Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

First time accepted submitter radudragusin writes "IEEE suffered a data breach which I discovered on September 18. For a few days I was uncertain what to do with the information and the data. Yesterday I let them know, and they fixed (at least partially) the problem. The usernames and passwords kept in plaintext were publicly available on their FTP server for at least one month prior to my discovery. Among the almost 100.000 compromised users are Apple, Google, IBM, Oracle and Samsung employees, as well as researchers from NASA, Stanford and many other places. I did not and will not make the raw data available, but I took the liberty to analyse it briefly."

Re:For God's Sake

[xxxJonBoyxxx]

>> when are we going to all start hashing and salting passwords?

Please RTFA. The exposure wasn't in password STORAGE, it was in password LOGGING. (The stored passwords may already have been hashed and salted for all we know, but the FTP server was writing them to log files out in clear text!)

The left the logs open to public.

[140Mandak262Jamuna]

The password, log in and authentication methods are secure it looks like. The mistake they did was to allow public access to the log files of their web server. Dumb mistake. And among the log is the log for the authentication request. It contained the user names and passwords in plain text, because that is how the log in data gets "posted" to the web site.

It is like having super duper security behind the passcode access panel. But leaving a security camera looking at the people using the panel recorded and making it public.

FYI: password hashing doesn't matter when...

[nweaver]

Password hashing doesn't matter when the login password is conveyed in a URL and the URLs fetched are logged.

From the article, its clear that this is what happened: the login process creates a URL with the username & password in it, and since the URLs were logged and accessible, the login passwords could be obtained in the clear.

Re:Well...

[tangent3]

Disclaimer: I've RTFA'ed

The passwords were not stored in plaintext.
However, the web server access logs logged the passwords entered in plaintext. That was what was downloaded from a publically access ftp folder.

Re:Secure password message falls on deaf ears

[wisnoskij]

I agree, but the graph scale shows that only 300 out of the 100,000 people used those most common passwords.
I am not sure what the average perentage of users that use horrible passwords are, but .3% is below what I would expect (and you have to think that all of those people probably know better, but just have nothing on their account worth protecting).

Re:Well...

[Alef]

Well, so what? The intention may not have been to have the passwords written in plain text to a file, but they were. It doesn't matter how much you salt and encrypt the "master store" if you f*ck up and write them another file in clear text as well. They are there, readable on the disk. The fact that it was a log file doesn't diminish the error the least. In fact makes it even worse, since the security of a log file is likely not looked after to the same degree as a password database (as we can clearly see in this case, where they left it on an ftp). If you write clear text passwords along with user names to an unencrypted file under any circumstance whatsoever, you fail. If you have a clue about security, you simply never, ever do that!

And for that matter, what has invalid attempts got to do with it? Security through infinitesimal obscurity? Unless you have something like a million times as many invalid attempts as valid ones, it is of no consequence.