Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scribd hacked – emails and hashed passwords leaked

support.scribd.com

Post reply on HN
Print view View original

51–60 of 72 posts

Re: Scribd hacked – emails and hashed passwords leaked

#51

Post by gingerlime »

I received this email, but it landed in my spam folder as suspected phishing...

  Be careful with this message. Similar messages have been used to steal people's personal information. Unless you trust the sender, don't click on links or reply with personal information.
I thought this was the hackers that got my email off scribd trying to phish my password.

Re: Scribd hacked – emails and hashed passwords leaked

#52

Post by packetslave »

Aardwolf wrote: post #33
psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

Why do you want to know the hashing scheme? Isn't it better if nobody knows? :)

No

Re: Scribd hacked – emails and hashed passwords leaked

#53

Post by nikcub »

kpumuk wrote: post #11
MattBearman wrote: post #7

Earlier quoted context omitted.

Thanks for clarifying, good to see you're using a decent hashing algorithm :) I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users. This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

that is a weird definition of compromised.

is it true that all, or greater than 1% of, emails and hashes were dumped?

I find it hard to believe you migrated 99% of passwords to a new scheme. I've never seen over 60%, and that is with a lot of prompting to users (and as as Scribd user i've never been prompted)

Re: Scribd hacked – emails and hashed passwords leaked

#54

Post by [deleted] »

kpumuk wrote: post #11
MattBearman wrote: post #7

Earlier quoted context omitted.

Thanks for clarifying, good to see you're using a decent hashing algorithm :) I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users. This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

[deleted]

Re: Scribd hacked – emails and hashed passwords leaked

#55

Post by harshreality »

beachstartup wrote: post #42
icebraining wrote: post #28

Earlier quoted context omitted.

Well, that assumes people aren't reusing those passwords.

http://en.wikipedia.org/wiki/Salt_(cryptography)

Salts make cracking a list of N password hashes take roughly N times as long, but if a password is cracked anyway (because it's common and/or because the hash is not using very many rounds, or because an attacker only cares about one particular account), and the password is reused elsewhere, the fact that it was salted doesn't matter anymore.

GP is right; if owners of the leaked accounts [email, hash] pairs are reusing passwords, the leaked hashes are potentially useful even though scribd has reset them. They're simply not useful for logging in to scribd.

Re: Scribd hacked – emails and hashed passwords leaked

#56

Post by [deleted] »

Aardwolf wrote: post #33
psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

Why do you want to know the hashing scheme? Isn't it better if nobody knows? :)

[deleted]

Re: Scribd hacked – emails and hashed passwords leaked

#57

Post by zwily »

nikcub wrote: post #53
kpumuk wrote: post #11

Earlier quoted context omitted.

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users. This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

that is a weird definition of compromised. is it true that all, or greater than 1% of, emails and hashes were dumped? I find it hard to believe you migrated 99% of passwords to a new scheme. I've never seen over 60%, and that is with a lot of prompting to users (and as as Scribd user i've never been prompted)

The migration can be transparent, since the app has your plaintext password when you log in.

Alternatively, stored passwords can be upgraded by using the new scheme on the hold ashed password, and storing that that's how the password should be checked in the future.

Since not everyone was migrated, I'm assuming they went the first way.

Re: Scribd hacked – emails and hashed passwords leaked

#58

Post by harshreality »

pitchups wrote: post #4

This seems to have become a common occurrence. Just curious about a couple of things : a) How easy/hard is it for the hashed passwords to be cracked by the hacker? b) How are hackers getting access to emails and password data so often? You would think these large sites have enough layers of security to prevent this from happening. Is it social engineering or common loopholes in these systems?

a) Depends on what hashing algorithm is used (and whether it incorporates a salt). http://hashcat.net/oclhashcat-plus/#performance

b) Because it's hard to secure a corporate infrastructure, (i.e., making a good set of usability/security trade-offs), and there's no such thing as perfect security. A web application that's been audited can still have a security flaw that enables disclosure of authentication data. Or an employee's machine might be compromised, leading to a compromise of corporate infrastructure or data that he/she is able to access.

Re: Scribd hacked – emails and hashed passwords leaked

#59

Post by beachstartup »

harshreality wrote: post #55
beachstartup wrote: post #42

Earlier quoted context omitted.

http://en.wikipedia.org/wiki/Salt_(cryptography)

Salts make cracking a list of N password hashes take roughly N times as long, but if a password is cracked anyway (because it's common and/or because the hash is not using very many rounds, or because an attacker only cares about one particular account), and the password is reused elsewhere, the fact that it was salted doesn't matter anymore. GP is right; if owners of the leaked accounts [email, hash] pairs are reusi…

yeah if you simply know what a password is, of course it's compromised, but you're not supposed to easily break a salted hashed password.

Re: Scribd hacked – emails and hashed passwords leaked

#60

Post by klox »

ComputerGuru wrote: post #12

kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate. Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from "Good news - your password was not among tho…

Er, what? Every single site I can think of 'leaks' this information through their registration page.

Try and sign up for a new Scribd account with an existing email:

"That email address is already taken; please choose another one"

Try to sign up for a Facebook account with an existing email:

"Sorry, it looks like somebody@somewhere.com belongs to an existing account"

Post reply on HN