20 ms·
AdultFriendFinder was hacked
- perlgeek 10y ago> Friend Finder Network Inc is a company that operates a wide range of 18+ services and was hacked in October of 2016 for over 400 million accounts representing 20 years of customer data which makes it by far the largest breach we have ever seen They didn't see the Yahoo break with 500m accounts? Also, why is "pakistan" such a popular password? Deployed soldiers?
- varjag 10y agoSome bot's default?
- aliakhtar 10y agoAs a pakistani, that cracked me up. We are at the top of the list of porn searching countries, I think ( http://tribune.com.pk/story/823696/pakistan-tops-list-of-most-porn-searching-countries-google/ http://tribune.com.pk/story/823696/pakistan-tops-list-of-mos... ) and porn sites often have AdultFriendFinder ads, so it is possible that a pretty large number of pakistani people signed up. (Assuming there's a free sign up)
- kimshibal 10y agoBecause they hate India
- Kenji 10y agoAdultFriendFinder.com 103,070,536 passwords already plainly visible 232,137,460 passwords hashed with SHA1 99.3% of all passwords from this website are now plaintext (cracked). As someone who cares about security, this is very, very painful to read. But it also makes me curious about that password data set. It might be used for security research, like estimating the entropy of passwords more accurately.
- coldcode 10y agoIt definitely shows how terrible people are at password generation and reuse but even more so how little it matters on individual sites if those folks have no understanding or don't care about protecting passwords. Yet people keep using 123456 as a password.
- noir_lord 10y ago> if those folks have no understanding or don't care about protecting passwords I suspect that or is an and in a lot of cases as well.
- qb45 10y agoI use silly passwords at sites where I don't care about security and don't want to be correlated with my other accounts elsewhere. Does this mean I'm bad at password generation and reuse? ;)
- user5994461 10y agoLots of bots and throwaway on AdultFriendFinder. It's normal to have many users using "123456" and the likes, they are not real users.
- olegkikin 10y agoI'm shocked that developers of such sensitive website would do this. Were the owners cheap and hired some offshore team for pennies?
- nmgsd 10y agoYou can always assume this.
- catoc 10y agoHow does this work? - The site lists 3.87 million Dutch speaking accounts. - Dutch is almost exclusively spoken in the Netherlands. - The total adult population (15-55) is 4.45 million (http://www.indexmundi.com/netherlands/demographics_profile.html http://www.indexmundi.com/netherlands/demographics_profile.h...) This would mean that 80% of the Dutch adult population has an Adult Friend Feinnder account!? (Of course people may have multiple accounts, but still, 80% is when taking into account the full (men+women) population.)
- TazeTSchnitzel 10y agoSpammers? Belgians?
- anc84 10y agoProbably 90% bots and throwaway accounts.
- jj89 10y agoYou need to double that, unless you exclude females. Why do you stop at 55? "15-24 years: 12.11% (male 1,050,889/female 1,010,596) 25-54 years: 39.83% (male 3,400,998/female 3,377,311)"
- catoc 10y agoThanks for correcting that. Doubling checking halves the estimate to just over 40%. Still high, but more likely (given the already mentioned bots/spammers/double accounts etc). Indeed why stop at 55. Why shouldn't a pensionado be on a swinger site. Who am I to judge ;-)
- jnbiche 10y agoThe first estimate I see of worldwide Dutch speakers is ~23 million[0]. There's over 5 million Dutch speakers (Flemish) in Belgium alone. So you're looking at somewhere between 15-20% of Dutch speakers have accounts, which seems more reasonable, particularly if some people have more than one account (very likely, I'm guessing). 0. http://www.ucl.ac.uk/atlas/dutch/who.html http://www.ucl.ac.uk/atlas/dutch/who.html
- anc84 10y agotl;dr: Last months AdultFriendFinder.com, Cams.com, Penthouse.com, Stripshow.com, iCams.com databases in a "statistics" advertisement for leakedsource.com's services.
- deleted 10y ago[deleted]
- supersan 10y agoI often store my password using PHP's password_hash('password', PASSWORD_DEFAULT) function. This function has been baked into the language since version 5.0 I think. I'm sure most other languages must have a similar function too, yet so many sites save the password in plain text. Doesn't make any sense.
