2.5 Million Xbox and PlayStation Gamers' Details Have Been Leaked From Piracy Forums (thenextweb.com) 36
Xbox360ISO.com and PSPISO.com have been hacked by an unknown attacker in late 2015 and the details of the 2.5 million users affected have been leaked online. The leaked information contains email addresses, IP addresses, usernames and passwords. The Next Web reports: It seems that the operator of these sites did nothing to protect the latter, as all passwords were "protected" using the MD5 hashing system, which is trivially easy to overcome. For reference, that's the same hashing system used by LinkedIn. As the names of these sites imply, they were used to share pirated copies of games for Microsoft and Sony's gaming platforms. They also both have a thriving community where people discussed a variety of tech-related topics, including gaming news and software development. If you think you might have had an account on these sites at one point, and want to check if you were affected, you can visit Troy Hunt's Have I Been Pwned. If you have, it's worth emphasizing that anyone who gained access to that site, and anyone who has since downloaded the data dump, will be able to discern your password. If you've used it on another website or platform, you should change it.
Creds leaked... (Score:3)
From this totally wholesome-on-the-up-and-up site. Color me surprised. This is why we use throw away email addys for this sort of thing kids.
How interesting! (Score:2)
It took me to the "Have I been Pwned?" site
NONONONONONONONONONONONONO!!!!! Do not fucking do this Slashdot! This is not funny! This is not appropriate. You want to take me to another website after clicking on white space? What the sleazy clickbit malware satan in hell are you doing?P NO! Bad Slashdot! Evil Slashdot. Stop it. This will not do. We are not amused.
Other than that, I have no strong fe
Re: (Score:2)
Agree, but I'd start closer to home: if, like me, you're dumb enough to browse Slashdot with no ad-blocker, the 'Sponsored Links' shown on the homepage are as scummy as clickbait gets.
Re: (Score:2)
Agree, but I'd start closer to home: if, like me, you're dumb enough to browse Slashdot with no ad-blocker, the 'Sponsored Links' shown on the homepage are as scummy as clickbait gets.
This is weird, as I'm blocking ads, and scripts. They musta found a way around it that needs fixed.
Re: (Score:1)
Gotta love unsubstantiated and unverifiable claims on the internet. "My life is *serious*, man! I have a murderer trying to murder me!"
If someone has "tried to kill [you] a couple of times" why did a "real man" like you have to wait for a woman to take out the restraining order? Wouldn't a "real man" deal with that himself?
Sorry, reads like fantasy/bullshit.
Not a surprise (Score:4, Interesting)
The number of times I have had to explain to customers how to do password storage right is staggering. Most still believe a single hash is enough (well, to be fair, for a high-entropy password it is). Some have at least heard of salting the hash. But as soon as you come to iteration, most are clueless, and if you put in things like a large-memory-property (to prevent brute-forcing by FPGAs and graphics-cards), you have lost them completely. Many people just stop learning when there is no direct need to and these are the same people that in many cases write security-critical software.
On the other hand, PBKDF2 has been available since 2000, packing hashing, iteration and salting in a nice package. And Argon2 now adds large memory and other nice properties and essentially solves the problem. People just seem to be completely unaware of this.
Re: (Score:2)
The number of times I have had to explain to customers how to do password storage right is staggering. Most still believe a single hash is enough (well, to be fair, for a high-entropy password it is). Some have at least heard of salting the hash...
Ah yes, salting. A concept I read about over two decades ago in my O'Reilly SysAdmin book. I agree with you, sure is frustrating when those writing software these days act like good security is some newfangled concept we're still waiting for cold fusion to provide.
On the other hand, PBKDF2 has been available since 2000, packing hashing, iteration and salting in a nice package. And Argon2 now adds large memory and other nice properties and essentially solves the problem. People just seem to be completely unaware of this.
Given the prevalence of humans using 123456 as a "password", it's not that people are unaware; they simply don't give a shit enough to care.
