec runs a password cracking tool against current hashes and succeeds in getting plain text passwords at that point the individual accountability becomes questionable. You can enforce procedures to keep InfoSec legally accountable, but a savvy lawyer will create doubt. The better answer is to run a password cracking tool against hashes that are older, 6 months to a year depending on your password change requirements. Then target any users whose password is cracked with training on password security. With your legal team's approval and help, you can inform the user that they are getting the remedial training because an old password was cracked.
-- Slashdot, making the Left look conservative since 1997.
The site is slashdotted. Would like to snag this.
Silence is a state of mime.
Most companies for you to change passwords at least every 90 days so the myspace password would be obsolete by now. They also don't usually register your corporate account with your home email.
Any company that is not forcing password changes and use their users home email as a login name are probably not going to run the test you suggested.
http://wayback.archive.org/web/*/https://myspace.thecthulhu.com/ (The original was slow for me, but did eventually load.)
There's a Magnet link on the page, but the Torrent file itself didn't get archived. I put a copy at http://www.invisibill.net/Myspace.com.rar.torrent.
I opened up my trusty torrent client, Vuze, to download this and it asked to install an update. I let it, and then bad craziness broke out. I visibly opened all my browsers up, opened up their preference settings, downloaded an installed extensions, and set their default pages and search engine to Yahoo.
Vuze is now malware. beware.
Some drink at the fountain of knowledge. Others just gargle.
If you go to the Vuze support forum theres multiple posts yelling about vuze as mal ware. In the fearliest one the moderator denies this. Then in the others the moderator has posted how to change your settings back to another search engine. They fail to mention the extensions (like quickview) that Vuze installs in all of your browsers.
the company can no longer be trusted.
It was a vast archive of horrendous web page design.
So far as I can tell, this dump contains only the SHA-1 hashes of passwords and no one has figured out how to invert SHA-1.
The SHA-1 hashes of common, already-known passwords are available, so it's possible to invert hashes for these passwords. But, claiming that you can recover any of the passwords is wholly different from being able to confirm that a few well-known passwords were used by a segment of the population. Case in point: Of the ~420 million passwords in the leak, only about 7 million are in the top 55 board on leakedsource.com/blog/myspace, i.e., 1.6%.
It would appear that, if anything, this is really a list of email addresses from circa 2013. It could also be interesting to look at the distribution of passwords by looking at frequencies of specific hashes.
Same thing happened to me. It appears Vuze installs the Spigot adware infection into your computer.
For Chrome there's some hope of disinfecting your computer. Don't know how to fix safari or Firefox.
navigate to /Users/YOUR_COMPUTER_USERNAME/Library/Application Support/Google/Chrome
YOUR_COMPUTER_USERNAME must of course be replaced with your computer username
grep -rnw '.' -e 'spigot' and grep -rnw '.' -e 'api.mybrowserbar'
get in there and remove that shit.
In the most annoying case, their genius software made itself the default restart page for whenever chrome unexpectedly crashes. This little tidbit is located deep inside a sort of huge JSON blob at ./Default/Preferences, inside Chrome directory