Learning From Gawker's Failure 236
Gunkerty Jeb writes "The Gawker hack has completely disenfranchised their users, not to mention the breach in trust that may well be impossible to regain. Users are demanding that they be allowed to delete their accounts immediately, and beyond implementing such a mechanism, it is likely that Gawker systems will have to be rebuilt from the ground up to avoid future hacks. So, what is to be learned from this perfect storm of bluster and bravado?"
What's to be learned? (Score:2)
Re: (Score:2)
So says an Anonymous Coward.
These lessons have been applied (Score:2)
And from what I hear, there is no way these clueless, juvenile script kiddies could EVER hack Slashdot.
Re:These lessons have been applied (Score:4, Informative)
Re: (Score:2)
So it's easier to hack?
How is Slashdot being opensource reassuring? I certainly cannot fix the code on the server where it is running.
Re:These lessons have been applied (Score:5, Funny)
Re: (Score:2)
Being open does not make Slashdot easier to hack, because it's written in Perl and so even access to the source code does not make it possible for an attacker to understand what it's doing.
I have not read a truthier statement all day. Explosion at the punctuation factory.
Re:These lessons have been applied (Score:4, Funny)
My biggest gripe on the other hand is that my browsers don't understand the html that Slashdot's Perl code produces...
Re: (Score:2, Insightful)
Re: (Score:3)
IT's not magical thing it work. This has been shown many times. The issue is with implementation. Locks are worthless if they aren't locked.
Re: (Score:3)
http://news.slashdot.org/article.pl?sid=00/09/29/0231248&tid=99 [slashdot.org]
Re: (Score:2)
Whoosh.
Re: (Score:2)
What whoosh? That hack was from like 10 years ago... about the time the alleged BSD backdoor was allegedly inserted. Coincidence? I think not!
Re: (Score:2)
My original post was a (lame) joke. The first lesson in the linked article is "don't poke the bear" so I was poking the bear.
Re: (Score:2)
Who whooshes the whooshers? :-)
Yes, I know. My post was also a (lame) attempt at a joke. :-)
Re: (Score:2)
And from what I hear, there is no way these clueless, juvenile script kiddies could EVER hack Slashdot.
How you talk.
BTW, after successfully tricking CommodoreTaco into running my PostScan 2010 script (to check his posts for virii) I now have the entire suite, user data and cheat codes to dozens of 1980's C64 games.
Re: (Score:2)
Narrator: There is a theory which states that if ever anyone discovers exactly what the Universe is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable.
There is another theory which states that this has already happened.(HHGTG [wikipedia.org])
Cmdr Taco hacked Slashdot long long ago. Once upon a time this was a sensible discussion board running software written in C and with a love of beautiful art discussions.
Re: (Score:2)
Remember when we had all those polite and insightful conversations about religion and politics? Man, those were the days, huh?
Description of hack? (Score:5, Insightful)
Until that's published there's really nothing to study.
Re:Description of hack? (Score:5, Interesting)
Re:Description of hack? (Score:4, Informative)
That is a really good article. If they are using very out of date Linux kernels there are probably a lot of other out of date software on their systems. That combined with the fact that they don't have any internal password strength policy and are using cryptographically broken encryption shows they don't seem to have any competent server admins and web developers.
There is a lesson to learn here and it is a simple one: Don't be stupid.
Given their demonstrated lack of competence in handling this whole situation I don't have a ton of faith that they can competently check their systems for other damage and any modifications made by Gnosis.
Re: (Score:2)
Always with the blaming the admins and web developers. It's only 95% of them that give the other 5% a bad name, you know.
Re: (Score:3)
Just because the kernel version is 2.6.18 (in particular, don't know about 2.6.21) doesn't mean its out of date. 2.6.18 is the kernel used by Red Hat Enterprise Linux 5 and its derivatives, and Red Hat's version gets regular patches.
Re: (Score:2, Redundant)
Here ya go: http://blogs.forbes.com/firewall/2010/12/13/the-lessons-of-gawkers-security-mess/ [forbes.com]
Re: (Score:3)
Re: (Score:2)
The attacker's release notes, hosted by Jeff Atwood : http://www.codinghorror.com/blog/gawker-hack-release-notes.html [codinghorror.com]
Re: (Score:2)
Re: (Score:2)
My point exactly! WTF was this awful website anyway?
