9 ms·

860k Stratfor Accounts Dump

77 points by mrb 15y ago

tansey 15y ago
Worth noting that these passwords are all MD5 encrypted but not salted. There were also no creation rules enforced, as a quick check reveals: Highest reused password count: 12023 "stratfor"? 12023 "password"? 517 "password1"? 46 "Password1"? 24 "123456"? 625 "12345678"? 74 "jesus"? 2 "love"? 7 "war"? 1 "michael"? 39 "america"? 7 "xbox360"? 0 "heroes"? 0 Those last 2 are popular for the battlefield heroes dataset and other gaming-related ones, so I keep them in my script as gaming sites are both highly targeted and usually poorly secured. Anyway, it's clear that no rules were enforced as a 3-letter dictionary word like "war" would never be allowed by any rule creation system. The fact that "stratfor" was used by nearly 1.4% of all accounts (!) tells me that either their users did not value these accounts or they simply have no idea how passwords are supposed to work.
- mobileman 15y ago
  Bad passwords really scare me.
- majelix 15y ago
  > users did not value these accounts Why would they value their password to one of 30ish different systems/websites?
- gerhardi 15y ago
  If the account does not hold any "vital" information, password "stratfor" could be quite a harmless password to leak, as I couldn't imagine anyone using that password for any other site/account. Although I don't know what user information is contained within the account. Anyway, it is stupid to use such passwords and it tells something about the persons using those. Maybe they would use site names as passwords on other sites also.
- russellallen 15y ago
  It was just a password to online news articles, not to my bank account...
  - pavel_lishin 15y ago
    In your case, sure.
- meriksson 15y ago
  I've been a Stratfor subscriber on and off since they got started about 15 years ago (I was 14 years old at the time). The last time around I got a new subscription, Stratfor set a new password for me, and it was... "stratfor". This is just about the only bad thing I have to say about Stratfor. Being a long-time subscriber, I am always a few steps ahead of basically everyone else when it comes to global politics, and this has been very useful and enjoyable over the years. One thing worth pointing out is that a Stratfor account like mine does not contain any sensitive information. It gives me access to exactly the same Stratfor reports as any other subscriber. As far as I know, it would not be possible to obtain e.g. my credit card details by using that password.
- steve8918 15y ago
  How did you get a breakdown of all the passwords used? Did you try to crack them yourself, or has the cracked passwords been posted? I'm trying to figure out if my own password has been compromised.
  - pavel_lishin 15y ago
    I assume that he just grepped for the md5 hash of the common passwords he tried. e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l
  - MadGouki 15y ago
    All you need to do to figure out the hash for a password is take the MD5 hash of it. My guess is the commenter you replied to just took some common passwords and some no-brainers and did a quick little "find all" for each hash. Here's a tool you can use to generate MD5 hashes for given passwords: http://www.iwebtool.com/md5?string=stratfor http://www.iwebtool.com/md5?string=stratfor Going from the hashes to the passwords requires brute forcing, dictionary attacks, that sort of thing.
  - stouset 15y ago
    Assume it has.
Jayasimhan 15y ago
naive question. Is it a violation of law to download these files? I dont want to be in any kind of trouble for five minutes of excitement. edit: I currently live in the US.
- thesis 15y ago
  I guess it depends on where you live... but I'm not touching anything with that much CC data in it. Good luck.
  - redthrowaway 15y ago
    I'm not sure merely downloading the data from a public source is a crime, but I'm hiding behind academic research anyway.
    - stfu 15y ago
      How much cover does the "academic research" argument actually give? Any experience with that?
      - redthrowaway 15y ago
        Not any first-hand, and I hope never to have to find out. Still, I suspect "I am an RA working with a security researcher and we're studying password strength" would go over better than "I'm curious", although they amount to the same thing. The respect and deference we afford institutions can be a bit strange, at times.
  - Jayasimhan 15y ago
    I live in the US.
- zobzu 15y ago
  IANAL. Imagine the policy scans you computer and it contains dozen of valid CC numbers, or something that links to that. You'd be in troubles. Thus I'd say, while it may or may not be illegal - it's probably a bad idea to get and store that stuff.
tomjen3 15y ago
So what exactly has Stratfor done? I mean aside from posting their own (informed) articles and running a business? These people aren't protesting anything reasonable anymore -- they are flat out against people who earn money. Personally I consider them traitors to America.
- cipherpunk 15y ago
