Formspring Hacked - 420,000 Password Hashes Leaked 68
wiredmikey writes with news of yet another business suffering a data breach. From the article: "Formspring, the Social Q&A portal ..., admitted to being breached on Tuesday. The compromise led to the loss of 420,000 passwords, forcing the site to reset all member passwords. Mirroring the recent LinkedIn breach, Formspring said that it was alerted to a forum post that contained 420,000 password hashes. Engineers shutdown the service and confirmed the passwords were indeed theirs. In less than a day, an investigation revealed that the attacker(s) had 'broken into one of our development servers and was able to use that access to extract account information from a production database' .... There have been no reported incidents of individual account compromise, but there were reports of Phishing by some users on Twitter attempting to capitalize on the incident."
420,000? (Score:5, Funny)
Re: (Score:3)
420,000? Is that like 100,000 people smokin' the reefer?
More like 420,000 people use(d) something I've never heard of?
I wonder if unknown websites would make up some imaginary accounts and intentionally release them to create buzz?
Its not like there's any penalty for public release of information, and all PR is good PR anyway, so..
Re:420,000? (Score:4, Funny)
More like 420,000 people use(d) something I've never heard of?
Exactly. One of the articles even concludes with
Interestingly, while it gained popularity early on, most users who were reporting that they had received a password reset notice had forgotten they even registered with the service.
Re: (Score:2)
That or they harvested and spammed some 400,000 email addresses using some sort of web promo where you fill in your contact details for a chance to get a freebie.
Network Isolation (Score:5, Insightful)
When are people going to get a clue and do proper network isolation of servers ... especially Database servers. There should be no way to attach to a database from outside network. Production and testing servers should all be on sandboxed networks that don't touch the outside.
Re: (Score:2)
Have you tried telling nigger jokes?
Sure everybody will mod them down to prove how PC and not-racist they are. If anybody is looking they might act offended. But they'll laugh.
Yes, if they're racists.
Re:Network Isolation (Score:5, Interesting)
I'm old enough to have had that very argument during the original SQL slammer infestation and the replies were along these lines:
1) Who cares, security costs money but insecurity is free, or free PR advertising anyway.
2) Thats just one bug, one time, I'm sure its completely secure now
3) Webservers were not originally built to be secure, but they pitifully bolted some security on and no one blinks at putting them bare on the net, so why worry about putting something originally designed to be secure on the net?
4) False sense of security means behind the firewall we'll get owned 10 times more often than if we stay paranoid and keep it on the public "dmz". The eternal crunchy outside and soft chewy inside argument. Who knows more about making a DB secure, a DBA or a firewall dweeb? So lets place it on the net and trust the DBA.
5) 99.9999% of databases getting powned are due to no input sanitizing and buffer overruns and other epic programming fails by those idiot web guys, so we may as well place the mysql server open on the net anyway since the web guys leave the barn door wide open almost all the time anyway.
6) Our hard coded back door password in the webserver executable closed source app is "password" so I think having the server outside is the least of our concerns. (prioritization)
Anybody ever hear anything else thats relevant?
Re: (Score:1)
I'm old enough to have had that very argument during the original SQL slammer infestation and the replies were along these lines: 1) Who cares, security costs money but insecurity is free, or free PR advertising anyway. 2) Thats just one bug, one time, I'm sure its completely secure now 3) Webservers were not originally built to be secure, but they pitifully bolted some security on and no one blinks at putting them bare on the net, so why worry about putting something originally designed to be secure on the net? 4) False sense of security means behind the firewall we'll get owned 10 times more often than if we stay paranoid and keep it on the public "dmz". The eternal crunchy outside and soft chewy inside argument. Who knows more about making a DB secure, a DBA or a firewall dweeb? So lets place it on the net and trust the DBA. 5) 99.9999% of databases getting powned are due to no input sanitizing and buffer overruns and other epic programming fails by those idiot web guys, so we may as well place the mysql server open on the net anyway since the web guys leave the barn door wide open almost all the time anyway. 6) Our hard coded back door password in the webserver executable closed source app is "password" so I think having the server outside is the least of our concerns. (prioritization)
Anybody ever hear anything else thats relevant?
