LinkedIn Hacked

[Geoff]

BBC News - LinkedIn passwords 'leaked by hackers'

 

Social networking website LinkedIn is investigating claims that over six million of its users' passwords have been leaked onto the internet.

 

Hackers posted a file containing encrypted passwords onto a Russian web forum.

 

They have invited the hacking community to help with decryption.

 

You might want to reset your LinkedIn password if you use this social network.

[SYNACK]

Gasp, you mean my code of '1234' is no longer secure, nooooooo...

 

Will I have to change the one on my luggage to?

[glennda]

Yeah saw this earlier and has been changed! If anybody wants to add me i'm here (cheeky plug as i only signed up last week!)

[Arthur]

LinkedIn Password Checker (via HN)

[6Foot2]

Link 1: LinkedIn hacker 'also stole 1.5m passwords from dating site eHarmony' - Telegraph

 

Link removed: Identified as a phishing site by another LEA.

Edited June 7, 2012 by 6Foot2
Amend post content.

[JJonas]

Link 2: Removed

 

That one is listed by our LEA as a Phishing site

Edited June 7, 2012 by JJonas

[Geoff]

false positive, it's probably taking a dislike to the Javascript.

[Arthur]

Link removed

I was going to post that link too, but thought better of it since typing passwords into websites run by unknown third-parties is generally considered bad practice (even if in this case the hash is generated directly on your computer).

 

On Mac OS X or Linux, you can actually run the command below to find the SHA-1 hash of your password.

 

echo -n '[color="#FF0000"]Pa$$w0rd123[/color]' | openssl sha1

[6Foot2]

I was going to post that link too, but thought better of it since typing passwords into websites run by unknown third-parties is generally considered bad practice...

 

Agreed. I was just suggesting it as a candidate to check if your old password had been hacked in this attack.

[Arthur]

Last.fm hacked...

 

www.last.fm/passwordsecurity

[6Foot2]

They just keep coming...

 

EHarmony.com hacked.

 

Link: eHarmony Users' Passwords Hacked - KWQC-TV6 News and Weather For The Quad Cities

[Arthur]

From the article above...

 

LinkedIn has already confirmed they are making the transition to adding what is known as "salt" to the hashes in the security community.

 

^ Shouldn't they have done this in the first place?

[tom_newton]

I was going to post that link too, but thought better of it since typing passwords into websites run by unknown third-parties is generally considered bad practice (even if in this case the hash is generated directly on your computer).

 

On Mac OS X or Linux, you can actually run the command below to find the SHA-1 hash of your password.

 

echo -n '[color="#FF0000"]Pa$$w0rd123[/color]' | openssl sha1

 

tail ~/.bash_history

 

not a great idea even if you don't plan to reuse the password

Tip: put a space before the command to prevent it being saved is the history file.

[tom_newton]

Also.. good article on salting as a kinda "follow up" to the BS flying around at EDIT

LinkedIn Password Leak: Salt Their Hide - ACM Queue

[Arthur]

tail ~/.bash_history

Good point. Thanks for the tip.

[RabbieBurns]

speaking of site hacks.. did we ever get a post about what happened to a certain IT Pro Life Line site?

[SYNACK]

speaking of site hacks.. did we ever get a post about what happened to a certain IT Pro Life Line site?

 

It was disussed in the ask the admins bit of the conf. Basicly there was a zeroday hole in the forum software that EG patched within hours but not before it was cracked by some Australian scriptkiddy who probably got the same email. He hung aroud for a bit before messing with the system. The possibility of a full breach was limited given the level of the exploitation and the limits on data transfer imposed by PHP timeouts on the server at the time meaning that it was unlikely they were able to dump the user table or anything like that.

[tom_newton]

Also, edugeek's passwords are salted MD5 - so harder to crack large numbers of them than say linkedin's unsalted sha1.

 

According to @zero_hour the attacker had limited access (no root) and while it was possible to see the hashed passwords, no evidence of a mass download was there.

[davidbrg1]

From the article

 

"Skycure Security said the the mobile app was sending unencrypted calendar entries to LinkedIn servers without users' knowledge.

 

The information included meeting notes, which often contain information such as dialling numbers and passcodes for conference calls."

 

Rather irresponsible of Linkin to be sending any kind of private data unencrypted...

[Geoff]

run:

 

unset HISTFILE

 

before you run any 'sensitive' commands. This will disable the command history being recorded to file for the session.

[6Foot2]

Link: Forgot Your Password? at Aram Bartholl – Blog

 

LinkedIn passwords on display in museums around Europe:

 

...4.7 million LinkedIn clear text user passwords printed in alphabetical order in eight books...

 

http://datenform.de/blog/wp-content/uploads/2013/05/IMAG7107-800x450.jpg