  Traitors to America? What the hell does that even mean in this context? Are all anti-capitalists traitors to America?
  - tomjen3 15y ago
    America is the country it is and people have it as good as they have it because America embraces capitalism. You would call a soldier a traitor if he gave a nuke to Al Quida right? Yet America would survive. Without capitalism, America would not.
    - beedogs 15y ago
      This may be the worst comment I've read on HN in months.
    - rbanffy 15y ago
      > Without capitalism, America would not. It would, of course. Just look at some European democracies that lean heavily towards socialism. Excellent universal healthcare, schooling, civil rights (yes, economic systems are orthogonal do state systems) and so on. What really endangers the US is the rapid erosion of civil liberties under the excuse the country is under attack. It is, but if the medicine kills the patient, it is not exactly a winning scenario.
- dantheman 15y ago
  I'm a fan of Stratfor (I read it to get a handle on international news - they provide a background/context to enable me to understand what's going on, unlike traditional news), and I don't agree with this type of activity, but calling someone a traitor is a serious allegation, especially when these people are merely criminals and are not committing treason, which is what traitors do. Given that I don't understand the point of posting account details with password hashes, and CC#s - what are they trying to achieve?
dandelany 15y ago
It's time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. We almost have sympathy for those poor DHS employees and australian billionaires who had their bank accounts looted by the lulz Wow. Apologies for venting, but this is fucking ludicrous. I am a middle-class mid-20s programmer who purchased a Stratfor subscription because their material is incredibly well-researched and about a million times more enlightening than your average CNN article. And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous. Congratulations, you've exposed the personal details of the rich bankers and military analysts that recognized Stratfor as the intelligent news service it is. And in the process, you've managed to completely alienate the rest of the Stratfor community, members of the "99%", who care enough about understanding global politics that they were willing to give up a portion of their hard-earned paychecks to become better-informed. Something tells me it won't be worth it. I just can't understand it. These guys are either agent provocateurs, or complete morons.
- robryan 15y ago
  I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.
  - Mithrandir 15y ago
    If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.
  - dandelany 15y ago
    You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault. Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.
gst 15y ago
When downloading the file from the .onion URL given in the link, the archive contains a member "._stratfor_users.csv". Seems that this is some OS X metafile that also includes a UUID of some sort. Anyone more familiar with the format? Does the UUID allow to identify the user that originally downloaded the CSV and/or posted the archive? (Assuming that you have access to Apple's or Google's data).
- dhx 15y ago
  AppleDouble format version 2. Home file system is "Mac OS X". There are 2 entries in the file. Format specifications for this file are available: https://tools.ietf.org/html/rfc1740 https://tools.ietf.org/html/rfc1740 General information on the file format: https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_formats https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_fo...
- jonhendry 15y ago
  Might be related to a custom icon applied to the document, or something like that.
deleted 15y ago
[deleted]
steve8918 15y ago
About 10 years ago, American Express had a service where you could create one-time credit card numbers for using it online. I loved it. For whatever reason, a couple of years later, they got rid of the service. It's times like these when a service like that would have been perfect.
- politician 15y ago
  So, Citi provides a similar "Virtual Account Number" service which allows a cardholder to create a new cc# with a new expiration date and a specific balance, but the billing address cannot be customized which reduces the usefulness of the service. As far as I know, it's also free.
CGamesPlay 15y ago
Interestingly, http://www.stratfor.com/ http://www.stratfor.com/ is "down for maintenance" at the moment.
jonhendry 15y ago
If Anonymous thinks they're making a strike against American militarism with this, why didn't they hack some place that has more influence, like the American Enterprise Institute, which is blatantly ideological and employed a number of people who went on to the Rumsfeld Pentagon? The people who support the Stratfor hack keep painting a picture of Stratfor which would far more accurately depict the mendacious hacks at AEI.
- im3w1l 15y ago
  They hack whatever sites their scripts work on.