- inglor 10y agoMajor props to Anthony https://github.com/ircmaxell https://github.com/ircmaxell for adding this as a language supported feature to PHP as well for his work on techniques for preventing injection. I work with C#, Java, Python Go and JS on backends a lot and no other language I worked with had such a simple but secure API.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- chucksmash 10y agoI can't speak for all of those languages, but this functionality is often provided at the web framework level in Python and it fits quite nicely there. Since your web framework typically also knows where you are storing your passwords, you can do nice things like increase the number of bcrypt rounds in a settings file and have users transparently migrated as they login which I'd assume doesn't really work at the language level. Still, a pragmatic answer and, given PHP started life as a web framework, fitting :).
- slrz 10y agoGo seems pretty nice: func GenerateFromPassword(password []byte, cost int) ([]byte, error) func CompareHashAndPassword(hashedPassword, password []byte) error [from golang.org/x/crypto/bcrypt]
- avinassh 10y agoNot a std lib in Python, but Django has nice API as well for saving the password [0]. from django.contrib.auth.models import User u = User.objects.get(username='john') u.set_password('new password') u.save() And here is the code which does all the magic - [1]. You can also generate nice passwords [2], use many available different hashers [3] Or write your own [4] [0] - https://docs.djangoproject.com/en/dev/topics/auth/default/#changing-passwords https://docs.djangoproject.com/en/dev/topics/auth/default/#c... [1] - https://github.com/django/django/blob/stable/1.10.x/django/contrib/auth/base_user.py#L104 https://github.com/django/django/blob/stable/1.10.x/django/c... and https://github.com/django/django/blob/stable/1.10.x/django/contrib/auth/hashers.py#L66 https://github.com/django/django/blob/stable/1.10.x/django/c... [2] - https://docs.djangoproject.com/en/dev/topics/auth/customizing/#django.contrib.auth.models.BaseUserManager.make_random_password https://docs.djangoproject.com/en/dev/topics/auth/customizin... [3] - https://docs.djangoproject.com/en/dev/topics/auth/passwords/#included-hashers https://docs.djangoproject.com/en/dev/topics/auth/passwords/... [4] - https://docs.djangoproject.com/en/dev/topics/auth/passwords/#writing-your-own-hasher https://docs.djangoproject.com/en/dev/topics/auth/passwords/...
- peter303 10y agoEVERYTHING done online could be public someday. Act like it.
- wepple 10y agoI feel this is a defeatist stance to take; LFI's are a solved problem and we should be looking to how and why this happened and prevent it in the future. Another angle: we're supposed to not do anything that requires any form of confidentiality online? can't book a doctors appointment, transfer money, send emails to family?
- twelve40 10y agoIt's not defeatist, it's personal hygiene. Sure there are some convenience trade offs and edge cases, but things like Facebook, Dropbox, etc can almost assuredly be treated as "eventually public" no matter how many buttons and knobs they add. The sooner people realize it, the better.
- rmc 10y ago> Sure there are some convenience trade offs and edge cases Some convenience trade offs? You're suggesting that people don't use any modern bank, don't use any hospital, don't interact with any state body at all. Should we go live in a cabin in the woods?
- tortasaur 10y agoIt seems to me that what they're actually saying is to tread carefully when it comes to social media and cloud services.
- anigbrowl 10y agoWhat about people who want to communicate and socialize but want some privacy?
- 10y ago
- aikah 10y ago> How did it happen? They were hacked via a Local File Inclusion exploit and you can read more about the situation when it was initially reported from this link. > LFI vulnerabilities allow an attacker to include files located elsewhere on the server into the output of a given application. How did they do that ? append /../../../etc to an url that is supposed to serve a file and hope the server doesn't check for directory traversal ?
- bitJericho 10y agoThat's it exactly. For example, Upload a jpg that is actually code and then call that jpg through the exploit.
