Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Weebly hacked, 43M credentials stolen

techcrunch.com

Post reply on HN
Print view View original

71–80 of 99 posts

Re: Weebly hacked, 43M credentials stolen

#71

Post by drinchev »

Every time when this happens I ask myself only one question.

What about all those hacked servers that we don't know that are hacked yet?

There are ( and I'm pretty sure ) lots of hackers that do this on a daily basis, but don't try to do anything malicious on a large scale ( like dumping the whole db of customers, DDoS, etc. ). They probably target medium-large or small companies' servers, put a backdoor there and analyze. Either stealing some business secrets or leave it like that for one of the dark days when some political-corporate person will need their help.

Having the whole human knowledge on the palm of my hand made also our own lives public-knowledge.

Re: Weebly hacked, 43M credentials stolen

#72

Post by jorisvansoest »

user5994461 wrote: post #69
dpweb wrote: post #35

Earlier quoted context omitted.

This title is incorrect. Credentials not stolen, usernames and hashed passwords stolen. That is not the same as having everyone's password. The title implies someone can easily log in to your account.

> That is not the same as having everyone's password It is for everyone who used "weebly" or any of the top 100 most common passwords. That could mean no less than 82% of users are at risk.

more than 63% of all statistics are made up [1]

[1] me

Re: Weebly hacked, 43M credentials stolen

#74

Post by davidsong »

jazoom wrote: post #16
stevesun21 wrote: post #11

I wonder if the hacker really interested in decoding credential or they just want to collect the email addresses which is really valuable for email marketing.

You mean "email spamming"? I'd be hesitant to call that "marketing".

Spam is as much a form of marketing as assault is a form of touching.

Re: Weebly hacked, 43M credentials stolen

#76

Post by novaleaf »

user5994461 wrote: post #69
dpweb wrote: post #35

Earlier quoted context omitted.

This title is incorrect. Credentials not stolen, usernames and hashed passwords stolen. That is not the same as having everyone's password. The title implies someone can easily log in to your account.

> That is not the same as having everyone's password It is for everyone who used "weebly" or any of the top 100 most common passwords. That could mean no less than 82% of users are at risk.

This is also not true, as if they used bcrypt (a key derivation function) the hash is salted, so even users using common passwords are protected against rainbow (lookup table) attacks.

as for brute force, yes attackers now know usernames, so can try brute forcing the live sites, or brute forcing each user hash.

Re: Weebly hacked, 43M credentials stolen

#77

Post by erjjones »

drinchev wrote: post #71

Every time when this happens I ask myself only one question. What about all those hacked servers that we don't know that are hacked yet? There are ( and I'm pretty sure ) lots of hackers that do this on a daily basis, but don't try to do anything malicious on a large scale ( like dumping the whole db of customers, DDoS, etc. ). They probably target medium-large or small companies' servers, put a backdoor there and an…

Exactly!

Also in this instance, Weebly, they get an anonymous "hey look, I have all of your data".

So Weebly issues a statement to their customers to reset their passwords (which the hackers knew would be a byproduct) and unbeknownst to them the hackers are now skimming the new passwords off the network.

Re: Weebly hacked, 43M credentials stolen

#78

Post by MasterScrat »

novaleaf wrote: post #76
user5994461 wrote: post #69

Earlier quoted context omitted.

> That is not the same as having everyone's password It is for everyone who used "weebly" or any of the top 100 most common passwords. That could mean no less than 82% of users are at risk.

This is also not true, as if they used bcrypt (a key derivation function) the hash is salted, so even users using common passwords are protected against rainbow (lookup table) attacks. as for brute force, yes attackers now know usernames, so can try brute forcing the live sites, or brute forcing each user hash.

I believe he meant the will try the top 100 most common passwords on each account on the website directly, resulting on "82% of users at risk", assuming 82% of users use one of these 100 passwords.

Strong brute-force protection (eg block account for exponential times) could mitigate this attack vector.

Re: Weebly hacked, 43M credentials stolen

#79

Post by SCHiM »

nstj wrote: post #63
Puts wrote: post #48

Earlier quoted context omitted.

I'm kind of tired of the "Security is hard, every one gets hacked eventually and we are just victims" mentality. This is not true. Why don't we see peoples banking information plastered over the web every month? That if something would be a high value target. No, it's always these Web 2.0 services this happens to. Now, you could argue that a small SAAS service can not possibly afford security as rigorous as a bank, b…

Swift hack.

It wasn't swift that was hacked.

Re: Weebly hacked, 43M credentials stolen

#80

Post by chris_7 »

sroussey wrote: post #50
hiou wrote: post #28

Earlier quoted context omitted.

How long would you estimate it takes someone to "properly learn version control"? When I work with very junior developers they pick up git quite well in a week or two at most. Beyond that almost every team I work with uses their own special homegrown git workflow anyway. I don't mean to put you down for you requirements but git is really really easy to learn. It would be a shame to miss out on a talented developer fo…

What is bad in job listings is made up in the trial week: https://www.sequoiacap.com/article/trial-week-our-hiring-sec...

I'd be very surprised if asking people to waste a week of vacation on only a 66% chance of getting a job (that they probably don't even need, if they're already employed) wasn't a strong filter against top performers.

> I tell people that the worst case scenario is that they use a week of vacation, but because of the extra pay they can take a nicer vacation later on.

I mean, how can they, if they've already used their vacation time?

Post reply on HN