77 points by mrb 15y ago

Worth noting that these passwords are all MD5 encrypted but not salted. There were also no creation rules enforced, as a quick check reveals: Highest reused password count: 12023 "stratfor"? 12023 "password"? 517 "password1"? 46 "Password1"? 24 "123456"? 625 "12345678"? 74 "jesus"? 2 "love"? 7 "war"? 1 "michael"? 39 "america"? 7 "xbox360"? 0 "heroes"? 0 Those last 2 are popular for the battlefield heroes dataset and other gaming-related ones, so I keep them in my script as gaming sites are both highly targeted and usually poorly secured. Anyway, it's clear that no rules were enforced as a 3-letter dictionary word like "war" would never be allowed by any rule creation system. The fact that "stratfor" was used by nearly 1.4% of all accounts (!) tells me that either their users did not value these accounts or they simply have no idea how passwords are supposed to work.

mobileman 15y ago
Bad passwords really scare me.
majelix 15y ago
> users did not value these accounts Why would they value their password to one of 30ish different systems/websites?
gerhardi 15y ago
If the account does not hold any "vital" information, password "stratfor" could be quite a harmless password to leak, as I couldn't imagine anyone using that password for any other site/account. Although I don't know what user information is contained within the account. Anyway, it is stupid to use such passwords and it tells something about the persons using those. Maybe they would use site names as passwords on other sites also.
russellallen 15y ago
It was just a password to online news articles, not to my bank account...
- pavel_lishin 15y ago
  In your case, sure.
meriksson 15y ago
I've been a Stratfor subscriber on and off since they got started about 15 years ago (I was 14 years old at the time). The last time around I got a new subscription, Stratfor set a new password for me, and it was... "stratfor". This is just about the only bad thing I have to say about Stratfor. Being a long-time subscriber, I am always a few steps ahead of basically everyone else when it comes to global politics, and this has been very useful and enjoyable over the years. One thing worth pointing out is that a Stratfor account like mine does not contain any sensitive information. It gives me access to exactly the same Stratfor reports as any other subscriber. As far as I know, it would not be possible to obtain e.g. my credit card details by using that password.
steve8918 15y ago
How did you get a breakdown of all the passwords used? Did you try to crack them yourself, or has the cracked passwords been posted? I'm trying to figure out if my own password has been compromised.
- pavel_lishin 15y ago
  I assume that he just grepped for the md5 hash of the common passwords he tried. e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l
- MadGouki 15y ago
  All you need to do to figure out the hash for a password is take the MD5 hash of it. My guess is the commenter you replied to just took some common passwords and some no-brainers and did a quick little "find all" for each hash. Here's a tool you can use to generate MD5 hashes for given passwords: http://www.iwebtool.com/md5?string=stratfor http://www.iwebtool.com/md5?string=stratfor Going from the hashes to the passwords requires brute forcing, dictionary attacks, that sort of thing.
- stouset 15y ago
  Assume it has.

Jayasimhan 15y ago

naive question. Is it a violation of law to download these files? I dont want to be in any kind of trouble for five minutes of excitement. edit: I currently live in the US.

thesis 15y ago
I guess it depends on where you live... but I'm not touching anything with that much CC data in it. Good luck.
- redthrowaway 15y ago
  I'm not sure merely downloading the data from a public source is a crime, but I'm hiding behind academic research anyway.
  - stfu 15y ago
    How much cover does the "academic research" argument actually give? Any experience with that?
    - redthrowaway 15y ago
      Not any first-hand, and I hope never to have to find out. Still, I suspect "I am an RA working with a security researcher and we're studying password strength" would go over better than "I'm curious", although they amount to the same thing. The respect and deference we afford institutions can be a bit strange, at times.
- Jayasimhan 15y ago
  I live in the US.
zobzu 15y ago
IANAL. Imagine the policy scans you computer and it contains dozen of valid CC numbers, or something that links to that. You'd be in troubles. Thus I'd say, while it may or may not be illegal - it's probably a bad idea to get and store that stuff.

