Posts tagged Leaked
Mozilla Passwords Leaked, No Reason to Panic
Dec 28th
A database containing 44,000 usernames and password hashes associated with accounts registered on the Mozilla add-ons website was accidentally made public, the organization and makers of the Firefox Web browser said on Monday. The partial database of user accounts was mistakenly left on a Mozilla public server, which would have allowed anyone to access the account usernames and the password hashes.
The good news? Says Mozilla: no one did. Well, no one except for the one security researcher who found them.
Sponsor
According to a post on the Mozilla security blog, a security researcher reported the issue via Mozilla’s web bounty program, a program that encourages external, non-employee security professionals to find and submit bugs to Mozilla. In return, Mozilla pays cash ($500 to $3,000 for valid bugs) for the submissions. Although Mozilla isn’t saying, this is probably one of those $3,000 dollar rewards.
This news comes on the heels of another high-profile password breach – the mid-December hacker attack on Gawker Media’s servers, which ended up exposing the usernames and passwords of 1.3 million user accounts, creating for commenting purposes on popular weblogs like Gawker, Gizmodo, LifeHacker, Kotaku, io9, Jezebel and others.
How Were the Passwords Protected?
Like Gawker’s passwords, which were poorly encrypted using DES encryption, an older, less secure technology, Mozilla’s passwords in this instance were protected with MD5 hashes, another older method of protection. These passwords can be cracked, explains Chester Wisniewski on the Sophos security blog. “MD5 has cryptographic weaknesses that permit creation of the same hash from multiple strings,” he says. “This permits security experts to compute all the possible hashes and determine either your password or another string that will work even if it is not your password.”
Mozilla hasn’t used MD5 since April 9, 2009 – it now uses SHA-512, a significantly stronger encryption method. The database in question, however, housed older, inactive accounts using the MD5-hashed passwords.
What’s Being Done
To address the issue, Mozilla says it erased all the MD5 passwords, effectively disabling the accounts.
Chris Lyon, Director of Infrastructure Security for Mozilla says “the issue posed minimal risk to users,” because the only person according to Mozilla’s logs, who accessed the database was the security researcher who reported the problem. Lyon also reassured users that the incident did not impact any of Mozilla’s infrastructure.
While the risk may be minimal, Wisniewski suggests that anyone contacted by Mozilla as having been one of the unfortunate users whose account information was exposed should make sure they are not using that same password at other websites, just in case. If so, change those passwords immediately. “If [Mozilla is] wrong or if the discloser is not trustworthy, your other accounts may be at risk,” he says.
View full post on ReadWriteWeb
Wikileaks’ Leaks Leaked: Norwegian Paper Has All the Cables and None of the Restrictions
Dec 22nd
Norway’s largest newspaper, Aftenposten, claims to have access to all 250,000 of Wikileaks’ diplomatic cables. Until this point, no news organization had more than a sample sent by the whistle-blower organization.
Norwegian business publication Dagens it reported the claim today. Aftenposten editor Ole Erik Almlid refused to explain who had leaked the leaks, but BoingBoing theorizes, “one guess could involve the database being stored on a server within Norway.”
Sponsor
Unlike The New York Times, El Pais, The Guardian, Le Monde and Wikileaks’ other media partners in past leaks, Aftenposten has no agreement requiring the organization’s sign-off prior to publishing the leaks, said Almid.
“We have worked long to get the documents, but it would be wrong of me to tell who is the source. We have not paid for the material, which we have gained access to no conditions. It is we who decide what to publish and how we should handle it.”
All bets are off, in other words, and control is out of the hands of Wikileaks. Given Wikileaks’ abiding dedication to information control, you have to wonder three things.
- How many more leaks (of these leaks and others) will happen?
- How will they effect what Wikileaks does in the future?
- How will it complicate the relationships, both partnerships and antagonisms, that have flowered around these leaks?
How many stories are likely to issue from the leaked leaks is uncertain, as is the timeline for their release. But we anticipate a great interest at news organizations around the world in “that one intern from Tromsø.” Hold on to your hat, Vebjørn!
Longship photo by William Murphy
View full post on ReadWriteWeb
Who Leaked YouTube’s Talks With Next New Networks to The New York Times?
Dec 16th
According to Claire Cain Miller and Brian Stelter of The New York Times, “YouTube, the video site owned by Google, is in talks to buy Next New Networks, a Web video production company, according to two people briefed on the discussions.” Now, who might those two people be?
Click to read the rest of this post…
View full post on Search Engine Watch Blog
Carol Bartz’s Leaked E-mail RE: Yahoo Layoffs
Dec 16th
Following up on our previous story about the latest round of Yahoo layoffs, a copy of an internal e-mail memo from CEO Carol Bartz about the staff reductions has been leaked.
Click to read the rest of this post…
View full post on Search Engine Watch Blog
Search Buzz Roundup: 5/4/2008 – Google AdWords Score Leaked, PageRank Update & Search Conference Debate
Jan 13th
www.SERoundtable.com – In closing our April and moving into May, we had a fairly slow week of search forum news. We discussed how Google leaked AdWords ranking scores, a Google PageRank update and a Sitelink update. We also saw how GoogleBot is crawling less, overall. Court ruled that META keywords are immaterial. Google launched TV ads to every US advertiser. Finally, we chatted about the search controversy between SES and SMX. Congrats to the winner of the Yahoo schwag and good luck …
