DailyTech - LinkedIn Passwords Stolen, Posted Online; Lack of Security the Cause

Submit News

Internet LinkedIn Passwords Stolen, Posted Online; Lack of Security the Cause
Tiffany Kaiser - June 7, 2012 4:40 PM

9 comment(s) - last by bug77.. on Jun 9 at 3:04 PM

(Source: abcnews.com)

Over 6 million passwords were posted on a Russian forum online

Business social network LinkedIn was the target of a cyber attack this week where over 6 million passwords were stolen and posted on the Web.

On Monday, about 6.5 million passwords were stolen and posted on a Russian online forum. Some of the passwords were connected to LinkedIn accounts, where security experts believe the hackers obtained the huge list of passwords. Russian hackers are suspected to be behind the cyber attack, but the exact culprits have not been identified.

The hackers posted half of the passwords in a cryptographic code called SHA-1, which is used by companies that have many passwords as a way of hashing them. However, the other half of the passwords were decoded and posted in such a way that they were understandable to humans.

It was discovered that LinkedIn used SHA-1 to hash its passwords, but the problem is that it only used SHA-1 and nothing else. SHA-1 is not effective enough to use on its own because it translates the same text the same exact way each time, meaning that two separate passwords being the word "password" would be hashed the same way. This makes the password easier to decode.

Security experts say that companies should also use salt in addition to SHA-1. Salt serves as an additional security layer by adding a piece of random information to a hashed password. This makes it unique and changes the underlying text so that it's difficult to be decoded.

LinkedIn was not using salt; only SHA-1. Per Thorsheim, chief information security advisor at Norwegian IT company EVRY, said using SHA-1 without salt is "a great risk."

LinkedIn is now seeing the results of this risk, but recently posted a blog entry that said it enhanced its security efforts by hashing and salting current passwords. It's unclear how recent salt was put into place.

So far, no user names have been identified on the list. Many are hoping that the attack was simply a wake-up call for LinkedIn where the hackers have no other intentions beyond posting the passwords. However, if the hack was conducted by professionals, LinkedIn could see much more trouble ahead.

LinkedIn users are being told to change their passwords to avoid further issues. LinkedIn confirmed the hack in a blog post that can be seen here.

Source: CNN

Comments

Threshold

Username
Password
remember me

This article is over a month old, voting and posting comments is disabled

Strange

By bug77 on 6/8/2012 4:12:19 AM , Rating: 2

1. How on Earth do you add a random string to each password? You'd need to store it for further reference so you're right back where you started.

2. How did linkedin add salt to current passwords of they only have the hashes?

RE: Strange

By gtrinku on 6/8/2012 11:27:29 AM , Rating: 2

You can use for example part of the same password, such as the first 4 letters, or a timecode if you're saving account creation date-times in your DB. As for adding the salt, they probably just rehashed the current hashes with a new salt, turning it into 2-step encryption.

Parent

RE: Strange

By bug77 on 6/8/2012 12:14:41 PM , Rating: 2

Ok, so it's not really random, but it's good enough for the job. The second encryption makes sense too, I didn't think of that :(

Parent

RE: Strange

By modulus on 6/8/2012 10:44:51 PM , Rating: 2

Well what we do with passwords is perform SHA-1 on a mash up of:
user's unique identifier + password creation time + password
You are right that you have to store the extra information, but in this case the extra information is useful to have even if it weren't used in the hash generation.

I'm not sure how they could have added salt to current passwords and I don't think it would matter much since the database was already compromised.

Parent

RE: Strange

By bug77 on 6/9/2012 3:04:01 PM , Rating: 2

User name/id is a rather poor choice as it's probably the first thing a hacker will try to append and prepend. Dates or a selection of characters from the user name seem like much better choices.

Parent

Change your Password

By Mitch101 on 6/7/2012 6:52:14 PM , Rating: 3

There is a website out there which you type in your LinkedIn password and it will convert your password to an SHA-1 encrypted key then check it against the cracked passwords.

Before you go running off and do this think about this. They have a list of SHA-1 keys and most likely logons and or e-mail addresses associated with those SHA-1 keys and by you typing in your password to check if its been one of the cracked its possibly going to come back and so NO CONGRATULATIONS! and you breathe a sigh of relief.

Sure that SHA-1 key was not hacked. However what you typed in matches one or more SHA-1 keys and now they know what that password is in SHA-1 form because you just typed it in. Lets say it matched just you. Now they have your password and e-mail or login which you probably use on other websites. Im also sure they will keep a database of those tried passwords and SHA-1 keys for future reference.

RE: Change your Password

By lennylim on 6/7/2012 7:18:04 PM , Rating: 3

Actually, you do not need to give them your password to check. You can just give them the SHA1 hash of your password, generated locally on your machine.

With your password's hash, they could use brute force or a dictionary attack to obtain your original password. They can get your IP address, and from there deduce more information about you to guess your email address (used for LinkedIn login).

The risk is small, but there's definitely still a risk.

Parent

RE: Change your Password

By Varun on 6/7/2012 9:12:07 PM , Rating: 2

If you read the source of the page, it is all client side Javascript, so nothing gets sent to them.

I checked mine, but it doesn't matter anyway because I use Lastpass, so the Linkedin password was unique to that site, and of course I changed my password anyway.

Parent