We can learn from the Wikipedia that it was:
Gawker is a blog based in New York City that bills itself as "the source for daily Manhattan media news and gossip" and focuses on celebrities and the media industry.
So, good, I was RIGHT in not giving two shits about this hack or the dozens of shitheads who bothered to create logins on a fucking useless blog site of nonsense and shitheadery(a word I had to make up to convey my lack of concern for those asshat u
Re: (Score:2)
Re: (Score:3)
Actually, Gawker owns and manages several websites: deadspin (sports), kotaku (computer gaming), jezebel (feminism, and other girly stuff), io9 (sci-fi) gizmodo (consumer electronics), lifehacker (computers), and jalopnik (cars). All of the accounts on those websites have been compromised, to some degree.
Re: (Score:2)
Jalopnik sucked anyhow... (Score:5, Insightful)
IO9 and others really were not much better. And the problem really came down to not being able to drown out the idiots. I attribute Slashdot's long term success to the mod system and the whole way it handles contributions. It works. And the Gawker crap blog engine was badly coded, anybody who used it could see that. So it isn't a shock that it got 0wn3d. Amateur blog engine should be a sign of overall poor design and security.
Re: (Score:2)
http://www.thetruthaboutcars.com/ [thetruthaboutcars.com] (AKA TTAC) is my current favourite auto rag, filled with TheRegister-esque satire dripping with sarcasm and some descriptive analogies worthy of PA's Jerry Holkins.
Here's a decent writing sample that sticks in my memory: http://www.thetruthaboutcars.com/2009/01/comparison-2008-dodge-charger-v6-vs-1993-toyota-camry/ [thetruthaboutcars.com]
Maybe I didn't notice it as a kid since I had the propensity to simply ignore all things politick, but C&D and some of the other auto mags seem to have very
Re: (Score:2)
It's nice to know I wasn't alone. Wert canned the real writers and brought in a bunch of talentless interns. From a business standpoint that's AOK, but they tried to use established Jalopnik references that they didn't fully understand and came off looking like clowns. "Look at me, I'm driving a Volvamino and doing double nickels on the dime!"
And you are dead-on - the decline in the quality of commentariat was directly proportional to the quality of the writing. In this case, the shift in both was nea
I know what I learned (Score:2)
I learned to always use the password "123456". Herd immunity.
Re:I know what I learned (Score:4, Interesting)
I have several passwords I use. Sites that require accounts for participation get one that I don't care if it gets out in the wild. No big loss. People posting as me is mildly amusing.
I have another password for systems I'm in charge of, that function like those I participate in in the first example. It would suck if that got out. Those systems are few, and you'd have to personally know me to know what they were.
I have secure passwords for each of the highly sensitive accounts (banks and such) that are not shared between accounts. IF one of those gets out, I'm screwed for that one institution, but nowhere else.
Re: (Score:2)
Salt your hashes (Score:4, Informative)
See title
Re: (Score:2)
Salting your hashes only protects you from rainbow tables (and then only if your hash isn't already in a rainbow table). The salt is included in the hash, so I can see if your password is a weak password like "password" or "PASSWORD" or... exactly what Gawker warned against.
Re: (Score:2)
Salting provides effective protection when combined with a number of rounds. Ideally, the client should do a number of rounds, then hand the 256 bit hash over to the server which will toss in the salt and do a few rounds. The reason for this is that trying to brute force guess a typeable password will become difficult. An additional bonus is that a client trying to guess a user's password is slowed down by an authentication mechanism before the guess goes to the machine.
What would be ideal is a standard
Salting is merely a good start (Score:5, Informative)
Salting addresses some attacks, but as CPU time becomes cheaper [amazon.com], it becomes increasingly feasible to brute-force even salted hashes. To address this issue, you need key strengthening [wikimedia.org] as well.
Or, better yet, just use the system designed to store passwords: bcrypt [codahale.com].
*sigh* Then again, I'm confident that we'll see incompetent web application developers using unsalted MD5 for decades to come. People don't learn from others' mistakes it seems.
Re: (Score:2)
Then again, I'm confident that we'll see incompetent web application developers using unsalted MD5 for decades to come. People don't learn from others' mistakes it seems.
