Gawker Media hacked - 1.3 million user accounts compromised

[roflcopter]

4chan gained access and dumped their entire MySQL DB.

http://www.wired.com/threatlevel/2010/12/gawker-hacked/

Gawker/Gizmodo does not salt their passwords, uses DES for hash, and now 1.3 million passwords vulnerable

If you have an account on any one of these sites and use the same password elsewhere, you might want to change it:

Gawker
Jezebel
Gizmodo
Lifehacker
Deadspin
io9
Kotaku
Jalopnik

:food-smiley-010:

 

[machinecontrol]

I don't care what you think about Gawker, it's kind of a dick move to release almost 200,000 people's emails and passwords in plain text.

Lots of people use the same password for everything. People online are saying a LOT of those passwords still work on their email, Facebook, PayPal accounts, etc.

Torrent if any of you want to look at it for..uh..research purposes:
Gawkmedia source code + database release (1,300,000 rows). (download torrent) - TPB

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?

 

[cardine]

I don't care what you think about Gawker, it's kind of a dick move to release almost 200,000 people's emails and passwords in plain text.

Lots of people use the same password for everything. People online are saying a LOT of those passwords still work on their email, Facebook, PayPal accounts, etc.

Torrent if any of you want to look at it for..uh..research purposes:
Gawkmedia source code + database release (1,300,000 rows). (download torrent) - TPB

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?

Wait, Gawker stores its passwords in plain text? That can't be right.

 

[roflcopter]

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?

"LifeHacker December 2010 Newsletter SPECIAL REPORT: Mom Makes $6,281.31 per second ONLINE!"

 

[machinecontrol]

Wait, Gawker stores its passwords in plain text? That can't be right.

The passwords were stored encrypted, but with a weak/old encryption method that makes them fairly easy to crack.

Of the 1.3 million accounts, the hackers were able to quickly crack about 200,000, which are included in the torrent in plaintext.

There's another textfile of the 2,000+ people whose password is "password". Those are probably the ones using "password" for all their passwords...

 

[danny]

2,000 out of 1.3 million not bad. Used to be 10% or so from AOL lobbies.

 

[(O_o)]

the readme.txt they include in the .torrent is hilarious.

too bad the Aweber hackers didnt .torrent their dump! lol



quote taken from readme.txt

[MySQL Database]

SERVER: 69.60.7.205
USER: root
PASSWORD: m00nsh1n3
PORT:9254

After gaining access to gawkers MySQL database we stumble upon a huge
table containing ~1,500,000 users. After a few days of dumping we
decided that 1.3 million was enough.

Gawker uses a really outdated hashing algorithm known as DES (Data Encryption Standard).
Because DES has a maximum of 8chars using a password like "abcdefgh1234" only the
first 8 characters "abcdefgh" are encrypted and stored in the database. If your
password is longer than 8 characters you only need to enter the first 8 characters
to log in!

YA DONT SAY!! ?

Because of this we were only able to recover the first 8 characters of someones password!
If the password is 8 characters long there's a good chance that it migt be longer
than 8 characters! But still, there's 1000's of people using 1 - 8 character passwords
for us to have some fun with!

We managed to crack ~200,000 hashes, if you want the rest of them cracking
DO IT YOUR FUCKING SELF! >:3

Here's a quote of encouragement for gawker users from Scott:

"We'll continue to look into this, but as I commented on your site earlier, we have no evidence that any of our readers' user accounts/passwords have been compromised. They are not stored in plain text and are on entirely different systems than the third-party hosted Campfire screenshots that appear in this article.
There's no evidence to suggest any Gawker Network user accounts were compromised, and passwords are encrypted (not stored in plain text) anyway, so stealing passwords isn't even possible."

Here's a handfull of interesting hashes from the other associated blogs.
Some maybe fake/spam accounts, can't be bothered to test them all.

We might as well help you rm -rf those files from the server because after
this your not going to want a server ever again!
I guess you wont be needing those backups either so we'll go right
ahead and help you clean that shit up!
No need for users either so we might aswell DROP that juicy MySQL database too!


