11 ms·
We got hacked
- carlsednaoui 13y ago"The information that was accessed includes usernames, passwords, physical addresses, email, hashed passwords..." They mention passwords AND hashed passwords, I wonder if this means they had some passwords saved in the clear.
- seanlinehan 13y agoI was thinking the same thing. From their wording of the issue, that appears to be the case.
- aroman 13y agoAnd also whether "hashed" means salted and hashed or just simply hashed. Honestly, I would feel much more comfortable if sites publicly disclosed their password encryption strategy. Just saying "oh they're hashed" really doesn't make me feel any better -- how do I know they didn't just do a quick MD5 instead of a proper password-appropriate process?
- nwh 13y ago> Honestly, I would feel much more comfortable if sites publicly disclosed their password encryption strategy. Funny you should mention that. I thought at one point that I could set up a http://tosdr.org/ http://tosdr.org/ like database, showcasing the best password securities in use. You could have lists of the people using MD5, scrypt, bcrypt, and so forth. Think of it as a trophy case of password storage algorithms. My sticking point was finding the information, aside from looking at already leaked databases, you just have to go and ask the developers. I emailed about 35 companies with a standard block of text asking if they were willing to disclose their scheme, the responses were mostly in the following: • "our passwords are encrypted, you don't need to worry" • "we can't disclose this for security reasons" • "you're trying to hack us!" I don't know what I expected really. We will have to stick to laughing at the atrocities listed on on http://plaintextoffenders.com/ http://plaintextoffenders.com/ .
- ghshephard 13y agoI would feel much better if passwords were just stored on a HSM (Hardware Security Module) instead of an local unix file system. And, from a security perspective, it's mostly irrelevant as to whether passwords were hashed (where hash = MD5, SHA, or some other high speed hash function), or salted+hashed. Why: Look at two scenarios, Scenario #1: The security of your Strong, high-entropy password. Scenario #2: The security of all the n00b's weak passwords. Then, look at two options: Option #1: Hashed, no Salt Option #2: Hashed + Salt. In Scenario #1 - your password is secure in Option #1, because your password does not appear in a rainbow table. In Scenario #2 - the vast majority (60%+) of those weak passwords can be brute forced with sophisticated dictionary attacks in a couple days even with a hash+salt - no need to use rainbow tables. Ironically, Salt's offer no security for you (you don't need them), or the vast majority of people (whose password will be broken, even if they are salted+hashed). Salts+Hash were relevant from 1990-2010, prior to high speed GPUs and ASICs overtaking Rainbow Tables. People learned lessons then, that are no longer relevant. Now, where Salts ARE important, is with a multi-iteration key-derivative function like bcrypt or scrypt. There, a salt (which is part of the bcrypt and scrypt algorithm) actually does offer (a lot) of security to the n00bs. Without salts scrypt/bcrypt would once again tip the balance back in favor of Rainbow Tables. But, of course, scrypt/bcrypt are inherently salted. But your high-entropy password is safe regardless. As always, http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- kouiskas 13y agoThey were using and probably are still using unsalted MySQL 4.1+ PASSWORD() https://news.ycombinator.com/item?id=5677550 https://news.ycombinator.com/item?id=5677550
- nadaviv 13y agoThey mentioned they're using bcrypt in the comments: http://www.name.com/blog/general/2013/05/we-got-hacked/#comment-892589869 http://www.name.com/blog/general/2013/05/we-got-hacked/#comm...
- kouiskas 13y agoThey're lying or confused, the data I have is definite proof. 9gag's password and ours were hashed unsalted with MySQL's PASSWORD(). I'll reply on that comment.
- nadaviv 13y agoHe seems to be correct. Here's the comment with more information: http://www.name.com/blog/general/2013/05/we-got-hacked/#comment-895686755 http://www.name.com/blog/general/2013/05/we-got-hacked/#comm...
- aidos 13y agoI think we all need to accept that once we've given a password to a website it's compromised. It does not matter how they protect it - it's no longer safe. If someone has walked in to their website and taken our information, it doesn't matter which hashing scheme they've used. It's no longer important. Assume that any password you ever give out is gone. Be prepared to change your password / key on a site at any time. Mine are 26 character keys I don't know and will change as required (or leave a service that loses them).
