Slashdot Mirror
Collection 1 Data Breach Exposes More Than 772 Million Email Addresses (zdnet.com)
A collection of almost 773 million unique email addresses and just under 22 million unique passwords were exposed on cloud service MEGA. Security researcher Troy Hunt said the collection of data, dubbed Collection #1, totaled over 12,000 separate files and more than 87GB of data. ZDNet reports: "What I can say is that my own personal data is in there and it's accurate; right email address and a password I used many years ago," Hunt wrote. "In short, if you're in this breach, one or more passwords you've previously used are floating around for others to see." Some passwords, including his own, have been "dehashed", that is converted back to plain text. Hunt said he gained the information after multiple people reached out to him with concerns over the data on MEGA, with the Collection #1 dump also being discussed on a hacking forum. "The post on the forum referenced 'a collection of 2000+ dehashed databases and Combos stored by topic' and provided a directory listing of 2,890 of the files," Hunt wrote.
The collection has since been removed. You can visit Hunt's Have I Been Pwned service to see if you are affected by this breach.
/sarcasm Like I'm going to fall for "Have I Been Pwned" -- that's just a honeypot ! =P
I love their API. You can do a search without submitting any sensitive information. Not even a full sha1sum. You send a partial sha1sum, and they send back possible matches. Locally, you see if any are exact matches.
Here is a bash/zsh function which looks up a password (obviously without printing it to console or sending it anywhere):
function haveibeenpwned() {
echo "Enter password to check:"
stty -echo
read line
stty echo
echo
local sha1="$(echo -n "$line" | sha1sum - | cut -f1 -d' ')"
echo sha1 is "$sha1"
local prefix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\1/')"
local suffix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\2/')"
echo "Searching for prefix: $prefix and suffix: $suffix"
echo
curl "https://api.pwnedpasswords.com/range/$prefix" 2>/dev/null | grep -i "$suffix"
}
A cat can't teach a dog to bark.
Starting a couple of months ago, I've received a huge number of extortion emails. At this point it's extortion spam.
All the emails follow the same pattern, and all including somewhere (usually in the To: line, for some reason) an old "burner" password I used on web sites where I don't care if the password leaks.
Here's a rough paraphrase:
I have received dozens of copies of this email, with the text slightly different. Some of them end with "Don't hate me, everyone needs to do their own job." Some of them call the mysterious malware "RAT software". A couple of times the email was translated into Japanese. (I can read just a little bit of Japanese and was able to recognize it, and I showed it to a fluent friend who confirmed that it fit the above pattern.)
<sarcasm>I must say, my computer is running pretty well considering how many elite international hackers have been messing with it and installing RAT software and such.</sarcasm>
As it happens, I got one copy of the email at least a week before the deluge started. I realized it would have been very scary for someone who uses the same password everywhere and doesn't know how easy it is to forge the "From:" header. Doubly scary if that person actually visits porn sites.
lf(1): it's like ls(1) but sorts filenames by extension, tersely
Exactly my reaction. The "checking" system should NOT ask for your email address. For example, it could ask for substrings, perhaps four letters at a time, and tell you how many possibilities there are. If there are too many to scan to see if you've been included, then you could enter another four characters and refine the search. At no point should you need to give away the email address you're trying to check.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
local prefix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\1/')"
local suffix="$(echo "$sha1" | sed 's/\(.....\)\(.*\)/\2/')"
For recent Bash versions that have built-in RegEx :
[[ "${sha1}" =~ ^(.....)(.*)$ ]]
local prefix="${BASH_REMATCH[1]}"
local suffix="${BASH_REMATCH[2]}"
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Just stop sharing your damn creds. If you can't do that, then stop sharing THE damn creds.
"Jail the execs!"
"Hold them accountable!"
"Fine them!"
"We need new laws!"
None of that shit is going to happen. If you keep making accounts for every little thing, pretty soon I'm gonna need to create a throwaway account to pump fkg gas. Just stop.
Checkout as guest. No thanks. I do NOT agree.
Do you really NEED an account for everydumbthing.com?
Creds have value, otherwise, you would not be asked to give them away every other keystroke. Treat them as such.
Sometimes, the only way to win is not to play.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
I already do all that. But none of that addresses the issue that most of these breaches are not due to some exotic zero-day exploit but from company after company not bothering to properly secure their data storage against the simplest of hacks and phishing attempts. Phish the right secretary who shouldn't have the access to those accounts and yet somehow she does and we have a breach.
Yes there will always be some vulnerabilities. But how often do you hear of Banks having their financial systems hacked? Not very often. And it's because they are liable for the money they are entrusted with. Security is possible, and not that difficult. But too many companies that are so eager to hoover in and aggregate all our data barely bother with security.
It's time to make allowing these breaches criminal. In court if they can prove it was a true zero-day exploit then they can be excused. But if it's determined to be a common and easily blocked attack then they deserve the liability, and any fines that come with it.
I'm too lazy to compose a creative sig.