13 ms·
Two million Facebook, Gmail and Twitter passwords stolen
- knownhuman 13y agoWhile technically accurate, the headline seems to allude to direct breaches of Facebook, Gmail, and Twitter.
- powera 13y agoNot even technically accurate. The article says that only 400k of the 2 million stolen passwords were from FB/GOOG/TWTR.
- antsar 13y agoAgreed. And considering the low probability of such a breach, my next assumption was some password storage service being breached. The real story: Personal computers were infected, passwords were keylogged. yawn
- denzil_correa 13y ago57.06% of the passwords stolen were for the Facebook domain. Sigh!
- seiji 13y agoAt least nothing of value was lost?
- dragonwriter 13y agoThe ADP -- a payroll service -- passwords (which, interestingly, aren't in the headline), are probably the ones that, despite being smallest in number, offer the most opportunity for direct financial disruption.
- seiji 13y agoADP is horrible, but their website can't change financial details (it only shows paystubs and tax forms). You can kinda change things through ADP FlexDirect, but all direct deposit enrollment is done elsewhere. The ADP employee site hasn't changed in the past ten years and still uses basic auth. It's horrible. And freaky. When you login to your new company account, it shows all paystubs from your past employers too. [With the implication of your current payroll department being able to see how much you were getting paid at all your previous jobs since it's the same account?]
- brucehart 13y agoDoes anyone know if this is actually the case? I have noticed something similar and I am curious about it. My new employer uses ADP for payroll, but does not use the online system. However I can still log in to the ADP online system using my account credentials from my old employer and get electronic copies of my new paystubs. I would like to know if my old employer has access to these paystubs.
- dragonwriter 13y ago> ADP is horrible, but their website can't change financial details The article here says that the account information that was compromised can. I'm not sure if that is a result of bad reporting on the same level as that related to FTP in the article, or the accounts that were compromised are different than the ones for the website you are talking about.
- seiji 13y agoYeah, it's possible they were HR-level accounts that actually run payroll and not just employee accounts. The more power you wield in an organization the less competent with technology you are.
- dragonwriter 13y agoThat's probably only even roughly true in tech organizations where the low-level folk have tech-related duties. (Though HN users are probably somewhat biased to think in terms of such organizations.)
- sergiotapia 13y agoMisleading headline, makes it seem like these guys were hacked on their servers. When the reality is people spread a virus and passwords were logged from individual machines. No fault from Google or Twitter.
- obituary_latte 13y agoYup. They're talking about the recent spiderlabs report it seems.
- werrett 13y agoThe source is this SpiderLabs blog post: http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-po...
- nathan_long 13y agoWhat platform(s) was the keylogger written for and how was it spread?
- sergiotapia 13y agoGiven the vast amount of passwords farmed, I would say it was targetted for the Windows platform.
- prawks 13y agoIs this really a valid point still? Surely two million is a drop in the bucket in the group of Facebook users accessing via OS X or Windows.
- babuskov 13y agoWindows XP/2003/Vista/7/8 (x32/x64) Apparently this one: http://malware.dontneedcoffee.com/2013/10/jolly-roger-stealer-c-panel.html http://malware.dontneedcoffee.com/2013/10/jolly-roger-steale...
- dullcrisp 13y agoThis makes me wonder, would running WireShark at all times provide some protection from viruses by spooking them?
- codeka 13y ago2 Factor Authentication, 2 Factor Authentication, 2 Factor Authentication! I've had 2 factor authentication enabled on my gmail account for over a year now, and once you get past the initial setup phase, it's really not that inconvenient. I have even been able to train my parents to use 2 factor auth, I just need to get them using a password manager now...
- dba7dba 13y agoI agree. However for people just not interested in tech stuff, teaching them how to use 2 factor authentication is pretty hard. I tried writing out the tutorial for friends but realized it's pretty daunting for regular users. What if Google started charging people (only ones with credit card on file which means they are in place with necessary infrastructure) $5 a year for NOT using 2 factor authentication... I guess I can dream...
- zzleeper 13y agoWhat happens if I'm i) outside the country, so no SMS for me, ii) outside cell tower coverage but with wifi (happens every day for me inside buildings), or I got my cellphone stolen for instance. How does 2fauth works in that case? (Just wondering, as the above are the reasons I decided not to use it)
- blairbeckwith 13y agoAuthentication apps like Google Authenticator or Authy work without any data service of any kind. Most services provide backup codes you can print out and keep in your wallet or another safe spot in case you lose or destroy your device.
- modeless 13y agoYou can print two copies of your backup codes, keep one in your wallet and one at home. You don't have to worry too much about them getting stolen because they are useless without your password. You can also generate a new set of backup codes at any time, which invalidates the old ones.
- rza 13y ago> Facebook, LinkedIn and Twitter told CNNMoney they have notified and reset passwords for compromised users. > The hackers set up the keylogging software to rout information through a proxy server, so it's impossible to track down which computers are infected. Have I missed something or are these statements contradictory?