Re: (Score:2)
On the other hand, PBKDF2 has been available since 2000, packing hashing, iteration and salting in a nice package. And Argon2 now adds large memory and other nice properties and essentially solves the problem. People just seem to be completely unaware of this.
Given the prevalence of humans using 123456 as a "password", it's not that people are unaware; they simply don't give a shit enough to care.
Well, my customers come from industries that should care, but yes, that is decidedly one of the roots of the problem.
Doing password storage badly needs to be classified by default as gross negligence and result in severe personal consequences for those that have done it, just the same as gross malpractice. It is regrettable that this may mean formal engineering qualification requirements or the like for people implementing password-handling software, but apparently the industry is completely unable to regul
Re: (Score:3)
Given the prevalence of humans using 123456 as a "password"
That's amazing! I've got the same combination on my luggage!
Re: (Score:2)
It depends.
If it's a user on a forums, "123456" or "password" may be perfectly legitimate to use. I use them on sketchy websites I don't care if the account gets pwned - they get a junk email address and a junk password - big whoop. You want to post as me? Go right ahead since I signed up to log in once and forgot all about it.
If it's the admins, then it's a bigger prob
Clickbait title (Score:3, Insightful)
Worst.
Re: (Score:3)
Yeah it is clickbaity but it's accurate.
Yes the hack was over a year ago but the "news" is that it was made widely available about three days ago.
Wrong Headline (Score:4, Insightful)
2.5 million game pirates had their information leaked from a sketchy ass website over a year ago and now are acting offended someone may steal from them
Headline is completely misleading. I'm done. (Score:3)
MD5 isn't really "trivially easy to overcome" (Score:2)
Re: (Score:3)
The problem lies in not using a salt, not in using MD5.
If a three-digit combination lock protecting a safe needs a bodyguard standing next to it to ensure no one steals anything, then using a shitty lock is in fact the problem, especially since few choose to spice up their recipe when cooking up a security model.
Re: (Score:3)
MD5's weakness lies in it's popularity and therefore susceptibility to rainbow table lookup. There's not a hashing algorithm around you should use without a salt and feel good about in the long term.
Your analogy is dumb.
Much like a 3-digit combination that is unknown to the attacker, MD5's ultimate weakness lies in the speed at which it can be cracked, which today's hardware has proven, irrelevant of the popularity or combinations known by rainbow tables.
And if programmers are going to remain as ignorant as they always have and refuse to add a little salt to their coding diet, then stronger algorithms (stronger locks) are a rather necessary minimum, because convincing them to use a decades-old security bolster sure as shit
Re: (Score:2)
MD5's weakness lies in it's popularity and therefore susceptibility to rainbow table lookup. There's not a hashing algorithm around you should use without a salt and feel good about in the long term.
Your analogy is dumb.
Much like a 3-digit combination that is unknown to the attacker, MD5's ultimate weakness lies in the speed at which it can be cracked, which today's hardware has proven, irrelevant of the popularity or combinations known by rainbow tables.
And if programmers are going to remain as ignorant as they always have and refuse to add a little salt to their coding diet, then stronger algorithms (stronger locks) are a rather necessary minimum, because convincing them to use a decades-old security bolster sure as shit ain't working.
You are correct in that a hash alone does not provide a comfortable security buffer, but that hardly dismisses my analogy.
Do you not know what a rainbow table is? MD5 can't be cracked quickly... The problem with MD5 is that people have been working for decades to crack it and they shared the cracked passwords to the point that it is trivial to take the encypted password "fb8273hbr#@T@(#FJW" and map it to "secret!"
And when a password happens to not exist yet in a rainbow table (thus removing your "popularity" factor), MD5's standing weakness is the fact that modern computing technology allows billions of computations per second against that particular algorithm, which was my entire point. The very existence of rainbow tables tend to prove how weak certain algorithms are, especially against modern hardware.
Outrageous (Score:2)