Gawker Media hacked - 1.3 million user accounts compromised



I don't care what you think about Gawker, it's kind of a dick move to release almost 200,000 people's emails and passwords in plain text.

Lots of people use the same password for everything. People online are saying a LOT of those passwords still work on their email, Facebook, PayPal accounts, etc.

Torrent if any of you want to look at it for..uh..research purposes:
Gawkmedia source code + database release (1,300,000 rows). (download torrent) - TPB

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?
 
machinecontrol said:
I don't care what you think about Gawker, it's kind of a dick move to release almost 200,000 people's emails and passwords in plain text.

Lots of people use the same password for everything. People online are saying a LOT of those passwords still work on their email, Facebook, PayPal accounts, etc.

Torrent if any of you want to look at it for..uh..research purposes:
Gawkmedia source code + database release (1,300,000 rows). (download torrent) - TPB

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?
Click to expand...

Wait, Gawker stores its passwords in plain text? That can't be right.
 
cardine said:
Wait, Gawker stores its passwords in plain text? That can't be right.
Click to expand...

The passwords were stored encrypted, but with a weak/old encryption method that makes them fairly easy to crack.

Of the 1.3 million accounts, the hackers were able to quickly crack about 200,000, which are included in the torrent in plaintext.

There's another textfile of the 2,000+ people whose password is "password". Those are probably the ones using "password" for all their passwords...
 
the readme.txt they include in the .torrent is hilarious.

too bad the Aweber hackers didnt .torrent their dump! lol :)



quote taken from readme.txt
[MySQL Database]

SERVER: 69.60.7.205
USER: root
PASSWORD: m00nsh1n3
PORT:9254

After gaining access to gawkers MySQL database we stumble upon a huge
table containing ~1,500,000 users. After a few days of dumping we
decided that 1.3 million was enough.

Gawker uses a really outdated hashing algorithm known as DES (Data Encryption Standard).
Because DES has a maximum of 8chars using a password like "abcdefgh1234" only the
first 8 characters "abcdefgh" are encrypted and stored in the database. If your
password is longer than 8 characters you only need to enter the first 8 characters
to log in!

YA DONT SAY!! :D?

Because of this we were only able to recover the first 8 characters of someones password!
If the password is 8 characters long there's a good chance that it migt be longer
than 8 characters! But still, there's 1000's of people using 1 - 8 character passwords
for us to have some fun with!

We managed to crack ~200,000 hashes, if you want the rest of them cracking
DO IT YOUR FUCKING SELF! >:3

Here's a quote of encouragement for gawker users from Scott:

"We'll continue to look into this, but as I commented on your site earlier, we have no evidence that any of our readers' user accounts/passwords have been compromised. They are not stored in plain text and are on entirely different systems than the third-party hosted Campfire screenshots that appear in this article.
There's no evidence to suggest any Gawker Network user accounts were compromised, and passwords are encrypted (not stored in plain text) anyway, so stealing passwords isn't even possible."

Here's a handfull of interesting hashes from the other associated blogs.
Some maybe fake/spam accounts, can't be bothered to test them all.
Click to expand...


We might as well help you rm -rf those files from the server because after
this your not going to want a server ever again!
I guess you wont be needing those backups either so we'll go right
ahead and help you clean that shit up!
No need for users either so we might aswell DROP that juicy MySQL database too!


YOU CAN THANK US LATER! <3
_
Click to expand...

You would think a site that likes to mock people, such as gawker,
would have better security and actually have a clue what they are
doing. But as we've proven ,those who think they are beyond our reach
aren't as safe as they would like to think!


We've not done yet, we have other targets in our sights, you will all soon realise that
nothing is sacred on the internet, we can get to each and every one of you and expose
your so called "security" and expose you for the faggots you are!
Click to expand...
 
danny said:
2,000 out of 1.3 million not bad. Used to be 10% or so from AOL lobbies.
Click to expand...

lol did you ever use pharming software? You could just suck all of the keywords out of peoples member profiles and try them as their password.

Lots of "soccer" "fishing" "guitar" type passwords.
 
cardine said:
Wait, Gawker stores its passwords in plain text? That can't be right.
Click to expand...

From my (PROBABLY WRONG) understanding:

Gawker stored the password as hash values, not plaintext (good).

They were using the Unix crypt function, which uses 56-bit DES and only hashes the first 8 characters of the password and stores that. (bad)

So if your password were 123456789, you can just log in by typing 12345678 as the password (lol), because the algorithm would generate the same hash for both values.

Since there are a limited number of possible passwords that are 1 to 8 characters long, you can brute force every possible combination and generate a hash for each possible password between 1 to 8 characters with modern hardware. Also because they either didn't use a salt, a static salt value, or a predictable salt value for each user, it makes it easy. Then you just query the db for that hash.

That results in getting a plaintext password.

If it works out that way, they can only get the first 8 characters of the password, so people using longer passwords would be safe.
 
Damn, I feel for the people that had their emails/passwords put out there. It's not like Gawker is a fly-by-night operation, people wouldn't expect their information to be released from them.

Relevant Image:
password_reuse.png
 
machinecontrol said:
I don't care what you think about Gawker, it's kind of a dick move to release almost 200,000 people's emails and passwords in plain text.

Lots of people use the same password for everything. People online are saying a LOT of those passwords still work on their email, Facebook, PayPal accounts, etc.

Torrent if any of you want to look at it for..uh..research purposes:
Gawkmedia source code + database release (1,300,000 rows). (download torrent) - TPB

So which one of you vultures will be the first to spam the entire list with a bizopp or zip submit?
Click to expand...

That torrent link is dead and no results come up on TPB or Demonoid for "gawker", "gawkermedia", etc.
 
Those that are using the same pass across multiple sites deserve what comes to them. It's not hard to install one of the many password managers out there.
 
You must log in or register to reply here.
Top Bottom