tomjen3 15y ago

So what exactly has Stratfor done? I mean aside from posting their own (informed) articles and running a business? These people aren't protesting anything reasonable anymore -- they are flat out against people who earn money. Personally I consider them traitors to America.

cipherpunk 15y ago
Traitors to America? What the hell does that even mean in this context? Are all anti-capitalists traitors to America?
- tomjen3 15y ago
  America is the country it is and people have it as good as they have it because America embraces capitalism. You would call a soldier a traitor if he gave a nuke to Al Quida right? Yet America would survive. Without capitalism, America would not.
  - beedogs 15y ago
    This may be the worst comment I've read on HN in months.
  - rbanffy 15y ago
    > Without capitalism, America would not. It would, of course. Just look at some European democracies that lean heavily towards socialism. Excellent universal healthcare, schooling, civil rights (yes, economic systems are orthogonal do state systems) and so on. What really endangers the US is the rapid erosion of civil liberties under the excuse the country is under attack. It is, but if the medicine kills the patient, it is not exactly a winning scenario.
dantheman 15y ago
I'm a fan of Stratfor (I read it to get a handle on international news - they provide a background/context to enable me to understand what's going on, unlike traditional news), and I don't agree with this type of activity, but calling someone a traitor is a serious allegation, especially when these people are merely criminals and are not committing treason, which is what traitors do. Given that I don't understand the point of posting account details with password hashes, and CC#s - what are they trying to achieve?

dandelany 15y ago

It's time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. We almost have sympathy for those poor DHS employees and australian billionaires who had their bank accounts looted by the lulz Wow. Apologies for venting, but this is fucking ludicrous. I am a middle-class mid-20s programmer who purchased a Stratfor subscription because their material is incredibly well-researched and about a million times more enlightening than your average CNN article. And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous. Congratulations, you've exposed the personal details of the rich bankers and military analysts that recognized Stratfor as the intelligent news service it is. And in the process, you've managed to completely alienate the rest of the Stratfor community, members of the "99%", who care enough about understanding global politics that they were willing to give up a portion of their hard-earned paychecks to become better-informed. Something tells me it won't be worth it. I just can't understand it. These guys are either agent provocateurs, or complete morons.

robryan 15y ago
I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.
- Mithrandir 15y ago
  If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.
- dandelany 15y ago
  You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault. Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.

gst 15y ago

When downloading the file from the .onion URL given in the link, the archive contains a member "._stratfor_users.csv". Seems that this is some OS X metafile that also includes a UUID of some sort. Anyone more familiar with the format? Does the UUID allow to identify the user that originally downloaded the CSV and/or posted the archive? (Assuming that you have access to Apple's or Google's data).

dhx 15y ago
AppleDouble format version 2. Home file system is "Mac OS X". There are 2 entries in the file. Format specifications for this file are available: https://tools.ietf.org/html/rfc1740 https://tools.ietf.org/html/rfc1740 General information on the file format: https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_formats https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_fo...
jonhendry 15y ago
Might be related to a custom icon applied to the document, or something like that.

deleted 15y ago

[deleted]

steve8918 15y ago

About 10 years ago, American Express had a service where you could create one-time credit card numbers for using it online. I loved it. For whatever reason, a couple of years later, they got rid of the service. It's times like these when a service like that would have been perfect.

politician 15y ago
So, Citi provides a similar "Virtual Account Number" service which allows a cardholder to create a new cc# with a new expiration date and a specific balance, but the billing address cannot be customized which reduces the usefulness of the service. As far as I know, it's also free.

CGamesPlay 15y ago

Interestingly, http://www.stratfor.com/ http://www.stratfor.com/ is "down for maintenance" at the moment.

jonhendry 15y ago

If Anonymous thinks they're making a strike against American militarism with this, why didn't they hack some place that has more influence, like the American Enterprise Institute, which is blatantly ideological and employed a number of people who went on to the Rumsfeld Pentagon? The people who support the Stratfor hack keep painting a picture of Stratfor which would far more accurately depict the mendacious hacks at AEI.

im3w1l 15y ago
They hack whatever sites their scripts work on.