Slashdot Mirror
Over 28 Million Records Stolen In Breach of Latin American Social Network Taringa (thehackernews.com)
Taringa, also known as "The Latin American Reddit," has been compromised in a massive data breach that has resulted in the leaked login credentials of almost all of its over 28 million users. The Hackers News reports: The Hacker News has been informed by LeakBase, a breach notification service, who has obtained a copy of the hacked database containing details on 28,722,877 accounts, which includes usernames, email addresses and hashed passwords for Taringa users. The hashed passwords use an ageing algorithm called MD5 -- which has been considered outdated even before 2012 -- that can easily be cracked, making Taringa users open to hackers. Wanna know how weak is MD5? LeakBase team has already cracked 93.79 percent (nearly 27 Million) of hashed passwords successfully within just a few days. The data breach reportedly occurred last month, and the company then alerted its users via a blog post: "It is likely that the attackers have made the database containing nicks, email addresses and encrypted passwords. No phone numbers and access credentials from other social networks have been compromised as well as addresses of bitcoin wallets from the Taringa program! Creators." the post (translated) says. "At the moment there is no concrete evidence that the attackers continue to have access to the Taringa code! and our team continues to monitor unusual movements in our infrastructure."
as in: we don't know.
Were they all 'Los Lobos' and 'Selena'?
Or were other records stolen?
is this in central america? one of those banana republicans?
Does this mean they weren't using a salt value?
Even with md5, I can't imagine that it would be that easy to crack when salting with a different salt for each password as best practices states but I have never looked into it closely so I am wondering...
Everything I write is lies, read between the lines.
Thought they were all undocumented.
I read the title and thought "Geez, how many trucks did they have to bring."
Hmmm...
So I get that this is in Hacker News, and the real true purpose of this article is to prompt the hoardes of privileged fake nerds to engage in spreading the dogma of password hashing by stimulating their need to feel superior to other privileged fake nerds. But can someone, preferably with actual security credentials, explain how passwords are somehow more sensitive than anything else in a database? I mean other than the fact that the lusers are probably not following their own best practices and are reusing their password elsewhere, other than that, the security, as far as I can tell, is just as important for everything else. If they gained access via a copy of a backup, well then they have purchase history, private messages, and whatever else information you are storing in that database. IOW the information that you are securing with the password is also in the database. Additionally, if they ever were to gain write access, i.e. by compromising the DB password, then they could do things like granting themselves 'administrator' privileges, making purchases, or whatever is within the application the DB is for.
So, other than the dogma and the brainwashing, why is there always such a big deal made about passwords?
MD5 is broken as hash function in the sense that it is easily possible to find two messages having the same hash (takes few seconds on a laptop). This doesn't have to do anything with someone being able to crack most passwords within few days. Also with the unbroken SHA3 they would have done this, as this is done by simply checking for a big list of possible passwords one by one if the hash belongs to the password of one of the users. You can do this attack, because cryptographic hashes have to be efficient for their intended purpose, but are unfortunately abused by security-unaware programmers, who did not even read the section "Password verification" on the wikipedia page for cryptographic hash functions.