YOU CAN THANK US LATER! <3
_

You would think a site that likes to mock people, such as gawker,
would have better security and actually have a clue what they are
doing. But as we've proven ,those who think they are beyond our reach
aren't as safe as they would like to think!


We've not done yet, we have other targets in our sights, you will all soon realise that
nothing is sacred on the internet, we can get to each and every one of you and expose
your so called "security" and expose you for the faggots you are!

 

[cougarclaws]

2,000 out of 1.3 million not bad. Used to be 10% or so from AOL lobbies.

lol did you ever use pharming software? You could just suck all of the keywords out of peoples member profiles and try them as their password.

Lots of "soccer" "fishing" "guitar" type passwords.

 

[roflcopter]

Wait, Gawker stores its passwords in plain text? That can't be right.

From my (PROBABLY WRONG) understanding:

Gawker stored the password as hash values, not plaintext (good).

They were using the Unix crypt function, which uses 56-bit DES and only hashes the first 8 characters of the password and stores that. (bad)

So if your password were 123456789, you can just log in by typing 12345678 as the password (lol), because the algorithm would generate the same hash for both values.

Since there are a limited number of possible passwords that are 1 to 8 characters long, you can brute force every possible combination and generate a hash for each possible password between 1 to 8 characters with modern hardware. Also because they either didn't use a salt, a static salt value, or a predictable salt value for each user, it makes it easy. Then you just query the db for that hash.

That results in getting a plaintext password.

If it works out that way, they can only get the first 8 characters of the password, so people using longer passwords would be safe.

 

[machinecontrol]

And the madness begins:

‘Acai Berry’ Twitter attack reportedly linked to Gawker hack

Seriously guys...acai? Let's forget about ethics or law for a moment.
You get a highly targeted, fresh email list of readers of a specific blog, and all you can think of is to hack their Twitter accounts and spam acai links?

Idiots like this is the reason our industry gets such a bad rep.

 

[eVandals]

so stupid ^

 

[roflcopter]

And the madness begins:

‘Acai Berry’ Twitter attack reportedly linked to Gawker hack

Seriously guys...acai? Let's forget about ethics or law for a moment.
You get a highly targeted, fresh email list of readers of a specific blog, and all you can think of is to hack their Twitter accounts and spam acai links?

Idiots like this is the reason our industry gets such a bad rep.

lolz

 

[Ulixes]

Damn, I feel for the people that had their emails/passwords put out there. It's not like Gawker is a fly-by-night operation, people wouldn't expect their information to be released from them.

Relevant Image:

 

[(O_o)]

And the madness begins:

‘Acai Berry’ Twitter attack reportedly linked to Gawker hack

Seriously guys...acai? Let's forget about ethics or law for a moment.
You get a highly targeted, fresh email list of readers of a specific blog, and all you can think of is to hack their Twitter accounts and spam acai links?

Idiots like this is the reason our industry gets such a bad rep.

lulzZz

 

[Hurr-Durr]

And the madness begins:

‘Acai Berry’ Twitter attack reportedly linked to Gawker hack

Seriously guys...acai? Let's forget about ethics or law for a moment.
You get a highly targeted, fresh email list of readers of a specific blog, and all you can think of is to hack their Twitter accounts and spam acai links?

Idiots like this is the reason our industry gets such a bad rep.

hahahaha wowwwww....isn't acai like DEAD already?

 

[vinnythejinny]

Gawkai Berry FTW. who the fuck did that shit

 

[cardine]

Sooooo.... anybody have a level 1 proxy network that has no honey pots?

 

[Fatbat]

I don't care what you think about Gawker, it's kind of a dick move to release almost 200,000 people's emails and passwords in plain text.

Lots of people use the same password for everything. People online are saying a LOT of those passwords still work on their email, Facebook, PayPal accounts, etc.

Torrent if any of you want to look at it for..uh..research purposes:
Gawkmedia source code + database release (1,300,000 rows). (download torrent) - TPB

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?

That torrent link is dead and no results come up on TPB or Demonoid for "gawker", "gawkermedia", etc.

 

[Wicked Ice]

@Fatbat, go to isohunt.com and search for "gawkmedia".

 

[-Matt-]

Those that are using the same pass across multiple sites deserve what comes to them. It's not hard to install one of the many password managers out there.