Imagine if the tanker truck driver felt that way about fire safety. Or if electricians felt that way about getting shocked. Imagine if doctors felt that way about using sterile equipment. Or what if your water utility felt that way about making sure the water was potable (morons saying things like "well I mean bacteria are everywhere so why bother right?").
If malicious hackers make this kind of stupidity more painful then at least they're doing SOME good in the world. That's what corporations and soc
Re: (Score:2, Interesting)
Re: (Score:2)
There is a good reason why I'm not hiring you. Ever.
You do shoddy work, and rationalize it.
If your chain of authorities aren't clean, nothing is clean, and you risk all.
Re: (Score:2)
Re: (Score:2)
Referential integrity is important. I know dbas that use the same complex password for all of their tables, triggers, queries, and apps. Tough password. Once broken, everything is omelet. Pass the cheese.
Elemental/atomic security, chain of authorities, referential integrity, are all important. There is a place between where your customer will offer you a "price" for something that you'll take, but it's up to par. If you accept that price and deliver substandard infrastructure, then your guilty of many bad t
Re: (Score:2)
Thanks for coming back with something constructive and thoughtful on top of the snarky comment I thought the previous one might be. I'll give you a little context:
I'm mid 30s and have been self employed as a web programmer* for a year now. My main client (a pub/bar sompany) is a previous enployer from over a decade ago, and they've never, ever been into the idea of the internet and having a presence. I'm self-taught from the age of 8.
So now your alarm be
Re: (Score:2)
* Web programmer: I'm not a "web designer", that seems to be people who can use photoshop and wordpress these days. My main tool is customised gedit, plus GIMP and Blender locally, working on LAMP stacks. Web programmer is the simple way to put what I do to a non-geek, I realise I'm probably offending a bunch of real web programmers here.
Re: (Score:2)
The "right amount" is a nebulous description based on who's context you're speaking from. At about double your age, I've seen systems taken town in front of my eyes, seen incredibly novel attacks and take-downs, and have watched other systems pounded 24/7 until they should have been bleeding on the floor, but they did their job.
Sometimes, you'll find that nothing is foolproof, because fools are so ingenious. That's why diligence counts and efficiency is sometimes sloth or worse: whistling in the dark. Locks
Re: (Score:2)
I'm taking that as the central message here.
Re: (Score:2)
It's why I had to react.
Re: (Score:2)
Anybody ever hear anything else thats relevant?
Yes. "IT Doesn't Matter" (http://www.nicholasgcarr.com/articles/matter.html). The argument that IT is just another commodity that should be purchased as cheaply as possible.
Amusingly, General Motors has apparently now decided that IT matters after all (http://www.itworld.com/it-managementstrategy/285577/gm-set-move-away-it-outsourcing).
Re: (Score:2)
Surely dev occassionally need a copy of the production DB to replicate bugs and so on? You clean out the passwords and emails and so, but probably on the dev server so at some point there's a copy of the production DB in the dev environment.
If you have remote workers then your dev environment needs to be accessible over a VPN or something (and so is touching the outside) - Indian workers are cheap after all.
Re:Network Isolation (Score:4, Insightful)
When are people going to get a clue and do proper network isolation of servers
You apparently read alot about security but haven't done much enterprise administration.
Database servers behind a second DMZ with reverse proxying always look great on paper, and start life out that way but what always happens is there is some "corner case" piece of software which doesn't work with your setup and you need to make an exception. Next, the developer group will explain they've wrote their applications to use "realtime" data and the subset of data you've copied out to the DMZ DB is 6 hours too old. You go to the DB Admin and ask him what it would take to increase the frequency of the Oracle dump and he explains it already takes 6 hours to complete and the dump locks tables so you have to do it at night when Sales and Marketing are not using it. You find out the backups are running after the dump process and the network is quite saturated as it pulls 1500G over the wire to the archive SAN. As a result it takes you another 2 hours to get the subset of data moved out to the DMZ. This whole process takes about 12 hours to run and since you are on the West coast you can't tie up the network or the DB for an additional 2 hours or the Midwest offices can't begin work at 8am. Eventually the boss screams he wants it fixed whatever the cost so someone dual-homes the DMZ database so things can get sucked off the back-end on a separate wire. Sunddenly, developers start using the second nic to connect directly to the DMZ DB but you find out all the added traffic on the second gig nic tops out the old Sun box taking all it's spare CPU cycles with it. The nail in the coffin finally comes in when the AD server in the DMZ is found to have been compromised for over 6 months and has been siphoning data off the Oracle connector to some place in China.
