SydLexia.com - The Forums :: View topic - Gawker, Kotaku, Lifehacker, Gizmodo... etc... HACKED

Joined: Dec 06 2007 Location: Connecticut Posts: 11244

http://gawker.com/5712615/commenting-accounts-compromised-++-change-your-passwords

Quote:

Our user databases appear to have been compromised. The passwords were encrypted. But simple ones may be vulnerable to a brute-force attack. You should change your Gawker password and on any other sites on which you've used the same passwords.

We're deeply embarrassed by this breach. We should not be in the position of relying on the goodwill of the hackers who identified the weakness in our systems. And, yes, the irony is not lost on us. For tips on creating strong passwords, see this post on Lifehacker.

To change your password on Gawker, click your username at the top of the page and choose the "Password" link towards the middle of the next page.

In other words, change your password if you registered with them.

In addition... what the fuck. Why would such a big company treat our credentials so poorly?

I don't know if this will impact Facebook Connect users.

Posted: Dec 13 2010 12:27 am

What info do I need to protect exactly?

If I recall correctly, when I signed up with Kotaku, I picked a user name, a password, and gave them my e-mail address. That's it.

It's not exactly sensitive info like home address, phone number, etc.

Posted: Dec 13 2010 12:31 am

I recently had my Facebook account tell me that someone from Africa logged into my account. That freaked me out and I changed my password.

Then just today, someone logged into my Yahoo e-mail account and sent a link to a website called 'allorsoft' or something to a bunch of my friends in my address book as well as my gmail account (which is how I found out it happened when I logged in there), so I changed my password on that too.

Scary shit, looks like I'm gonna have to check my other online accounts to be safe...

2010 SLF Tag Champ Joined: Jun 07 2006 Posts: 12294

Skynet.

Posted: Dec 13 2010 12:53 am

FNJ wrote:

Skynet.

Holy tities flying jew your right!

Posted: Dec 13 2010 01:40 am

My sister's inability to understand the importance of strong passwords pisses me off. She insists on using a simple password on the family Netflix account (paid for by my mom) so she doesn't have to remember anything complicated. I use 64-character RNG-generated secure passwords with KeePass wherever possible on sites like this, but my sister thinks that's stupid because no one will think to hack my mom's email account. Apparently, according to her, people's accounts are hacked one at a time and only really important people are ever at risk of identity theft.

Posted: Dec 13 2010 01:48 am

The-Excel wrote:

I use 64-character RNG-generated secure passwords with KeePass wherever possible on sites like this

that's fucking hard core... you must play beyblades a lot.

Posted: Dec 13 2010 01:57 am

Only when I had the time.

Posted: Dec 13 2010 02:24 am

Anyone else find it suspicious that Hacker suddenly wants his name changed a few days ago and now this happens? Sounds like someone was trying to remove himself as much as possible from the scene of the crime. But you failed to take into account that Detective Sideway was on the case!

Joined: May 22 2008 Location: Goshen, VA Posts: 6544

I seriously don't know what any of those sites are.

Posted: Dec 13 2010 06:53 am

The-Excel wrote:

I use 64-character RNG-generated secure passwords with KeePass wherever possible on sites like this,

While your sister is a bit silly, you're just as silly in my opinion going way over to the other extreme. A 64 character randomly generated password is a bit much.

Posted: Dec 13 2010 10:23 am

I got this e-mail, as presumably everyone else did who was hacked. I assumedit's from the hackers, as I got it at both e-mail addresses I had signed up to two of those sites with:

Quote:

Hi there,

Hint wanted to let you know that your email address and password that you used to signup for Gawker (or one of its sites) were hacked. Forbes' coverage is here

In situations like this, time is of the essence, which is why we were surprised & shocked to find that Gawker Media hadn't taken the initiative to notify you of this privacy breach immediately. We HIGHLY recommend you change all of your online passwords as a precaution.

-The Team at Hint

(This is a one time email)

Posted: Dec 13 2010 11:53 am

Methid Man wrote:

I recently had my Facebook account tell me that someone from Africa logged into my account. That freaked me out and I changed my password.

I had the same thing happen to me only instead of Africa, it was Florida...

Posted: Dec 13 2010 11:55 am

I had my Facebook temporarily frozen because someone was using it to send out invites to FREE PS3 events. I reauthenticated and changed my password. It was a pain in the ass.