Or even cleartext; yes, I have seen this on production websites, and it is unbelievable.
Re: (Score:2)
Or even cleartext; yes, I have seen this on production websites, and it is unbelievable.
As have I, a good way to test this is to try and reset your password on said site. If they show you or email you your existing password and not a random new one, you know their security is crap and shouldn't be trusted.
Re: (Score:2)
Not necessarily. I've been on sites that will show you your existing password, but only after jumping through many hoops to prove your identity. The fact that they have access to your unencrypted password doesn't necessarily mean that they're using it for identification--it could easily be stored in a back-end database somewhere and used only to show to people that forget it.
Re:Salt your hashes (Score:4, Informative)
From what I have read, the passwords were hashed but only with DES. Furthermore, there was salting and no password complexity requirement because rainbow tables were able to reveal a medley of Gawker passwords. Gawker's reaction to the first signs of a break in a month ago (complete indifference) was pretty nuts. It's user base is its biggest asset; the disrespect they show their users was ridiculous.
Re: (Score:2)
the passwords were hashed but only with DES
DES is an encryption algorithm, not a hashing algorithm. The difference is that encryption is reversible. If you use encryption as weak as single DES then someone can crack it pretty quickly and then generate a list of unencrypted passwords. If the passwords are hashed, even with a weak algorithm, then they can generate a list of possible passwords, but if someone has used the same password in two places then you won't necessarily get the same one that they used in the other place.
Re: (Score:2)
Re: (Score:2)
DES is the standard unix hash algorithm (like ed is the standard unix text editor).
Here's the first paragraph of "man crypt"
of course you would have to be borderline retarded to actually use it now.
With big words come big responsibility (Score:4, Funny)
The Gawker hack has completely disenfranchised [reference.com] their users
That's quite a hack, depriving users of their right to vote...
Re: (Score:2)
Indeed, I think they were looking for "disenchanted".
Re: (Score:2)
The Gawker hack has completely disenfranchised [reference.com] their users
That's quite a hack, depriving users of their right to vote...
disenfranchise verb \dis-in-fran-chz\ Definition of DISENFRANCHISE transitive verb : to deprive of a franchise, of a legal right, or of some privilege or immunity
franchise (noun)
2 b. a constitutional or statutory right or pirvilege; especially the right to vote
Bold mine, italics not.
Passwords are a failure (Score:5, Insightful)
The big lesson here is not that you should never get breached, or that you should use some super-secure password, or that you should use a different password on every site (you should).
No, the real lesson is that passwords themselves are faulty. No one is going to select and memorize a strong password for every website they use. They're going to either re-use passwords, or choose weak passwords, or write their passwords down (or use a password manager).
None of these are good answers. The expectation is that users are going to choose strong passwords, that they will never re-use passwords, that hashes (even with salt) are an effective way to protect passwords, and that users will never be tricked into revealing their password.
It's bullshit. It's always been bullshit. Users aren't careful with passwords, and why would we expect them to be - 99.9% of the time they get away with it. Humans are bad at evaluating the risk of things that are low frequency but high impact.
The other thing that's bullshit is password reset. It doesn't make any sense: how can someone who forgot their password remember "security questions" that are actually secure. No, 99 times out of 100 these systems use some crap like "Where were you born", which is pretty damn trivial to find out for any attacker. My brokerage account has a secure password that I only use there, but resetting the password requires only my username, SSN, ZIP code, and last name. And there are far, far more people who know that stuff than people who know my password.
It's time to get serious about replacing passwords. That's the lesson here.
Re:Passwords are a failure (Score:4, Interesting)
If they're not required for logging in I always fill the security question answers with a long string of random characters, effectively making them unusable for password recovery.
Re: (Score:2)
Careful - they don't always tell you they're required to login until afterwards.
Best to keep a copy of the string of gibberish encrypted on a private machine in case you need it. That's the best solution for all passwords anyway, despite OP's claim that using password managers to save strong passwords is a bad idea.
Some of us are more fortunate (Score:5, Funny)
Well, some of us were more fortunate there.
I was born in the quaint town of P5$+19"797q4. It's lovely in the spring. You should visit. My mother's maidens name was B192zve8p6; an ancient and distinguished family, if you must ask. My first pet was a cat named Ö8z~30+r.vd. We all loved her. And I went to ß8s8h,u:82 memorial school.
