Geoff Posted June 6, 2012 Posted June 6, 2012 BBC News - LinkedIn passwords 'leaked by hackers' Social networking website LinkedIn is investigating claims that over six million of its users' passwords have been leaked onto the internet. Hackers posted a file containing encrypted passwords onto a Russian web forum. They have invited the hacking community to help with decryption. You might want to reset your LinkedIn password if you use this social network.
SYNACK Posted June 6, 2012 Posted June 6, 2012 Gasp, you mean my code of '1234' is no longer secure, nooooooo... Will I have to change the one on my luggage to?
glennda Posted June 6, 2012 Posted June 6, 2012 Yeah saw this earlier and has been changed! If anybody wants to add me i'm here (cheeky plug as i only signed up last week!)
6Foot2 Posted June 7, 2012 Posted June 7, 2012 (edited) Link 1: LinkedIn hacker 'also stole 1.5m passwords from dating site eHarmony' - Telegraph Link removed: Identified as a phishing site by another LEA. Edited June 7, 2012 by 6Foot2 Amend post content.
JJonas Posted June 7, 2012 Posted June 7, 2012 (edited) Link 2: Removed That one is listed by our LEA as a Phishing site Edited June 7, 2012 by JJonas 1
Geoff Posted June 7, 2012 Author Posted June 7, 2012 false positive, it's probably taking a dislike to the Javascript.
Arthur Posted June 7, 2012 Posted June 7, 2012 Link removed I was going to post that link too, but thought better of it since typing passwords into websites run by unknown third-parties is generally considered bad practice (even if in this case the hash is generated directly on your computer). On Mac OS X or Linux, you can actually run the command below to find the SHA-1 hash of your password. echo -n '[color="#FF0000"]Pa$$w0rd123[/color]' | openssl sha1
6Foot2 Posted June 7, 2012 Posted June 7, 2012 I was going to post that link too, but thought better of it since typing passwords into websites run by unknown third-parties is generally considered bad practice... Agreed. I was just suggesting it as a candidate to check if your old password had been hacked in this attack.
6Foot2 Posted June 7, 2012 Posted June 7, 2012 They just keep coming... EHarmony.com hacked. Link: eHarmony Users' Passwords Hacked - KWQC-TV6 News and Weather For The Quad Cities
Arthur Posted June 7, 2012 Posted June 7, 2012 From the article above... LinkedIn has already confirmed they are making the transition to adding what is known as "salt" to the hashes in the security community. ^ Shouldn't they have done this in the first place?
tom_newton Posted June 9, 2012 Posted June 9, 2012 I was going to post that link too, but thought better of it since typing passwords into websites run by unknown third-parties is generally considered bad practice (even if in this case the hash is generated directly on your computer). On Mac OS X or Linux, you can actually run the command below to find the SHA-1 hash of your password. echo -n '[color="#FF0000"]Pa$$w0rd123[/color]' | openssl sha1 tail ~/.bash_history not a great idea even if you don't plan to reuse the password Tip: put a space before the command to prevent it being saved is the history file.
tom_newton Posted June 9, 2012 Posted June 9, 2012 Also.. good article on salting as a kinda "follow up" to the BS flying around at EDIT LinkedIn Password Leak: Salt Their Hide - ACM Queue 1
RabbieBurns Posted June 9, 2012 Posted June 9, 2012 speaking of site hacks.. did we ever get a post about what happened to a certain IT Pro Life Line site?
SYNACK Posted June 9, 2012 Posted June 9, 2012 speaking of site hacks.. did we ever get a post about what happened to a certain IT Pro Life Line site? It was disussed in the ask the admins bit of the conf. Basicly there was a zeroday hole in the forum software that EG patched within hours but not before it was cracked by some Australian scriptkiddy who probably got the same email. He hung aroud for a bit before messing with the system. The possibility of a full breach was limited given the level of the exploitation and the limits on data transfer imposed by PHP timeouts on the server at the time meaning that it was unlikely they were able to dump the user table or anything like that.
tom_newton Posted June 9, 2012 Posted June 9, 2012 Also, edugeek's passwords are salted MD5 - so harder to crack large numbers of them than say linkedin's unsalted sha1. According to @zero_hour the attacker had limited access (no root) and while it was possible to see the hashed passwords, no evidence of a mass download was there.
davidbrg1 Posted June 9, 2012 Posted June 9, 2012 From the article "Skycure Security said the the mobile app was sending unencrypted calendar entries to LinkedIn servers without users' knowledge. The information included meeting notes, which often contain information such as dialling numbers and passcodes for conference calls." Rather irresponsible of Linkin to be sending any kind of private data unencrypted...
Geoff Posted June 10, 2012 Author Posted June 10, 2012 run: unset HISTFILE before you run any 'sensitive' commands. This will disable the command history being recorded to file for the session.
6Foot2 Posted December 13, 2013 Posted December 13, 2013 Link: Forgot Your Password? at Aram Bartholl – Blog LinkedIn passwords on display in museums around Europe: ...4.7 million LinkedIn clear text user passwords printed in alphabetical order in eight books... http://datenform.de/blog/wp-content/uploads/2013/05/IMAG7107-800x450.jpg
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now