Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Weebly hacked, 43M credentials stolen

techcrunch.com

Post reply on HN
Print view View original

81–90 of 99 posts

Re: Weebly hacked, 43M credentials stolen

#81

Post by SixSigma »

dsacco wrote: post #51
Puts wrote: post #48

Earlier quoted context omitted.

I'm kind of tired of the "Security is hard, every one gets hacked eventually and we are just victims" mentality. This is not true. Why don't we see peoples banking information plastered over the web every month? That if something would be a high value target. No, it's always these Web 2.0 services this happens to. Now, you could argue that a small SAAS service can not possibly afford security as rigorous as a bank, b…

I invite you to research this topic more thoroughly. First, while there is a recent uptick in breaches, newsworthy ones do not happen every month. There does appear to be something of a clustering effect, which I think is attributable to a number of different causes. [1] Second, banks, even very large ones like Citigroup and Chase, have been compromised in recent memory. [2] Even the IRS suffered one of the largest b…

They kept the usernames in the clear. It is possible to create a service that never stores usernames but only hashes of them too. Keep an email linked to that account for a reset of the username / password combo.

Then breaches only reveal emails and a pair of hashes, so to control the account you need to control the email.

Re: Weebly hacked, 43M credentials stolen

#82

Post by bengale »

SixSigma wrote: post #81
dsacco wrote: post #51

Earlier quoted context omitted.

I invite you to research this topic more thoroughly. First, while there is a recent uptick in breaches, newsworthy ones do not happen every month. There does appear to be something of a clustering effect, which I think is attributable to a number of different causes. [1] Second, banks, even very large ones like Citigroup and Chase, have been compromised in recent memory. [2] Even the IRS suffered one of the largest b…

They kept the usernames in the clear. It is possible to create a service that never stores usernames but only hashes of them too. Keep an email linked to that account for a reset of the username / password combo. Then breaches only reveal emails and a pair of hashes, so to control the account you need to control the email.

What is that going to do, the outcome is the attacker still has the password hash and the linked email address?

Re: Weebly hacked, 43M credentials stolen

#83

Post by scurvy »

lrvick wrote: post #55

I have talked to a number of current and former Weebly employees trying to convince them to use things like hardware token based 2FA, hardened servers, hardened workstations, and strong end to end encrypted password management that can't be trivially decrypted from a private key stolen from memory. I had such things written off as being too paranoid when they are too easy -not- to set up. I was not at all shocked by…

How do you know if any employee passwords were stolen? How do you know it wasn't just a basic application exploit?

How do you know Weebly doesn't do the things you mentioned?

Fact is, you don't and that post was just an ad for your "services" in the form of a thinly veiled critique.

Re: Weebly hacked, 43M credentials stolen

#84

Post by SixSigma »

bengale wrote: post #82
SixSigma wrote: post #81

Earlier quoted context omitted.

They kept the usernames in the clear. It is possible to create a service that never stores usernames but only hashes of them too. Keep an email linked to that account for a reset of the username / password combo. Then breaches only reveal emails and a pair of hashes, so to control the account you need to control the email.

What is that going to do, the outcome is the attacker still has the password hash and the linked email address?

So how do they log in without a username & password ?

Re: Weebly hacked, 43M credentials stolen

#85

Post by jc4p »

sroussey wrote: post #49
jc4p wrote: post #19

Earlier quoted context omitted.

Perhaps I should've gone in more detail. I'm not upset about them wanting people who are proficient in git, I'm saddened that the job listing doesn't mention anything about what a Senior Android Developer does at Weebly. The only Android related things on the job listing are proficiency with the IDE (Android Studio) and generic "frameworks". I am an Android engineer, I clicked this job listing earlier today when it w…

What are your suggestions?

I wrote a post about this a while back: http://kasrarahjerdi.com/2016/08/on-developer-hiring/

Basically I like job listings that include _specific_ information about the role at the company. Maybe that means listing some of the hard challenges the other people on the team have worked on recently, maybe it just means listing the frameworks and libraries they're using, but anything to help me differentiate their Android role from someone else's Android role.