Strangely enough, nobody ever guesses those ;)
Re:Some of us are more fortunate (Score:5, Funny)
Re: (Score:2)
I do that too, but sometimes it bites you in the ass - my credit card bank, for example, occasionally asks one of those questions in addition to the password.
Re: (Score:2)
Yeah I had that issue with my bank. They asked for the answers to a bunch of questions when I first created my account for password recovery purposes, so I put in long random strings, but recently they changed to using the "two factor" (yeah right) authentication, so I had to go to my bank to change them.
Re: (Score:2)
Re: (Score:2)
As I see it, the best thing you can get is some fortified password manager. I'm not sure how secure the manager of Firefox is. After all, JS in Firefox can do pretty powerful things, you can do a plugins and whatnot, so I can imagine some JS exploit, either through JS engine failure, or making a plugin that claims to be something else than it actually is (e.g. Flash video downloader, or whatnot; just wait for the password manager to fill in the field and your evil script does an Ajax push in the background)
Re: (Score:2)
Why is a password manager not a good answer? I use KeePassX and generate a random string for each and every login. It's even easier than trying to remember more than one password. Simply copy and paste the password each time (also defeating any keylogger you may have installed).
Phillip.
Re: (Score:2)
Why is a password manager not a good answer?
Allegedly, it's the same reason why you don't put stickys on the monitor. However, by the time someone has enough resources to crack into your encrypted password store, your other passwords would probably be compromised by now.
A slightly better option is generating a password constructed from a hash, which basically means you need to carry around a mobile device at all times if you use computers at different places.
Re: (Score:2)
Any application that could log your keystrokes can also monitor your clipboard. And - while we're at it - take screenshots periodically and record the coordinates of mouse clicks, potentially defeating on screen keyboards.
Re: (Score:2)
The reason I don't use one is that you could lose your password database. I'd rather remember a bunch of passwords than rely on always having that file. Even backing it up I don't feel safe.
Re: (Score:2)
I back it up to a printout that I store in a safety deposit box. That way even if my data and all backups fail, I still have a human readable copy somewhere.
Re: (Score:2)
write passwords down or use a password manager (Score:2)
Nothing wrong with that. A piece of paper in my wallet is reasonably secure, and I'll notice fairly quickly if it's missing. Especially if I use an algorithmic password.
Re: (Score:2)
Only if you're stupid enough to use the most obvious answer. In my case I could use the name of the city like pretty much everyone else - but I use something else that is technically correct, easily remembered by me, and non-obvious to the random hacker. (I.E. something that can't be found by searching public records and isn't something like 'a hospital'.)
Re: (Score:2)
Use a unique random string as a username.
Re: (Score:2)
Re: (Score:2)
You can ahve strong passwords, and not nede to memorize one.
Not what I use, but here is an example:
Last three intiais of a middle name, the age you lost your virginity and the day of the week you where born and then add the sitenane backords with numbers:
So John Doe on Slashdot could have a password:
Doe16Wedt0dh5415
Obviously, pick you own decision points.
The site should hash them as an added layer.
Also alerting a user when unusually activity happens is useful as well. Like when google alerted me someone fro
Re: (Score:2)
The lesson I took away from those experiences and the gawker story is this: The negative consequences of someone stealing my ID on some forum about RC cars are basically nil, especially if my profile on that forum doesn't
Re: (Score:2)
Why did they even need passwords? (Score:4, Interesting)
Re: (Score:2)
What I'm left wondering is why someone should need a username and password to comment on a blog post on their sites. Do they have a reputation system? Does it really prevent spam? Or is it just to gather a list of email addresses that they might sell later? There must be a better way to accomplish the little functionality that their login requirement provides. Especially now that they have to deal with the fact that their login system was not secure.
There are two primary reasons to require logins:
1) A registration system with a captcha is highly-effective at preventing spam on your blog comments or forum posts.
2) To a greater or lesser degree, it prevents people from impersonating you. Sure there are ways to trick this (create a username that's one lookalike character off, etc.) but on the whole it makes it easier to recognize who you're talking to.
Re: (Score:2)
The more info they collect, the more they can sell to advertisers. This is why so many blog places demand so much info.