- aroman 13y agoSo where and how do you store these passwords which you don't know?
- neilc 13y agoUsing a password manager like 1Password.
- aidos 13y ago1password for me. You can choose whatever you want though. Write them on a piece of paper you keep in your pocket if that works for you. Whatever you do, don't reuse them between services. It's just a matter of time before someone loses them and all your accounts are wide open. In an ideal world we wouldn't use passwords anymore. But right now we have no choice so we have to do whatever we can to mitigate our eventual compromised accounts.
- rmrfrmrf 13y agoKeePass
- FajitaNachos 13y ago1password here too. Previously used lastpass, and for me, 1password is so much better.
- rmrfrmrf 13y ago> And also whether "hashed" means salted and hashed or just simply hashed. That really doesn't make that much of a difference anymore, given the fact that it's known information that's easily parseable. Rainbow tables are really just a quick convenience, but it's not like there aren't programs that can automate the process of getting and appending the salt to a password string and then just brute forcing. Even with something like bcrypt, you're still working against 1) infinite time and 2) users who don't understand how dangerous a weak password is.
- deleted 13y ago[deleted]
- sluu99 13y agoI emailed them and got this as a response: http://cl.ly/image/3R1R3e2i1h0s http://cl.ly/image/3R1R3e2i1h0s
- gmanley 13y agoHere is an excerpt from the email I received from them: "Name.com recently discovered a security breach where customer account information including usernames, email addresses, and encrypted passwords and encrypted credit card account information may have been accessed by unauthorized individuals. It appears that the security breach was motivated by an attempt to gain information on a single, large commercial account at Name.com. Name.com stores your credit card information using strong encryption and the private keys required to access that information are stored physically in a separate remote location that was not compromised. Therefore, we don't believe that your credit card information was accessed in a usable format. Additionally, your EPP codes (required for domain transfers) were unaffected as they are also stored separately. We have no evidence to suggest that your data has been used for fraudulent activities. As a response to these developments, and as a precautionary measure, we are requiring that all customers reset their passwords before logging in. If you use your previous Name.com password in other online systems, we also strongly recommend that you change your password in each of those systems as well." Based on their suggestion to change your passwords on other online services using the the same password one could assume that there is a good chance they could be decrypted. On the other hand they could just be overly cautious. In any case I agree it would be nice if they could divulge more information on the encryption strategies in use.
- Cushman 13y agoPasswords aren't (usually) encrypted, they're hashed. Hashing buys you time, nothing more; if an attacker has a copy of your hash you should treat your password as compromised. Nothing to see here.
- gmanley 13y agoHashed was indeed what I meant. I tend to use the words interchangeably, in error. What I meant to say is the strategies in use can vary quite a bit. Are they using a salt and/or a pepper? Are they using bcrypt or the like? Based on those answers one can usually guess if its feasible to break those in a reasonable amount of time.
- 13y ago
- larrys 13y agoSomeone asked this question on the post so I will answer it I run a registrar (but not name.com obv.). "Hypothetically, what would happen if some bad guys managed to transfer domains? What recourse would there be: would it be dealt with by yourselves, or would the previous owners of the domains have to take legal action against whoever the domains were transfered to?" There is a procedure in place between registrars to cover situations like this. Of course this assumes that the person who has the name stolen knows it has happened and that the proper people are notified fairly quickly. There are many cases where people might not know a domain was stolen (extra domain pointing to another site for example or an unused name) so there is definitely a risk here. But assuming this was discovered right away by the person whos name was taken it could be reversed and transferred back to the losing registrar. Of course all this can be time consuming and there is no guarantee that the registrar that the name was transferred to would act quickly etc. YMMV.
- sweis 13y ago"For the techies who are wondering, the encryption on the credit card information is 4096 bit RSA." Why would they be using RSA to encrypt fields in an internal database, rather than a symmetric algorithm? If they really did use RSA, I'd wager they did not pad it correctly and don't have any authentication.
