Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

41–50 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#41

Post by gattilorenz »

wasmitnetzen wrote: post #26
Deukhoofd wrote: post #20

Earlier quoted context omitted.

They explain more here: https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845

So, still a wrong procedure. They should have told everyone to renew their password and view them as compromised in August. Edit: typo

> nothing was leaked in august, we followed the hackers request, secured our services, hired an extra sysadmin, ran extra audits.

Oh yes, what could ever go wrong with keeping already compromised passwords? Plus it was clearly a white hacker that helped them secure the website, the required fee was for this service.

/s

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#42

Post by m000 »

johndoeee wrote: post #24
lawtalkinghuman wrote: post #18

Earlier quoted context omitted.

> Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivate…

> The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting Opensubtitles has a VIP program at $15 a year. It's quite easy to find the person who runs the site and, according to their CV, this is basically their job. That'd make Opensubtitles a for-profit piracy site, i guess.

> according to their CV, this is basically their job. That'd make Opensubtitles a for-profit piracy site, i guess.

Guess what: Non-profit != for-free && Non-profit != for-a-loss.

If in order for opensubtitles to fulfill its envisioned role needs full-time attention, it is legit to pay yourself or hire an employee, paid by the ad and or subscription money. That's what also happens on all registered non-profit organizations.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#43

Post by tialaramex »

gwd wrote: post #38
woutifier wrote: post #30

Earlier quoted context omitted.

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

> Defense against rainbow tables is obtained via salt, not via slow hashes. And bcrypt includes stores a unique salt next to the hash for every password, making rainbow tables completely useless. https://en.wikipedia.org/wiki/Bcrypt

Nobody is saying bcrypt isn't a good choice here, they're saying that rainbow tables (and all time-space trades) are made infeasible by salt regardless of whether you're using a good password hash like bcrypt.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#44

Post by lawtalkinghuman »

johndoeee wrote: post #24
lawtalkinghuman wrote: post #18

Earlier quoted context omitted.

> Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivate…

> The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting Opensubtitles has a VIP program at $15 a year. It's quite easy to find the person who runs the site and, according to their CV, this is basically their job. That'd make Opensubtitles a for-profit piracy site, i guess.

Yeah, I saw it had a subscription model for VIP users. I'm guessing they're not getting Jeff Bezos, Bill Gates level rich off it though.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#45

Post by mustardo »

morelish wrote: post #37

I wonder how the hacker got network access to the database? I couldn't work out from what I read. It said the DB had a weak superuser password. But it didn't say how the hacker managed to make network calls to the DB. Presumably there was some initial entry point to get inside the network? It sounds like maybe the web-application user verification was poor and the app allowed admin users to make arbitrary DB calls?

> was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data.

Depending on the injection vulnerability data can be exfiltrated, there are tools like sqlmap https://sqlmap.org/ which make it pretty easy to dump tables via injection

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#46

Post by morelish »

mustardo wrote: post #45
morelish wrote: post #37

I wonder how the hacker got network access to the database? I couldn't work out from what I read. It said the DB had a weak superuser password. But it didn't say how the hacker managed to make network calls to the DB. Presumably there was some initial entry point to get inside the network? It sounds like maybe the web-application user verification was poor and the app allowed admin users to make arbitrary DB calls?

> was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. Depending on the injection vulnerability data can be exfiltrated, there are tools like sqlmap https://sqlmap.org/ which make it pretty easy to dump tables via injection

Ah I see, it was the website user SuperAdmin the hacker got into. Cheers.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#47

Post by wasmitnetzen »

chompychop wrote: post #31
wasmitnetzen wrote: post #27

Earlier quoted context omitted.

KeepassDX (Android) has a really nifty keyboard feature which allows you to even put passwords in apps, which the regular Firefox Sync doesn't support. Maybe that's the use case which makes you do the switch?

Do we need to toggle this feature somewhere in the settings? I use KeepassDX but I've never been asked by the app to auto-fill in passwords on websites or other apps.

It's a separate keyboard, and needs to be enabled in the keyboard settings of Android. There's a link in the KeepassDX settings.

There is a separate autofill feature, but that works quite rarely, maybe 10% of the apps support that, but that makes things even easier.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#48

Post by mustardo »

morelish wrote: post #46
mustardo wrote: post #45

Earlier quoted context omitted.

> was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. Depending on the injection vulnerability data can be exfiltrated, there are tools like sqlmap https://sqlmap.org/ which make it pretty easy to dump tables via injection

Ah I see, it was the website user SuperAdmin the hacker got into. Cheers.

Thats my understanding, I initially thought MySQL root user as well

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#49

Post by gwd »

tialaramex wrote: post #43
gwd wrote: post #38

Earlier quoted context omitted.

> Defense against rainbow tables is obtained via salt, not via slow hashes. And bcrypt includes stores a unique salt next to the hash for every password, making rainbow tables completely useless. https://en.wikipedia.org/wiki/Bcrypt

Nobody is saying bcrypt isn't a good choice here, they're saying that rainbow tables (and all time-space trades) are made infeasible by salt regardless of whether you're using a good password hash like bcrypt.

But both you & GGP are talking about bcrypt as though it was only a password hash. If someone says, "I'm using bcrypt", then they are using both a password hash and unique per-password salts, or they're not using bcrypt. What makes bcrypt and other such systems nice (and makes this kind of mistake basically inexcusable in 2022) is that if you're using a library or package which implements it (which you should), you don't need to think about salts; you just call GenerateFromPassword() and CompareHashAndPassword(, ) and forget about it.

EDIT: I mean, I understand maybe why in 2006 you used md5 without salt. But a few years ago I when I tossed together my first webapp (a scheduling system for the community I'm involved in), I just googled "password hash" and immediately bcrypt came up as a recommendation; there was a package in my target programming language, so after half an hour of research and 5 minutes of programming I was done. I don't understand how the opensubtitles team, after having had their password database compromised, came up with "use sha256 without salt" instead of "use bcrypt or one of the many libraries which takes care of all of that for you".

Post reply on HN