- awj 13y agoNothing contradictory about it. First statement is about accounts on services, second is about finding the machines used to log into said accounts. The sad part is that many people with this keylogger may react to the password change before/without removing the logger, which would entirely defeat the point.
- steffan 13y agoI found this rather amusing: “Among the compromised data are 41,000 credentials used to connect to File Transfer Protocol (FTP, the standard network used when working from home)”
- staticfish 13y agoEh, I've seen worse technoerrors.
- Raphmedia 13y agoWell, it is a not so wrong vulgarization.
- lurkinggrue 13y agoDoes anybody have a torrent of this? You know... for science.
- owenfi 13y agoI'd like to verify my users are not among those exposed, since we use some of the aforementioned services for single sign on.
- gurvinder 13y ago"File Transfer Protocol (FTP, the standard network used when working from home) " May be at CNN, that is what they use to work from home.
- elwell 13y agoyeah, what the heck??
- krapp 13y agoHN greatly overestimates how dead FTP is.
- sliverstorm 13y agoBut I heard FTP was declared harmful and phased out in 1970?
- krapp 13y agoTell that to my wordpress projects....
- JoshuaDavid 13y agoYou can. Put this line in the config file: define( 'FS_METHOD', 'direct');
- est 13y agoyeah because we had scp and rsync. Hell even dropbox.
- jpwright 13y agoLooks like they updated the article to read "File Transfer Protocol (FTP, the standard network used when transferring big files)". Better, although it's still wrong to call FTP a "network".
- loceng 13y agoI had an unexpected login attempt from Vietnam in this past week. Google blocked it automatically - though it was successful, correctly used password. I wonder if connected..
- wpietri 13y agoUgh. Actually, 410k Facebook, Gmail, and Twitter passwords stolen: 318,000 Facebook accounts 70,000 Gmail, Google+ and YouTube accounts 22,000 Twitter accounts
- mtsmithhn 13y agoSo no details on how to detect if this virus is on your computer?
- kevinchen 13y agoApparently not. I think just wait until Google, Facebook, or Twitter reset your password.
- onemanshow33 13y agoThat is exactly my fear
- Zoomla 13y agoNot as safe as other solutions, but I can remember all my passwords by choosing passwords by website category (6 for example): one low-security sites, one for sites that have your CC #, one for social networking, one for email, one for work, and one for your banking sites. keep a copy in your wallet. Sleep better.
- joshfraser 13y agoIf you use LastPass, this is a good time to run their Security Challenge (https://lastpass.com/index.php?securitychallenge=1 https://lastpass.com/index.php?securitychallenge=1) to audit the strength and uniqueness of your passwords. If you're not using LassPass or something similar like 1Password then today is a good time to fix that.
- Houshalter 13y agoWhat good will that do against a keylogger?
- JangoSteve 13y agoStrength of password won't really help for key logging, but using e.g. Lastpass helps because it logs you into everything without having to type your passwords. It will even generate and fill in your initial passwords so that you never have to type your passwords even once.
- Houshalter 13y agoLastpass doesn't have a password itself?
- JangoSteve 13y agoAh great question. It does, but it usually stays logged in on your computer, since it runs locally. So you rarely if ever need to type your password for Lastpass, meaning the keylogger would have had to be running on your computer when you installed and set up Lastpass. On a related note, it can also be set up with 2 factor auth.
- Houshalter 13y agoPresumably the password is stored to a file or in memory (of course that could be arbitrarily difficult to figure out how to decode, but it can't be encrypted since that would require another password.)
- lcasela 13y agoWas this targeted towards windows?
- babuskov 13y agoWindows XP/2003/Vista/7/8 (x32/x64) Apparently this one: http://malware.dontneedcoffee.com/2013/10/jolly-roger-stealer-c-panel.html http://malware.dontneedcoffee.com/2013/10/jolly-roger-steale...
- mikeishi 13y agoWhich operating systems were affected? It seems like the official report doesn't even contain this critical information.
- babuskov 13y agoWindows XP/2003/Vista/7/8 (x32/x64) Apparently this keylogger was used: http://malware.dontneedcoffee.com/2013/10/jolly-roger-stealer-c-panel.html http://malware.dontneedcoffee.com/2013/10/jolly-roger-steale...
- LizVerano 13y agoScary!
- werrett 13y agoIn case anyone is interested the primary source for the article is the following blog post (it is slightly buried): http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-po...
- cdvonstinkpot 13y agoPage won't display in my mobile browser, so I can't read the story.
- iamabhishek 13y agoi thought hotmail was least secure. But every time passwords are stolen, its always for the Big-3 Social networks. Facebook, Twitter or LinkedIn. This time Gmail joined in. Great !! But then what can you expect from a free service {kidding}
- iamabhishek 13y agoI was wondering, how does these services come to know that they had a breach. How Facebook or Twitter or Gmail, exactly number the amount of data(passwords) stolen. Just curious to know!
- yaix 13y ago> The massive data breach was a result of keylogging software maliciously installed on an untold number of computers around the world Is that a Windows only issue or are other OSes affected?