- tbrownaw 13y agoIt's a Write-Only Memory. The web server can write the credit card info to the database, but isn't able to read (and decrypt) that same info in case it gets hacked. Presumably there is another machine that only does billing and has a much smaller attack surface, which is the only online place with the key to decrypt the card info.
- sweis 13y agoI've seen web frontends that encrypt submitted credit card info with a public key, then had billing backends that re-encrypted with a symmetric key (usually in a HSM). That was strictly for performance overhead and key rotation flexibility. Perhaps name.com didn't care about that.
- kcen 13y agoThat way you can safely put your public key on all of your application servers so that any node can write data, but only allowed nodes can read.
- agj 13y agoHas anyone heard anything from Moniker, or the other registrars claimed to be hacked? I wasn't able to fetch the registrar data from the zine release, and haven't found another source, though it had sounded like HTP obtained root or privileged access on Moniker. I haven't heard anything from Moniker. My trust for them has be waning for a while, and radio silence on this doesn't help -- though I haven't attempted to reach out to their support at all either.
- josephlord 13y agoDon't know about Moniker but Melbourne IT admitted to some breach (although play it down): http://www.theregister.co.uk/2013/05/09/melbourne_it_hacking/ http://www.theregister.co.uk/2013/05/09/melbourne_it_hacking...
- huhtenberg 13y agoThis reads like something written by a marketing/PR team. Not just OK'd by them, but actually authored.
- GigabyteCoin 13y agoName.com: Why did it take you over a month to report the fact that you were hacked to your users if you "give a shit" about us?
- err_badprocrast 13y agoI think they only realized it happened after name.com was mentioned as a hacked site in HTP5. http://www.exploit-db.com/papers/25306/ http://www.exploit-db.com/papers/25306/
- highace 13y agoOr they only chose to do something about it once it was public domain.
- rubbingalcohol 13y agoSo they're either incompetent or really shady. At least they're handling it as well as Linode did.
- deminature 13y agoIt says in the HTP5 release that Linode was placed in an intolerably difficulty situation between the HTP group and the FBI and were not in a position to make a public statement until they were directly instructed to by the FBI.
- tlrobinson 13y agoIf that's the only reason they realized it happened then that's disturbing as well.
- mbreese 13y agoThis is the big problem with their response. All I want to know two things: what they know, and when they knew it. After that, I want to know that they've fixed their problem and that's it. I'm not sure if this answered much.
- MichaelApproved 13y ago“give a shit” This language is such a turn-off. Very few organizations can use that type of flippant language successfully, especially in a serious email like this. Now's not the time to try to be hip or cool. This is a serious issue and the writer should be just as serious. Edit: Their site is down now so here's a copy of their post Many of you received our email or saw online that name.com was hacked. The truth is that it's one of the more painful admissions that can be made on the Internet. We want you to know that when we say that we “give a shit” we truly mean it. In an effort to maintain the open, honest, and transparent reputation we’ve built for ourselves, we’re going to give you the lowdown on what happened and what we did in response. Our security team alerted us that unauthorized individuals had accessed our database. After doing some digging we found that the attack seemed to be geared toward a few specific accounts. The hackers had a target and name.com was a means to that end. The information that was accessed includes usernames, passwords, physical addresses, email, hashed passwords and encrypted credit card data. EPP codes (required for domain name transfers) are not stored in the same place so those were not compromised. For the techies who are wondering, the encryption on the credit card information is 4096 bit RSA. Since the password hashes were compromised we took proactive steps and initiated a site-wide password reset (hence the email, apologies for the inconvenience). We are genuinely sorry for the annoyance and the scare. We’re taking this incredibly seriously and are doing everything possible to continue to improve the security of our systems. We greatly appreciate the support across the web and over the phones.