Joined: Dec 06 2007 Location: Connecticut Posts: 11244

Incase anyone was unaware, the following sites all use the same set of credentials:

gizmodo.com, kotaku.com, lifehacker.com, gawker.com, jezebel.com, io9.com, jalopnik.com, deadspin.com

If you have an account at any of those sites, it was compromised.

Knyte wrote:

What info do I need to protect exactly?

If I recall correctly, when I signed up with Kotaku, I picked a user name, a password, and gave them my e-mail address. That's it.

It's not exactly sensitive info like home address, phone number, etc.

If you were smart enough to use a unique password for Kotaku, one that is used no where else on the web, then you should change the password on Kotaku and you have nothing else to worry about.

The hackers were able to find the following information:
* Email Address
* Password
* Username

Many people use the same credentials across multiple accounts on the web. This is a bad idea, but so is doing drugs... doesn't seem to stop people.

The most common hack that could be used is the combination of the email address and password to login to a person's email account. If that email account was used to register other sites, it could be used to steal a person's identity.

This is all contingent on the concept that people, in general, are not wise enough to use different passwords all over the web.

Knyte, if I had to bet, I would guess that you are probably safe because you are alert and aware of these concepts. I would however assume that at least 80% of the Sydlexia.com population would use the same password for this website as they would on Kotaku and their email.

Updated Post: http://lifehacker.com/5712785/

Joined: Dec 06 2007 Location: Connecticut Posts: 11244

So... was your account hacked?

Lets find out:

1. First go to this website and get the MD5 hash of your full email address:
* http://pajhome.org.uk/crypt/md5/
* Just type your full email address into the input and click the MD5 button.
* Copy the MD5 hash

2. Go to this website:
* http://www.google.com/fusiontables/DataSource?dsrcid=350662
* In the view menu select "Filter"
* Switch the dropdown from Domain to MD5
* Paste the MD5 hash from step 1 into the blank text box to the right of the =
* Click the Apply button

3. Did your domain pop up? Yes? Well you were hacked.

Posted: Dec 13 2010 12:22 pm

I have a set of about 6-8 passwords I use on various sites. I couldn't remember my Kotaku or Gawker logins, so I had to do password resets via e-mail address to get them. So I don't know what my passwords were on them. So I changed all my major passwords to new stuff.

I use my catch-all addresses when I register for other sites. So they won't be able to hack my e-mail address, as there is no password associated with those addresses. I did change my e-mail password anyway though, just in case it was the same as my Kotaku one.

If they really want, they may be able to take over my accounts on a bunch of forums I forgot I registered for.

Joined: Dec 06 2007 Location: Connecticut Posts: 11244

Yeah... there are two listings for Sydlexia.com

Title: Titlating Joined: Dec 17 2007 Posts: 5042

Well I guess thank goodness for the awkward inconsistent facebook connect.

Joined: Dec 06 2007 Location: Connecticut Posts: 11244

Optimist With Doubts wrote:

Well I guess thank goodness for the awkward inconsistent facebook connect.

For its messy implementations all over the web, it does have some advantages.

2010 SLF Tag Champ Joined: Jun 07 2006 Posts: 12294

So I guess alot of you guys attended my "end of the Internet" facebook event.

Posted: Dec 13 2010 10:32 pm

Pandajuice wrote:

The-Excel wrote:

I use 64-character RNG-generated secure passwords with KeePass wherever possible on sites like this,

While your sister is a bit silly, you're just as silly in my opinion going way over to the other extreme. A 64 character randomly generated password is a bit much.

Some other sites agree and don't let me use such excellent security. For those, I have to use 48-character passwords.

Posted: Dec 14 2010 06:59 am

I sure am glad I never signed up to any of those sites.

Posted: Dec 14 2010 01:42 pm

Pandajuice wrote:

I sure am glad I never signed up to any of those sites.

Me 2

Posted: Dec 14 2010 03:39 pm

Navy/Government Websites are serious about Password building, which is understandable.

14-18 Characters.
2 Upper Case
2 Lower Case
2 Numbers
2 Special Characters

If you reset your password, you cannot use any of your previous 10 passwords.
Your password also expires every month and must be recreated.

I find it annoying but I can see why it's needed.