Weebly hacked, 43M credentials stolen • Hacker News Board

Re: Weebly hacked, 43M credentials stolen

#91

Post by wglb » Fri, Oct 21, 2016, 10:00 PM UTC

drusenko wrote: post #41

tptacek wrote: post #39

Earlier quoted context omitted.

Anyone who tells you they're "encrypting" email addresses in their SaaS app is almost certainly describing a cosmetic security feature. Every day of the week and four times and Tuesday I'd prefer the team that spends their marginal dollar on finding the next marginal reflected XSS bug than the one that wastes it on "two-way encryption of email addresses". I don't know what Weebly does for appsec (I've never worked wi…

In terms of appsec, we run quarterly black box pen tests and annual comprehensive white box pen tests with well regarded firms, and have been rotating vendors on a regular basis for diversity. We also do a lot of stuff internally, like regular scanning, and internal sprints focused on vuln detection. We've been doing this for years. That's not to say we're perfect (we clearly are not) but we do take it seriously.

What sort of security training do you do for your developers and other staff.

Re: Weebly hacked, 43M credentials stolen

#92

Post by SCHiM » Sat, Oct 22, 2016, 3:12 PM UTC

nstj wrote: post #87

SCHiM wrote: post #79

Earlier quoted context omitted.

It wasn't swift that was hacked.

Can you elaborate?

The reason this attack became known as the swift hack is because the hackers were able to send messages over the swift network to transfer money around, however this how the system is supposed to operate, it's what the swift network does.

What was hacked was the bank where the messages were sent from.

https://www.bloomberg.com/news/articles/2016-05-26/swift-hac...

If you read the article (any of the articles) the headlines always talk about the 'swift hack' however it was the _banks_ that were hacked (and the article says so), not swift.

Re: Weebly hacked, 43M credentials stolen

#93

Post by novaleaf » Sat, Oct 22, 2016, 3:24 PM UTC

user5994461 wrote: post #88

MasterScrat wrote: post #78

Earlier quoted context omitted.

I believe he meant the will try the top 100 most common passwords on each account on the website directly, resulting on "82% of users at risk", assuming 82% of users use one of these 100 passwords. Strong brute-force protection (eg block account for exponential times) could mitigate this attack vector.

Why are you guys talking about live site and rainbow table??? The attackers have the salts and the hashes, they can brute force the hashes offline with [ocl]hashcat as they wish. Top 100 passwords * 43M accounts is only ~4B hashes to compute. We don't know what bcrypt parameters they used but we're probably talking a few hours here, maybe only a few minutes.

to brute force the top 100 passwords, only the usernames were really required. can easily bruteforce the top 100 passwords on a live site.

you are right that it's now very easy to use dictionary attacks now, on all the credentials offline. and those with super weak passwords will have their accounts compromised.

Re: Weebly hacked, 43M credentials stolen

#94

Post by vonklaus » Sat, Oct 22, 2016, 9:20 PM UTC

unimpressive wrote: post #27

vonklaus wrote: post #22

Earlier quoted context omitted.

I am not trying to start a flame war, just curious why the 2 jokes about Russian hackers being the origin of breaches are being heavily downvoted. I would assume people think they aren't clever or funny, but hopefully not because they disagree that Russia seems to be the catch-all scapegoat right now.

It doesn't matter if people think they're clever or funny, a core tenet of HN is that you downvote cute jokes so that they don't eat all the real discussion like they do on Reddit.

It is a semi-noob illusion that satire and irony-- which underscore & catalyse discussion about relevant and important issues; should be reserved for Reddit. Often, satire is used when it may be difficult to confront an issue directly/the issue itself (or discussion) could be unpopular.

Re: Weebly hacked, 43M credentials stolen

#95

Post by ksec » Sun, Oct 23, 2016, 6:18 AM UTC

I really like Google's Recent Log in Activity and Location. So anyone logging into your account from a Different location, you are automatically notified. But one of the problem with this is that once hacked, it exposed your location as well.

2nd thing is 2FA. I hope 2FA becomes the standard for all login. Even SMS. ( I know SMS is not save in US, but I am not sure if similar can be said in EU or Japan )

Re: Weebly hacked, 43M credentials stolen

#96

Post by unimpressive » Sun, Oct 23, 2016, 6:35 AM UTC

vonklaus wrote: post #94

unimpressive wrote: post #27

Earlier quoted context omitted.

It doesn't matter if people think they're clever or funny, a core tenet of HN is that you downvote cute jokes so that they don't eat all the real discussion like they do on Reddit.

It is a semi-noob illusion that satire and irony-- which underscore & catalyse discussion about relevant and important issues; should be reserved for Reddit. Often, satire is used when it may be difficult to confront an issue directly/the issue itself (or discussion) could be unpopular.

My account is older than yours.

Re: Weebly hacked, 43M credentials stolen

#97

Post by DeAndre222 » Mon, Oct 24, 2016, 1:24 AM UTC

If you are looking for a professional Hacker that is specialized in changing school grades,getting password to Facebook, Instagram ,any email account, Mobile phone Hacking, removal of links from website. Retrieving hack and frozen bank account, His jobs are secured and without trace. contact him at dataoasis247@outlook.com or message us at +1 262 777 8270

Re: Weebly hacked, 43M credentials stolen

#98

Post by bengale » Mon, Oct 31, 2016, 10:19 AM UTC

SixSigma wrote: post #84

bengale wrote: post #82

Earlier quoted context omitted.

What is that going to do, the outcome is the attacker still has the password hash and the linked email address?

So how do they log in without a username & password ?

To your site, they probably don't. But they'll take the email and password and use it elsewhere. You'll have still exposed your customers.

Re: Weebly hacked, 43M credentials stolen

#99

Post by sroussey » Mon, Oct 31, 2016, 11:02 PM UTC

Dolores12 wrote: post #65

matthewmacleod wrote: post #59

Earlier quoted context omitted.

This is silly – the entire process of "Oh, we got hacked. What did they access? Who's been compromised? Better write an email. Better find a channel to send that email, and wait for it to be sent" could very, very obviously take a couple of days. You are unfairly trivialising that.

My point was transactional emails does not hit any spam filters. And since email services tracks how many of emails were opened, i am pretty sure 'we have been hacked' will be opened quite often and will never be in spam folder.

"transactional emails" is a term marketers use, but in reality the email systems do not know the difference. And yes we did get stopped by various ISPs, and yes we did have to get some on the phone.