- Mz 13y agoI agree. I am prone to "swearing like a sailor" but in public (including the internet), I try to keep it pg-13-ish most of the time. Even on my personal blog, where some folks think I say waaay too much about my (lack of a) sex life, I try to limit the swearing. If I can figure out that this does not make a good impression, one would hope that "business people" could too (though perhaps not). (Also, fwiw, I am grossed out by casual references to poop, no matter how nicely they say it, but especially when using the S word. I am very prone to F bombs, but, then, I actually like sex. But references to poop have me envisioning it. No thanks. Ick. Y'all are disgusting. And, though perhaps not the norm, I am probably not the only person who dislikes having images of poop forced upon them, even if others don't necessarily have the quirk of finding it more offensive than the F word.)
- lm741 13y agoThis seems like a good time to remind everyone how easy it is to upgrade to scrypt. Also, if you just wrap your current hashing scheme, you don't even have to bug your users to update their passwords. https://gist.github.com/cagerton/5485241 https://gist.github.com/cagerton/5485241
- pyre 13y agoWhat does scrypt offer over bcrypt? The only difference I seem to recall is that scrypt is more memory-intensive (making it so that the CPU/GPU/whatever isn't the only bottleneck).
- tptacek 13y agoscrypt is designed to be difficult on hardware. Both bcrypt and scrypt are currently difficult on GPU hardware, but it's unlikely to remain that way. Both are better than PBKDF2. scrypt is likely to be better longer. But really: throw a dart at any of the three of them.
- jplewicke 13y agoIt sounds like one of the Bitcoin alternatives is scrypt based, and they are putatively getting a roughly 10x speedup from GPUs: https://en.bitcoin.it/wiki/Litecoin#Scrypt_Proof_of_Work https://en.bitcoin.it/wiki/Litecoin#Scrypt_Proof_of_Work . Is that a new development, or is it in the neighborhood of how GPU-resistant it was supposed to be?
- JoachimSchipper 13y agoThe Litecoin guys just set the "make GPUs suck" (aka "memory use") parameter too low.
- jplewicke 13y agoThanks!
- cmstoken 13y agoHere's the cache: http://webcache.googleusercontent.com/search?q=cache%3Awww.name.com%2Fblog%2Fgeneral%2F2013%2F05%2Fwe-got-hacked%2F&aq=f&oq=cache%3Awww.name.com%2Fblog%2Fgeneral%2F2013%2F05%2Fwe-got-hacked%2F&aqs=chrome.0.57j58.971j0&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Awww.n...
- deleted 13y ago[deleted]
- clemc 13y agoHackerNews effect - got hacked + servers down with the traffic?
- MichaelGG 13y agoThis is a registrar that, if you use their DNS service, refuses to return not found records and instead serves up ads, on your domain. That's cheesy thing to do. I had started to move some domains to them from GoDaddy, found out about it, contacted them to see if they can remove it, and was told off.
- Spearchucker 13y agoI'd like very much to know how they got hacked. All the talk of 4096 bit RSA and security is great, but how did the database get compromised?
- kevcampb 13y agoThey've clearly omitted the line “the private key was stored securely on a separate system which was not compromised” after the statement about card data and RSA. I'd go as far as to suggest that was deliberate.
- kevcampb 13y agoThey've clearly omitted the line “the private key was stored securely on a separate system which was not compromised” after the statement about card data and RSA. I'd go as far as to suggest that was deliberate.
- rlf 13y agoFWIW, I like name.com. I've been with them for around five years and have always had good customer service experiences. If I need help or have a question, it's very easy to get a human being on the line. In fact, one time, the rep spent fifteen minutes or so explaining the whole domain name expiration process. Yea, I'm not happy they were hacked but I think they're trying to do right by their customers.
- L0j1k 13y ago"the encryption on the credit card information is 4096 bit RSA." This language, however, is awesome.
- deleted 13y ago[deleted]
- pentarim 13y ago3 days after HTP supposedly hacked linode (and name.com in the process), name.com suddenly "give a shit" and did "an effort to maintain the open, honest, and transparent reputation". I do wonder if this would be made public at all without HTP announcement made.
- deleted 13y ago[deleted]
- pi18n 13y agoName.com isn't opposed to doing a little hacking of their own, on the DNS responses. I'm glad a despicable company got hacked, but I do feel empathy for their customers--both because of the hack and because they have a malicious registrar.