Slashdot Mirror
Collection 1 Data Breach Exposes More Than 772 Million Email Addresses (zdnet.com)
A collection of almost 773 million unique email addresses and just under 22 million unique passwords were exposed on cloud service MEGA. Security researcher Troy Hunt said the collection of data, dubbed Collection #1, totaled over 12,000 separate files and more than 87GB of data. ZDNet reports: "What I can say is that my own personal data is in there and it's accurate; right email address and a password I used many years ago," Hunt wrote. "In short, if you're in this breach, one or more passwords you've previously used are floating around for others to see." Some passwords, including his own, have been "dehashed", that is converted back to plain text. Hunt said he gained the information after multiple people reached out to him with concerns over the data on MEGA, with the Collection #1 dump also being discussed on a hacking forum. "The post on the forum referenced 'a collection of 2000+ dehashed databases and Combos stored by topic' and provided a directory listing of 2,890 of the files," Hunt wrote.
The collection has since been removed. You can visit Hunt's Have I Been Pwned service to see if you are affected by this breach.
/sarcasm Like I'm going to fall for "Have I Been Pwned" -- that's just a honeypot ! =P
What was the source of the breach though
everything in the cloud "cloud service MEGA" in this case, that you did not personally securely encrypt before hand. Is just your raw data in someone else's hands. And the security of that information is just based on your trust of them.
;)
Now if your good with that OK, Great, you are aware of the risks and have made a judgement on them.
But if not you need to rethink using the cloud for that use in the first place.
Just my 2 cents
Oh no, the linked website says my email address billg(at)microsft.com has been pwned on 46 sites.
I love their API. You can do a search without submitting any sensitive information. Not even a full sha1sum. You send a partial sha1sum, and they send back possible matches. Locally, you see if any are exact matches.
Here is a bash/zsh function which looks up a password (obviously without printing it to console or sending it anywhere):
function haveibeenpwned() {
echo "Enter password to check:"
stty -echo
read line
stty echo
echo
local sha1="$(echo -n "$line" | sha1sum - | cut -f1 -d' ')"
echo sha1 is "$sha1"
local prefix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\1/')"
local suffix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\2/')"
echo "Searching for prefix: $prefix and suffix: $suffix"
echo
curl "https://api.pwnedpasswords.com/range/$prefix" 2>/dev/null | grep -i "$suffix"
}
A cat can't teach a dog to bark.
Starting a couple of months ago, I've received a huge number of extortion emails. At this point it's extortion spam.
All the emails follow the same pattern, and all including somewhere (usually in the To: line, for some reason) an old "burner" password I used on web sites where I don't care if the password leaks.
Here's a rough paraphrase:
I have received dozens of copies of this email, with the text slightly different. Some of them end with "Don't hate me, everyone needs to do their own job." Some of them call the mysterious malware "RAT software". A couple of times the email was translated into Japanese. (I can read just a little bit of Japanese and was able to recognize it, and I showed it to a fluent friend who confirmed that it fit the above pattern.)
<sarcasm>I must say, my computer is running pretty well considering how many elite international hackers have been messing with it and installing RAT software and such.</sarcasm>
As it happens, I got one copy of the email at least a week before the deluge started. I realized it would have been very scary for someone who uses the same password everywhere and doesn't know how easy it is to forge the "From:" header. Doubly scary if that person actually visits porn sites.
lf(1): it's like ls(1) but sorts filenames by extension, tersely
The companies not securing this data properly must be held to account, and it _must_ hurt. Something like a general $500 compensation to anybody affected (without the need to prove any damage) would do the trick. Sending those responsible to prison for a year or so would do it as well.
As it is at the moment, they just continue their shoddy practices,because nothing happens to them and not securing this data properly is far, far cheaper.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This email was used on only one site, Slashdot.org
It is pwned.
Suggestion: Please change the password of the emails you use on /.
When are we going to get criminal liability for these companies that do not secure their data. Every week it's another breach, with another release of incredible numbers of peoples account or personal information. Enough is enough. Any company that does not secure it's user data should be criminally liable for this failure
That and maybe they shouldn't be keeping nearly as much data. But then they can't data-mine it and sell it.
I'm too lazy to compose a creative sig.
So I searched a couple of addresses and they are listed. Or, at least, the site tells me there are listed.
What would be good, now, is if I could actually view the information about myself. Email it me, maybe? Like, I just gave you my email address...
Just how old is the password? And for what site(s)? that information doesn't appear to be particularly forthcoming...
You're clearly a "modern Internet user" yourself – so, as my old mum used to say, "don't take names to yourself".
(Also, why the obsession with bundles of sticks?)
Exactly my reaction. The "checking" system should NOT ask for your email address. For example, it could ask for substrings, perhaps four letters at a time, and tell you how many possibilities there are. If there are too many to scan to see if you've been included, then you could enter another four characters and refine the search. At no point should you need to give away the email address you're trying to check.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
local prefix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\1/')"
local suffix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\2/')"
For recent Bash versions that have built-in RegEx :
[[ "${sha1}" =~ ^(.....)(.*)$ ]]
local prefix="${BASH_REMATCH[1]}"
local suffix="${BASH_REMATCH[2]}"
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Just stop sharing your damn creds. If you can't do that, then stop sharing THE damn creds.
"Jail the execs!"
"Hold them accountable!"
"Fine them!"
"We need new laws!"
None of that shit is going to happen. If you keep making accounts for every little thing, pretty soon I'm gonna need to create a throwaway account to pump fkg gas. Just stop.
Checkout as guest. No thanks. I do NOT agree.
Do you really NEED an account for everydumbthing.com?
Creds have value, otherwise, you would not be asked to give them away every other keystroke. Treat them as such.
Sometimes, the only way to win is not to play.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
I'm waiting for our self proclaimed security expert, Android Package, to weigh in on the use of hosts and how if only it had been used by those who were breached this could have all been avoided.
Ya know, Kimmie-boy Schmitz, lardball extraordinaire and mostly beloved for being something the copyright mafia can sink a lot of resources in so they can't prosecute someone innocent at least for the time being?
Well, he is German originally, and "cloud" is a homophone of the German "klaut", which means "he steals".
Draw your own conclusions.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Here are your meds. All is OK.
We still check in from time to time, though.
fB
For the past couple of months, I also received a lot of these variants.
All of them have a Bitcoin address that you should pay a ransom to.
All of them claim that they hacked my "internet" and viewed me on webcams (which I don't use).
All of them claim that they have compromising videos of me watching porn.
Most of them have my leaked email address in the From: header.
Many of them have a password that I used or part of it (and use that as proof they hacked "my account").
Many of them claim the hack is on my router and reference a CVE for Cisco (I don't own any Cisco equipment)
BBC reporters were targeted, and they did a piece on this scam. Worth watching ...
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
Scary, how many information were breach. My email was found in three instances of data breach. Reading though another forum, found that someone using the acronym datasiph0n is publishing the data breach databases online https://shoppy.gg/product/jWCDeeJ
This pigfucker is charging for the database. Fuck him sideways with a rusty spork.
CEE5210S The signal SIGHUP was received.