5 ms·

There's an alleged database dump of Mt Gox floating around... https://twitter.com/#!/954/status/82531189705019392 https://twitter.com/#!/954/status/825311897050

There's an alleged database dump of Mt Gox floating around... https://twitter.com/#!/954/status/82531189705019392 https://twitter.com/#!/954/status/82531189705019392 UPDATE: looks legit. http://forum.bitcoin.org/index.php?topic=19543.0 http://forum.bitcoin.org/index.php?topic=19543.0 https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

kristofferR 15y ago
Damn, I'm in there. Glad I used a generated password (from LastPass) so I don't have to change my passwords on a lot of various sites.
- deleted 15y ago
  [deleted]
- lubos 15y ago
  this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.
  - jtchang 15y ago
    They look like salted hashes to me.
    - lubos 15y ago
      you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)
      - rorrr 15y ago
        5f4dcc3b5aa765d61d8327deb882cf99 = md5("password") for those who don't know Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.
        jonknee 15y ago
        That's what happens when there's no regulation...
        icebraining 15y ago
        You must not have been following the news: http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... It happens everywhere.
        jfoutz 15y ago
        Would you be willing and able to point out the regulation violated? http://www.federalreserve.gov/bankinforeg/reglisting.htm http://www.federalreserve.gov/bankinforeg/reglisting.htm Cause, I don't think they broke any rules. Are they even required to keep those details secret? It's pretty clear marketing agencies can buy that data, so i don't think it's any sort of violation of privacy policy.
        gcb 15y ago
        icebraining, that's called irony ...i hope
        leon_ 15y ago
        I find it funny that people are outraged about unsalted MD5 yet they use passwords like "secret123" that are found in every wordlist. Guess what: Even salted hashes won't save your ass with such weak passwords. And yes: it's a FUCKING TRADING PLATFORM you want to put money on so _you_ should think of a secure password.
        15y ago
deleted 15y ago
[deleted]
deleted 15y ago
[deleted]
- deleted 15y ago
  [deleted]
  - deleted 15y ago
    [deleted]
soult 15y ago
I can confirm that the alleged dump is the real deal. Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes. 0: http://www.kernel.org/doc/man-pages/online/pages/man3/crypt.3.html http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....
- bradleyland 15y ago
  I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.
  - Hawramani 15y ago
    Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?
    - defrost 15y ago
      A good start can be made by following the work of Ross Anderson and having a read of his book. http://www.cl.cam.ac.uk/~rja14/ http://www.cl.cam.ac.uk/~rja14/ http://www.cl.cam.ac.uk/~rja14/book.html http://www.cl.cam.ac.uk/~rja14/book.html
    - bradleyland 15y ago
      Being a programmer means committing yourself to a life of continued education. Building a secure authentication system? Time to read up on the subject. You don't have to go far before you learn about the vulnerability of MD5 hashes for password storage.
    - michaelf 15y ago
      A great place to start is "Applied Cryptography" by Bruce Schneier. http://www.schneier.com/book-applied.html http://www.schneier.com/book-applied.html Edit: Note, this really barely scratches the surface for building secure software. AC says how to apply cryptographic primitives correctly. It won't teach you how to avoid vulnerabilities specific to particular application domains (like CSS, SQL injection, etc...).

kristofferR 15y ago

Damn, I'm in there. Glad I used a generated password (from LastPass) so I don't have to change my passwords on a lot of various sites.

deleted 15y ago
[deleted]
lubos 15y ago
this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.
- jtchang 15y ago
  They look like salted hashes to me.
  - lubos 15y ago
    you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)
    - rorrr 15y ago
      5f4dcc3b5aa765d61d8327deb882cf99 = md5("password") for those who don't know Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.
      - jonknee 15y ago
        That's what happens when there's no regulation...
        icebraining 15y ago
        You must not have been following the news: http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... It happens everywhere.
        jfoutz 15y ago
        Would you be willing and able to point out the regulation violated? http://www.federalreserve.gov/bankinforeg/reglisting.htm http://www.federalreserve.gov/bankinforeg/reglisting.htm Cause, I don't think they broke any rules. Are they even required to keep those details secret? It's pretty clear marketing agencies can buy that data, so i don't think it's any sort of violation of privacy policy.
        gcb 15y ago
        icebraining, that's called irony ...i hope
      - leon_ 15y ago
        I find it funny that people are outraged about unsalted MD5 yet they use passwords like "secret123" that are found in every wordlist. Guess what: Even salted hashes won't save your ass with such weak passwords. And yes: it's a FUCKING TRADING PLATFORM you want to put money on so _you_ should think of a secure password.
        15y ago

deleted 15y ago

[deleted]

deleted 15y ago

[deleted]

deleted 15y ago
[deleted]
- deleted 15y ago
  [deleted]

soult 15y ago

I can confirm that the alleged dump is the real deal. Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes. 0: http://www.kernel.org/doc/man-pages/online/pages/man3/crypt.3.html http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....

bradleyland 15y ago
I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.
- Hawramani 15y ago
  Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?
  - defrost 15y ago
    A good start can be made by following the work of Ross Anderson and having a read of his book. http://www.cl.cam.ac.uk/~rja14/ http://www.cl.cam.ac.uk/~rja14/ http://www.cl.cam.ac.uk/~rja14/book.html http://www.cl.cam.ac.uk/~rja14/book.html
  - bradleyland 15y ago
    Being a programmer means committing yourself to a life of continued education. Building a secure authentication system? Time to read up on the subject. You don't have to go far before you learn about the vulnerability of MD5 hashes for password storage.
  - michaelf 15y ago
    A great place to start is "Applied Cryptography" by Bruce Schneier. http://www.schneier.com/book-applied.html http://www.schneier.com/book-applied.html Edit: Note, this really barely scratches the surface for building secure software. AC says how to apply cryptographic primitives correctly. It won't teach you how to avoid vulnerabilities specific to particular application domains (like CSS, SQL injection, etc...).