- wyager 10y agoIMO, if you're checking the URL for directory traversal it's already too late. Whenever I build a server that serves files, I maintain a whitelist set of served files, and the first thing I do in the file request handler is check if the URL is in the set. If not, immediately drop to 404. There's too much that can go wrong with trying to sanitize inputs; it's better to rule out the possibility of unsanitized data by design. There's more than one approach to this, and none of them admit directory traversal.
- andybak 10y agoHow would you allow user uploads with that a whitelist? Accepted uploads get automatically added to your whitelist? That sounds problematic.
- wereHamster 10y agoProblematic how? It doesn't mean the whitelist has to be in the code, it could be 'generated' from a database (let whitelist be the result of select file_name from uploaded_files_table)
- paulddraper 10y ago
- blah39832908 10y agoIs it possible for such a leak on Google searches? I.e. massive leak of accounts to search data, or 3rd party leaks?
- Kenji 10y agoOf course it's possible, the question is how likely it is.
- have_faith 10y agoI would be interested to see if it is possible to work out what percentage of the profiles are fake/bots from the data leaked. Is that possible or would they simply blend in too easily?
- CoryG89 10y agoIt would probably be difficult to prove with certainty, but depending on what the passwords are, you could potentially be able to do something like that. For example, if there are enough accounts that have the same password (which is also relatively unique), then at some point it will be a statistical impossibility that they were all created by different people.
- wepple 10y agocan we please not refer to a kid who exploits a 10-year-old known vulnerability as a "researcher".
- ec109685 10y agoHow do you know he/she is a kid?
- ftxdri 10y agoYour ego is showing. Just because the vulnerability is old doesn't mean you can disrespect his profession. Sometimes people just write bad code. I'm sure you've done the same.
- wepple 10y agoI've definitely written bad code, for sure. I don't mean to sound disrespectful, I chose my words pretty poorly there. I'm arguing that this isn't research. There was no novel technique used or investigation into original paths of exploitation or increasing our understanding of previously unknown areas of anything. There's a material reason I said the above; calling the individual a researcher suggests that the exploitation of AFF was something quite complicated requiring a previously unknown attack, taking away from the fact that having an LFI in your app in 2016 is potentially bad luck but more likely just negligent; it should be highlighted as such.
- mpclark 10y agoIn the sheepish confirmation it'll be "a sophisticated and meticulously executed attack by what can only be a state-sponsored hacking group"
- user5994461 10y agoHum. Your quote is a line from the last Mirai DDoS. And the next week, a later article corrected to "a script kiddie from HackForums" as determined by the FBI :D
- coldcode 10y ago"the hashed passwords seem to have been changed to all lowercase before storage". I have no words to describe how idiotic this is. How do people come up with this and still get paid?
- Fluid_Mechanics 10y agoI don't think they're recruiting top talent...
- 0xmohit 10y agoMaybe they don't look out for talent on HN unlike Pornhub [0] :) [0] https://news.ycombinator.com/item?id=12846537 https://news.ycombinator.com/item?id=12846537
- riffraff 10y agoI guess this was done to allow inputting a slightly wrong password? I seem to recall facebook allowed login for a pass "fooBar" with "FooBar" (phone input capitalize first letter) and "FOObAR" (caps lock pressed). Still seems stupid to me, but if you care a lot more about letting people in than about their security it might make sense.
- timbowhite 10y agoChase's online banking login is case insensitive (for both username and password). Frightening that a bank cares less about security than letting people in.
- manyxcxi 10y agoI get the case insensitivity on the username though. You don't want grandma trying to remember if it was SweaterKnits@aol.com or sweaterKnits@aol.com as they resolve to the same thing. If not using the email, then he same thing applies, and I don't want the hassle of my tech support trying to resolve the difference over the phone.
- 10y ago
- teppopo 10y agoHow they crack the hashed passwords?
- Kenji 10y agoProbably SHA-1 Rainbow tables.
- rasmi 10y agoProbably rainbow tables: https://en.wikipedia.org/wiki/Rainbow_table https://en.wikipedia.org/wiki/Rainbow_table
- ryan-c 10y agoThe passwords shown were cracked with dictionary attacks. Rainbow tables are difficult to use in situations other than cracking up to a particular length using a specific character set, and even for that have little, if any speed advantage over modern GPUs.