Re: Weebly hacked, 43M credentials stolen

#86

Post by tptacek »

SixSigma wrote: post #81
dsacco wrote: post #51

Earlier quoted context omitted.

I invite you to research this topic more thoroughly. First, while there is a recent uptick in breaches, newsworthy ones do not happen every month. There does appear to be something of a clustering effect, which I think is attributable to a number of different causes. [1] Second, banks, even very large ones like Citigroup and Chase, have been compromised in recent memory. [2] Even the IRS suffered one of the largest b…

They kept the usernames in the clear. It is possible to create a service that never stores usernames but only hashes of them too. Keep an email linked to that account for a reset of the username / password combo. Then breaches only reveal emails and a pair of hashes, so to control the account you need to control the email.

It is possible to do any number of weird things that practically nobody in the whole world, including companies with the best security teams in the world, actually do. Tokenizing email address is indeed one of those weird things.

Re: Weebly hacked, 43M credentials stolen

#88

Post by user5994461 »

MasterScrat wrote: post #78
novaleaf wrote: post #76

Earlier quoted context omitted.

This is also not true, as if they used bcrypt (a key derivation function) the hash is salted, so even users using common passwords are protected against rainbow (lookup table) attacks. as for brute force, yes attackers now know usernames, so can try brute forcing the live sites, or brute forcing each user hash.

I believe he meant the will try the top 100 most common passwords on each account on the website directly, resulting on "82% of users at risk", assuming 82% of users use one of these 100 passwords. Strong brute-force protection (eg block account for exponential times) could mitigate this attack vector.

Why are you guys talking about live site and rainbow table???

The attackers have the salts and the hashes, they can brute force the hashes offline with [ocl]hashcat as they wish.

Top 100 passwords * 43M accounts is only ~4B hashes to compute. We don't know what bcrypt parameters they used but we're probably talking a few hours here, maybe only a few minutes.

Re: Weebly hacked, 43M credentials stolen

#89

Post by sroussey »

jc4p wrote: post #85
sroussey wrote: post #49

Earlier quoted context omitted.

What are your suggestions?

I wrote a post about this a while back: http://kasrarahjerdi.com/2016/08/on-developer-hiring/ Basically I like job listings that include _specific_ information about the role at the company. Maybe that means listing some of the hard challenges the other people on the team have worked on recently, maybe it just means listing the frameworks and libraries they're using, but anything to help me differentiate their Androi…

Great, thanks! The Android team is 2 people currently, so roles in such teams tend to be like roles in much smaller companies, but with a bit more infrastructure and process. I'll pass this around.

Re: Weebly hacked, 43M credentials stolen

#90

Post by lrvick »

scurvy wrote: post #83
lrvick wrote: post #55

I have talked to a number of current and former Weebly employees trying to convince them to use things like hardware token based 2FA, hardened servers, hardened workstations, and strong end to end encrypted password management that can't be trivially decrypted from a private key stolen from memory. I had such things written off as being too paranoid when they are too easy -not- to set up. I was not at all shocked by…

How do you know if any employee passwords were stolen? How do you know it wasn't just a basic application exploit? How do you know Weebly doesn't do the things you mentioned? Fact is, you don't and that post was just an ad for your "services" in the form of a thinly veiled critique.

I have no idea if that was what caused this particular incident, but there was a lot of exposed surface on the table in that area making an attackers job that much easier via those vectors. Employee workstation or credential compromise is one of the most common ways internal assets are stolen. When easy to implement measures are not taken like using hardware tokens to gate access... then I am left to suspect if any of the harder things were done.

As for making an ad for my "services". My company does not provide security services and I am not looking for a job in this space. Pretty happy where I am. I gain nothing from posting this but to promote discussion I feel is important for our industry.

I do however participate in a not-for-profit community I have funded mostly out of pocket for the last 15 years for helping teach better system admin and security practices. If you can even find it, and want to call this an ad for that ... uh, sure.

Post reply on HN