This is why compromises happen and why we can't have nice things like secure database setups.
Re: (Score:1)
You can't have nice things because reality always wins. No matter what you do, your database will somehow be wired to the Internet. That's its purpose.
You can VLAN it, make proxies, make one way push-connections such that you replicate the writable system in realtime to read-only nodes in a special DMZ with just one port open to your application server in its own DMZ that has only a service port open to the webserver.
Bottom line is you just make more hosts to compromise in order to get to the database.
Now
Re:Network Isolation (Score:4, Insightful)
I've run into this before. We've got a DB that's hosted in a "cloud service" then we have idiot supervisors/management that want to do training... so they set all their training accounts to
Username "training1"
Password "training1"
We find out, force them to change it. Next thing we know, they're trying to sick VPs on us... "Why are you making it hard for my department to train?!?! It's only a test server!"
Explaining that it's a duplicate of production doesn't seem to phase them... It's kind of irrelevant which database the hackers get into when they are identical to each other. Calling one "test" is kind of irrelevant from a security standpoint.
Yet another reason to use a variety of passwords (Score:5, Insightful)
And once again we are reminded that using the same password on every site is a terrible idea for just this reason. I know I'm guilty of recycling a generic password on sites I don't care about, but I fear that my family members are even worse. I'd say there's an 80% chance that my family recycles the same password on both social and banking sites.
It doesn't help that many password validation routines choke on spaces. Being able to use a passphrase is way easier than trying to remember some random group of characters that just happen to have a high entropy. The Correct Horse Battery Staple [xkcd.com] model is my new favorite for any site that will accept spaces. Sadly, one bank that I have done business with won't even allow a password that is more than 8 characters and only accepts letters and numbers. They try to shore this up with some bogus security questions on the following page, but I don't feel really "secure."
What other password strategies do you all use to make sure you keep reasonably secure? I eventually gave in to using KeePass to keep my less frequently but more important passwords secure.
Re:Yet another reason to use a variety of password (Score:4, Informative)
Re: (Score:3)
Personally I much prefer serves like pwdhash.
Remember one base password across all sites and it'll convert it into a hash for you, so even if you have a key-logger installed it'll only record the base, and not the hashed one.
Re:Yet another reason to use a variety of password (Score:5, Informative)
Re: (Score:1)
Re:Yet another reason to use a variety of password (Score:4, Informative)
Yep, I love pwdhash. It's portable without worrying about leaving a password database on a thumbdrive or in the cloud, it can generate long, site-unique passwords while using the same base password. Pwdhash is pretty nice in that it is sensitive to stupid websites that don't allow special characters, too - if you put a special in the password you supply, it very likely (but not necessarily) include one in the password it generates. If you don't put specials in the user-supplied portion, the output is just alphanumeric. Of course, there are still the stupid websites that want passwords to be 12 characters or less, and/or have to start with a letter, and/or other asinine rules. A downside though is that there is a maximum length for the passwords pwdhash generates, 22 chars if I remember correctly, but at this point, I don't think that's really an issue.
Still don't recommend actually using the same base password for everything, of course.
The other cool thing about pwdhash (and potentially, similar services too) is that they don't have to be used on websites. You can use it to generate passwords for, say, your wireless. Do something like the SSID in place of the website, then supply your part of the password.