- user5994461 10y agotop 1000 passwords list + brute force + rainbow table + dictionary attack + fingerprinting attack. All of that running on GPU. It's terribly effective. Even more so when 90% of accounts are throwaway/bots/fake accounts. I'd make a blog post about cracking 99.7% of AdultFriendFinder passwords in 1 hour. But then I realized that it's evil and I shall not.
- truth_sentinell 10y agoAnd what do they hit to make sure the password was cracked? Do they make bots to login? I don't understand.
- joaodlf 10y agoSHA1 is a hashing algorithm (as opposed to an encryption algorithm), this means the string you're trying to hash will always have the same result. As an example, the string "password" will always have the same SHA1 hash (5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8). If you have the list of hashes, you can always find a lot of the passwords by using the techniques explained above.
- deleted 10y ago[deleted]
- encoderer 10y agoIf they don't want it to be mineable, why not a search feature that emails results to the email in question?
- auganov 10y agoI'm guessing they got an exclusive on that one. Want to ramp up the PR machine before delivering the goods. They'll drop it when everyone's excited enough. I doubt they care about privacy, the whole point of their service is/was not caring about it (as opposed to haveibeenpwned).
- dredmorbius 10y agoMy first thought was "again"? This just happened. Yes. Again: This event also marks the second time Friend Finder has been breached in two years, the first being around May of 2015. Data are liability.
- asafira 10y agoSo I have always wondered this, but what is the most common way to realize that your data was hacked? Is it from very careful monitoring of connection logs? Do hackers typically leave notes and/or obvious traces? Do you start to notice your stored information online (possibly for sale) in sketchy places? Do specifically your customers start getting spam?
- zombees 10y agoAt the last company I worked for, we discovered an intrusion when we started getting a ridiculous number of credit card fraud complaints. It should be noted that we sold scientific instrumentation to other small companies and rural markets so it was pretty easy for them to figure where their info got stolen from when they only used their cards for infrequent transactions.
- rarrrrrr 10y agoIf you're being proactive about it, one approach is to create "canary" accounts: single purpose email addresses that signup for your service and nothing else. When those email addresses start getting spam, it's a strong indicator your database has been accessed. Many users signup for each online service with a single-purpose email address. e.g. <servicename>@uniquedomain.com, so many customers will often know of a leak as soon as the service provider does.
- grzm 10y agoI hadn't heard of the canary account approach. Nice idea! As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct?
- cmdrfred 10y ago>As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct? I don't know how you would tell the difference in that case so I assume yes. The way I implement this is I bought an entire domain for spam. I created a catchall account and when I sign up for services I can just punch in hackernews@spam.com for example. All of this filters into a single email account allowing me to retrieve all my password resets and account confirmations. This will weird out some people over the phone: "Yes, it's comcast@spam.com" "Sir, to look up your account I need YOUR email address"
- chomp 10y agoIs there a torrent or something of the database that is not hidden behind a paywall?
- SorryImAnon 10y ago> If Twitter decides to ban them [their new @BigSecurityNews account] as well, we are going to start giving exclusive content to the terrorist group ISIS so they too get banned from Twitter because it seems like that's what it'll take to get Twitter to take action against accounts of those who enjoy cutting the heads off their enemies. Savage. It's interesting why twitter seems to be blind against obvious terrorists accounts.
- Animats 10y agoFriendfinder and their brands are run by Andrew Conru. They're quite successful; they own Penthouse. At one point he tried to buy Playboy, but Hefner wouldn't sell. They don't really have 300,000,000 accounts; there's been litigation over their fake accounts. It's probably going to turn out to be like Ashley Madison, where over 95% of the female accounts were fake. They had a breach last year, but it wasn't as big.[1] [1] http://www.ibtimes.com/adult-friend-finder-dating-site-known-casual-sex-hacked-blackmail-purposes-1934545 http://www.ibtimes.com/adult-friend-finder-dating-site-known...
