[Owasp-natal] RES: Confirmado hack no Linkedin

Ivanildo Galvão ivanildo em itservices.com.br
Quinta Junho 7 14:25:40 UTC 2012


Com certeza perdeu pontos, desta forma o serviço passa a ter a desconfiança
de todos os usuários.

 

Já mudei a minha senha e penso seriamente em sair alterando em todos os
serviços de redes sociais e e-mails.

 

 

Sds,

 

 

 

 

Ivanildo Galvão

Consultor de Tecnologia

MCP, MCT, MCSA, VSP, VTSP, ITIL V3

Tel. (84) 3201 2146                 | Cel. (84) 9111 8873

 <mailto:ivanildo em itservices.com.br> ivanildo em itservices.com.br    |
<http://www.itservices.com.br/> www.itservices.com.br 

Twitter: @ivanildogalvao 

Descrição: Descrição: Descrição: Descrição:
http://t2.gstatic.com/images?q=tbn:ANd9GcQI4ZEGsNwiYIiYGnywUNOvmUzPmGhH1UHv0
6QxJDjryTCM3ClQOg  Descrição: Descrição: Descrição: Descrição:
http://t2.gstatic.com/images?q=tbn:ANd9GcQFyGrF-fTbBPkpE1F0ZGsmGSb-QEX_75vhf
FhZOlQIVX-Mg0CM  Descrição: Descrição: Descrição: Descrição:
http://www.ctsblackburn.com.au/images/stories/sophos_reseller.gif

APC, IBM, DELL, Fortinet, Citrix, Kerio, Microsoft

 

 

 

De: owasp-natal-bounces em lists.owasp.org
[mailto:owasp-natal-bounces em lists.owasp.org] Em nome de Eduardo Coelho
Enviada em: quarta-feira, 6 de junho de 2012 22:23
Para: Noilson Caio
Cc: owasp-natal em lists.owasp.org
Assunto: Re: [Owasp-natal] Confirmado hack no Linkedin

 

É grave.

 

Merece um alerta, em especial para quem usa a mesma senha para diversos
serviços diferentes.

 

Linkedin perdeu alguns pontos. Usar hash sem salt, veio? Serio? =/

 

 


Atenciosamente,

Eduardo Coelho Lima

>> eduardocoelholima em gmail.com

http://coelho.ithub.com.br





2012/6/6 Noilson Caio <caiogore em gmail.com>

é isso mesmo.




LinkedIn has confirmed
<http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised/>
that some of the password hashes that were posted online
<http://nakedsecurity.sophos.com/2012/06/06/millions-of-linkedin-passwords-r
eportedly-leaked-take-action-now/>  do match users of its service. They have
also stated that passwords that are reset will now be stored in salted
hashed format. 

What is a salt? It is a string that is added to your password before it is
cryptographically hashed. What does this accomplish? It means that password
lists cannot be pre-computed based on dictionary attacks or similar
techniques.

 Password hash with salt example
<http://sophosnews.files.wordpress.com/2012/06/passwordsalts466.png?w=466&h=
204> 

This is an important factor is slowing down people trying to brute force
passwords. It buys time and unfortunately the hashes published from LinkedIn
did not contain a salt.

 60% of LinkedIn passwords cracked
<http://sophosnews.files.wordpress.com/2012/06/linkedin60pc1.png?w=250&h=250
> After removing duplicate hashes, SophosLabs has determined there are 5.8
million unique password hashes in the dump, or which 3.5 million have
already been brute forced. That means over 60% of the stolen hashes are now
publicly known.

We also did some additional testing of commonly used passwords that should
never be used. We started with the list of passwords that the Conficker worm
used <http://nakedsecurity.sophos.com/2009/01/16/passwords-conficker-worm/>
to spread through Windows networks.

All but two of the Conficker passwords were used by someone in the 6.5
million user password dump. The two passwords that weren't found were
'mypc123' and 'ihavenopass'.

Other passwords that we found in the dump include 'linkedin',
'linkedinpassword', 'p455w0rd' and 'redsox'. We even found passwords that
suggest people should know better like 'sophos', 'mcafee', 'symantec',
'kaspersky', 'microsoft' and 'f-secure'.

We will continue to keep Naked Security readers up to date with what is
known as we learn more. 

It is critical that LinkedIn investigate this to determine if email
addresses and other information was also taken by the thieves which could
put the victims at additional risk from this attack.

Special thanks to Beth Jones and Richard Wang from SophosLabs for their hard
work and assistance with this post.








-- 

Noilson Caio Teixeira de Araújo
Linux Professional Institute Certification  2 - LPI000182893
Novell Certified Linux Administrator (CLA) - 10111916
Novell Data Center Technical Specialist

http://ncaio.ithub.com.br
http://br.linkedin.com/in/ncaio
http://www.commandlinefu.com/commands/by/ncaio
http://www.dicas-l.com.br/autores/noilsoncaioteixeiradearaujo.php



_______________________________________________
Owasp-natal mailing list
Owasp-natal em lists.owasp.org
https://lists.owasp.org/mailman/listinfo/owasp-natal

 

-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://lists.owasp.org/pipermail/owasp-natal/attachments/20120607/7982f8a6/attachment-0001.html>
-------------- Próxima Parte ----------
Um anexo não-texto foi limpo...
Nome: image001.jpg
Tipo: image/jpeg
Tamanho: 2147 bytes
Descrição: não disponível
URL: <http://lists.owasp.org/pipermail/owasp-natal/attachments/20120607/7982f8a6/attachment-0002.jpg>
-------------- Próxima Parte ----------
Um anexo não-texto foi limpo...
Nome: image002.jpg
Tipo: image/jpeg
Tamanho: 1817 bytes
Descrição: não disponível
URL: <http://lists.owasp.org/pipermail/owasp-natal/attachments/20120607/7982f8a6/attachment-0003.jpg>
-------------- Próxima Parte ----------
Um anexo não-texto foi limpo...
Nome: image003.png
Tipo: image/png
Tamanho: 4853 bytes
Descrição: não disponível
URL: <http://lists.owasp.org/pipermail/owasp-natal/attachments/20120607/7982f8a6/attachment-0001.png>


More information about the Owasp-natal mailing list