Pwdhash [pwdhash.com]
Re:Yet another reason to use a variety of password (Score:5, Interesting)
I know I'm guilty of recycling a generic password on sites I don't care about, but I fear that my family members are even worse. I'd say there's an 80% chance that my family recycles the same password on both social and banking sites
I have one password for each class of security. Ultra critical life savings depends on it has one which is only used on two sites anyway. Then there's /. and sites like it which has another "I can't lose money, but I'd be pissed if someone stole my account" password. Finally "I can't believe these morons force me to create an account for their cruddy site F those idiots the password for moron sites is password123"
I believe that websites that demand account creation when there is no need to create an account, like to order stuff, or view pages, are a social disease that should be stamped out. Aggressively if necessary. Not because one POS automotive parts site demanding I "create an account" just to make a single item purchase one time in my life is inherently evil, but because making a billion people make hundreds of accounts each, many of which will be stolen IS evil. This is no different than the argument where "if I occasionally accidentally dump out a little used motor oil its no big deal, but if the whole planet dumped all their used oil, it would be a freaking disaster"
Re: (Score:1)
Hey me too! Except at the top level (e.g. banking, email), every site has a unique password. At the lowest level, all the forums and miscellany have the same password.
Re: (Score:2)
The "identity sites" have different password model vs a same password. They are associated with me and my information. It would blow if my account started spamming 5 or 6 forums that I use.
[John]
Re: (Score:2)
Hasn't failed me yet.
Except now when you told publicly everyone about it.
Re: (Score:2)
Sure, why not. Most of the time they're saved in your browser password keeper anyway. I have a similar number of accounts with different levels of passwords. For the 200 or so that I don't go to often, I just check my password database. Not a big deal. I periodically roam through the browser db to make sure I have all mine in the pwdb up to date.
[John]
Re: (Score:2)
All of my banking passwords are the weakest ones. Most of the banking sites will not allow a full alphabet of special characters (American Express only has something like 6 different special characters you can use). I'm like WTF, is this a banking site or not?
Re: (Score:2)
Re: (Score:2)
People need more useful advice then this, because "use different passwords everywhere" is so impractical for most of the public that it's ignored.
More and more I don't think smaller websites like this should even store passwords. Use external authentication providers like Facebook or Google accounts instead. We've seen too many cases where companies that aren't huge don't have security that can stand up, and given budget they never really will.
Re: (Score:2)
The best part about the security questions is the answers are easy to find (in general). What's your mother's maiden name, where were you born, etc are many times easily available. When I have to use those, I pick something totally different from the true answer. Then it doesn't matter which security question I have. I do record them in my password database though :)
[John]
Keepass (Score:2)
I think I figured it out. (Score:5, Funny)
I know it's a Q&A site, but ForumSpring Engineers really shouldn't have answered the question, "How do I hack the ForumSpring servers?"
Re: (Score:3)
Heh, I refer you to A Logic Named Joe [baen.com]. It predicted the personal computer, the internet, search engines, and the real uses which most people would find for them. In 1946. Nineteen. Forty. Six.
Re: (Score:2)
Oh, shiny, time to read.
Bad configuration management (Score:1)
It sounds like bad configuration management. I'm guessing the database passwords are the same for the dev servers as they are for the production servers. Bad, bad, bad...
Could have been worse (Score:2)
The immediate question: (Score:2)
Re:The immediate question: (Score:5, Informative)
The linked SecurityWeek articles includes the quote:
“We were able to immediately fix the hole and upgraded our hashing mechanisms from sha-256 with random salts to bcrypt to fortify security."
Which suggests that they were indeed salting the passwords. Assuming this was actually done, and done in a reasonable manner, then in theory there should actually be little or no risk from this breach I would think. But then I don't know why they would feel the need to immediately replace their hashing mechanism...
G.
Re: (Score:2)
If by "Blowfish" you actually meant "bcrypt", then yes. Blowfish is not a hashing algorithm.
Re: (Score:1)
Salting just defends against precomputed hashes (rainbow tables). Using a slower algorithm such as bcrypt defends against brute force attacks.
Case in point: I cranked through LinkIn's 6+ million SHA hashes using a dictionary of around ~20 million words (not counting JtR's manipulation rules). The total runtime was maybe half an hour. Using bcrypt makes brute force attacks much less practical. It's also good practice to iterate your hashing algorithm, each time feeding the resultant hash as input. Running sh
Am I crazy? (Score:1)
For the love of god (Score:2)