- MilnerRoute 10y agoThey don't own Penthouse. That's one of the things that's so weird about all this. They sold Penthouse.com in February -- but then still managed to lose all of its login credentials in a database breach 8 months later... https://it.slashdot.org/story/16/11/13/2144229/hack-exposes-412-million-accounts-on-adultfriendfinder-sites https://it.slashdot.org/story/16/11/13/2144229/hack-exposes-...
- mcguire 10y agoThey kept a backup?
- stingraycharles 10y agoWhich is usually not allowed after acquisition, exactly for reasons like this.
- anigbrowl 10y agoEven if there are only 3 million real accounts that's still massively problematic for people who have one.
- djsumdog 10y agoI thought Conru owned both Ashley Madison and AFF? Didn't some AFF info leak during the Ashley Madison hack? Or am I not remembering that correctly?
- codedokode 10y agoIf we could use a different identifier (like email address) for every website such hack would not be a problem. Or if we used a hardware key without email address.
- inostia 10y ago17 fuckyou 34,498. What a strange password choice. The interesting thing to me is that password choices clearly reflect the demographic of the users.
- jsprogrammer 10y agoCards should be easy to pull. Things are tightening up.
- junto 10y agoI think that is a response based upon the dark UI pattern of the site. If you want to view a profile, they force you to register. Hence the user clicks on a profile, gets a registration form, and fills it out in a bad mood, since they are being forced register to continue when they don't want to. Hence "fuckyou" or "fuckoff" becoming their password choice. It would be interesting to see what email addresses these specific users gave. Possibly throwaways that use equally fruity names?
- lemming 10y agoI'm amused to see "ifyourreadingthisitstoolate" among the long passwords. Quite!
- mitchh 10y agoCould just be a reference to the Drake album
- WhitneyLand 10y agoWhy are they not making the data searchable? I don't see how that helps anyone when a technical person can trivially setup a search, and a non-tech person could pay someone a small sum to do the same.
- Buge 10y agoThey say the hashes were peppered. What does that mean? If it's similar to a unique salt per user, I find it hard to believe they could crack that many very strong looking passwords.
- bcoates 10y agoAll peppering does is make it trivially more difficult to check for duplicate passwords. A system with a decent amount of GPU power can try passwords against SHA-1 at billions of attempts per second.
- Buge 10y agoWhat does peppering mean though? I don't even know the definition. Per-user unique salts are definitely helpful in leaks like this. With 400,000,000 users, it would take 400,000,000x more compute power to crack the same number of passwords.
- slau 10y agoGoing to take it from the top. Skip down for the actual pepper information if you're already familiar with hashing and salting (I assume most people will be). Let's assume you want to store a password. The first, obvious step, is to store it in plain text. This is obviously brain dead, but well, we live in the world we live in. $user_pw = $password; The second step is to hash it. This means that the password can't just be read out of the database. $user_pw = hash($password); The problem with this approach is that with the amount of computing available, it's fairly trivial to just bruteforce everything, and with the advent of rainbow tables (pre-cracked hashes), it gets even easier. The next obvious step is to salt the password. Salting means that you add a random piece of information to what you hash, in order to disable the use of rainbow tables. Every password has to be cracked individually. The salt needs to be included in the stored form of the hash, because otherwise you can't calculate incoming authentication requests against it. $user_pw = concat($salt, ':', hash(concat($salt, password))); This makes a targeted attack possible, but mass attack over a long list of passwords gets quite a bit more difficult. The problem is that now, you have the salt always stored with the password. This means that if your database gets stolen/dumped, an attacker has all the information required to crack specific hashes. In order to alleviate this, you can use a pepper, which is similar to a salt, except that it is global and unique to your application, and doesn't change all the time. It is a static piece of data that gets hashed as well, but isn't stored alongside the hashes in the database. $user_pw = concat($salt, ':', hash(concat($salt, $PEPPER, password))); This obviously only changes anything if your pepper doesn't get stolen alongside the database, so this is usually an application-specific constant that doesn't get stored in the database.
- ommunist 10y agoI wonder how much Adobe and Dropbox data from their breaches overlap with AFF data? What a Klondike for a sociologist.