6 ms·
8tracks Password Security Alert
- GrumpyNl 9y agoHere we go again. We see these happening to often.
- Rjevski 9y agoAt least the passwords were hashed. I wonder what hash they used though. I'm tempted to bet good money it's going to be an inadequate one like SHA1 or a completely broken one like MD5.
- scovetta 9y agoSHA-1 and MD5 are susceptible to collisions, not pre-image attacks, so replacing either with SHA-256 wouldn't really impact this scenario. The real question is whether they used iterated hashing (and to what degree), peppering, a keyed hash, or something else that would slow down a dictionary attack.
- JosephRedfern 9y agoI don't think OP suggested otherwise?
- ivanbakel 9y agoI think it's relevant to GGP's use of "completely broken" - collisions are far less useful than actually extracting the password string, since one is transferable and has long-term potential, and the other will probably lose all its value pretty quickly, especially with a change of salt.
- cyphar 9y agoWhile "inadequate" and "completely broken" are totally valid qualifiers for those hashing algorithms, the way in which they are broken doesn't affect sha1crypt or md5crypt (only a pre-image attack would break them, collisions are bad but not enough). That doesn't mean you should use them though (you should use bcrypt or similar).
- meowface 9y agoWhen the purpose of hashing is protection of passwords, MD5, SHA1, SHA256, etc. are all effectively equally broken. MD5 vs. SHA1 makes no real difference here. You can usually tell a company's security posture when they say "all passwords were hashed and salted" without listing the hashing algorithm. If they're using an algorithm actually suited for password hashing, like bcrypt, they'll usually state the name of the algorithm.
- Rjevski 9y agoTo be honest I know that MD5 vs SHA1 or SHA512 is irrelevant in terms of password hashing, but personally seeing SHA512 would make me laugh a little less than MD5. Both are inadequate for this particular use-case, but at least seeing the modern hash would mean they tried to do the right thing.
- kevin_thibedeau 9y agoLittle comfort if they weren't salted.
- phreack 9y agoWhat I'd like to know and is lacking from this disclosure is what data they stored and was leaked from users, and the hash algorithm they used.
- achairapart 9y agoMotherboard[0] talks about 18 million accounts compromised, stolen data includes usernames, emails and SHA-1 hashed passwords. [0]: https://motherboard.vice.com/en_us/article/mbjm83/hacker-steals-millions-of-accounts-from-internet-radio-service-8tracks https://motherboard.vice.com/en_us/article/mbjm83/hacker-ste...
- ec109685 9y agoWish all sites let you login with one of the big identity providers like google or Facebook.
- ocdtrekkie 9y ago"Wish all sites reported your activity to advertisers like Facebook or Google." Convenience is a big selling point, but the price is too high.
- cyphar 9y agoAbsolutely not, it ties all of your information together trivially. People should just use password managers with a unique password for each website. Then you don't really about one site's bad security meaning that your security on another site is ruined (with SSO that's also an issue, you just trust the SSO provider more explicitly). You only care about whether data was accessed or modified with a particular service.
- Kiro 9y agoNo, I prefer Google or Facebook.
- cyphar 9y agoAnd if your Google or Facebook account is hacked...?
- user5994461 9y agoSame as if your password manager account is hacked.
- rocqua 9y agoThere are non-cloud based password managers.
- ec109685 9y ago
- matt_wulfeck 9y ago> If you signed up via Google or Facebook authentication, then your password is not affected by this leak This is why it drives me crazy when I click "login using google" and then it immediately prompts me to create an account with only my email filled in.
- joneholland 9y agoThanks for letting us have access to all your personal data!
- colechristensen 9y agoThis is not how "login with google" works. Instead it's using Google/Facebook/whatever as a trusted third party to authenticate you.
- cyphar 9y agoBut Google/Facebook/whatever can trivially link all of your accounts through the SSO (and when you access your accounts). Of course, Google can get some of that information from GMail and both can get it from tracking (and GP was talking about the other way around), but it is something to consider.
- cyberferret 9y agoOk, so the breach was via an employee's Github account that wasn't secured with 2FA. I understand that would have given them access to the source code for 8tracks, but HOW did they get access to database credentials?? I would have assumed best practice would dictate that database server IP addresses and access credentials would have been in a configuration file that is NOT checked into version control?? Most companies go to great lengths to extract credentials, keys and other sensitive information into some sort of environment file, don't they? Unless they had a copy of their database in text/JSON/XML format uploaded to version control as well??
- ams6110 9y agoThey don't explain exactly how, but yes the attacker did find a database backup. Apparently the production systems were not accessed.
- staofbur 9y agoIt's perfectly reasonable to put your credentials and configuration into a VCS if any secrets are in ansible vault or something similar. I reckon they either stuffed it all in as plain text or someone got hold of their source code and found a stupid hole in it and just read the database file off the front end somewhere. It's not unusual for the unclued to stick a database dump on a front facing web server with a "secret url" and just pull that down with curl or something.
- ivanbakel 9y agoIt's really never reasonable. Even if your VCS is already secure, inserting credentials means bringing it up to spec with actual credential storage policy, even if that means inconvenience to the developers - and if it's not inconvenient, your policy is probably too lax in the first place. There should be a total separation of concern between your code and user credentials.
- user5994461 9y agoI have never seen a company that didn't store some credentials in their VCS.
- TekMol 9y agoThat the Github account did not use 2FA does not explain the breach. How did the attacker get the password?
- kentt 9y ago> Although the decryption of one particular user’s password through brute-force techniques is unlikely, This doesn't seem true to me given that many people use weak passwords (even when they think they don't).