Gawker's failure? (Score:2)
Meh, I'd always used Facebook Connect to post comments to their sites. Probably the first mildly useful thing Facebook has done for me.
So at worst, I probably have my spam email address out there in that torrent. Big deal. It's posted all over the web already (including my personal contact page).
But really, if anyone was adversely impacted by this, was it Gawker's failure, or their own for trusting some random website with a sensitive password? I don't use my good passwords for any of these "social netw
The real failure was storing passwords. (Score:2)
Re: (Score:2)
how else do you compare the password with what the user types to see if it's legit? or did you mean in cleartext?
Re: (Score:2)
Why, why, WHY would a site think its ok to store users' passwords in the first place?
From what I've read, they didn't store the passwords, only hashes. The passwords that have been released were weak passwords that were easily brute-forced from the hashes.
Re: (Score:2)
Why, why, WHY would a site think its ok to store users' passwords in the first place?
From what I've read, they didn't store the passwords, only hashes. The passwords that have been released were weak passwords that were easily brute-forced from the hashes.
I should be more specific. They should have stored salted hashes. Regular hashes are susceptible to rainbow table attacks. Especially since they used an obselete DES encryption.
Single login = single point of failure (Score:3)
This is the trouble with "single login" systems. Now there's a single point of failure.
Single login requires a trusted organization with a good reputation willing to contractually commit to paying for the damages if they screw up. But look who's in the business: Gawker. Facebook. Microsoft. Google. That's no good.
If anyone were to do this well, it might be Amazon. Amazon is not an advertising-supported business. They take orders, accept payments, and ship real products. As a major credit card merchant selling physical objects for which they pay real money, they constantly have people trying to steal merchandise from them. So their management has to understand the risks of authentication failures. Amazon has a powerful and well-respected distributed computer infrastructure, which tends to stay up despite problems. So they could probably implement a single login system that could be trusted.
No account delete option (Score:2)
But they're "working on it." This from a company that has railed against Facebook and other sites for privacy violations. Here's an official Gawker response from a year and a half ago to give you an idea of their real attitude towards user privacy and account deletion:
Requesting purge of accounts
What a bunch of asshats.
Gawker? Scadenfreude Central Hoist on own Petard! (Score:4, Informative)
Their MO is "Kick 'em when they're up, kick 'em when they're down". [lyricsfreak.com]
This hack couldn't have happened to a bigger bunch of self-involved, arrogant jerks. If there is a balance of justice in the universe, then it just inched another tiny notch towards equilibrium.
Really, the imperious attitude that is exhibited by the Gawker "editorial" stance is a smug and sarcastic condescension towards the foibles of others.
Re:Gawker? Scadenfreude Central Hoist on own Petar (Score:5, Interesting)
Yea, well it happened to the "customers" of those jerks, too.
I had a registered account on Gizmodo, mostly to write posts telling an author how full of shit they were, or to correct silicon/silicone errors, etc., but that's immaterial.
What is material is that I've been getting emails from hosts of hosts upon which I've used that same email address to register, telling me I need to change my password, even though my password is not the same from site to site.
Worse, in a fit of idiocy, battle.net decided that, since my battle.net account is identified with an email address that they found on the leaked Gawker database, that they'd go ahead and reset my password. Yes, unsolicited. Despite the facts that a) my password does not hash to the string associated with the address in the database, b) I have an authenticator attached to the account, and c) it's not their fucking business to reset my password without asking first.
So what happened next? After getting the email from battle.net, I went to their account management page, and entered a new password -- and am then unable to login using those credentials. They broke my access for 36 hours. For no valid reason.
If I had actually held a desire to play during that time, I'd have been royally pissed. As it is, I'm just royally irritated at their stupidity, and at the subsequent neutronium density of their CS group to be completely unable to parse my simple request: "your password reset broke my login, please fix it," and instead treated me as if I had reported my account hacked. So now my WoW account is locked down while they review whatever they think they need to review.
Mass idiocy all around, yes, but precipitated by the arrogant idiocy of Gawker.
And of course, just for safety, I've had to go and change accounts everywhere to be registered with a new email address - or where not possible, rotate passwords... which I usually do, but not all at fucking once. I spent three hours last night going over my list of accounts and passwords and updating everything, including my home network, which caused things to break for other family members who are now calling me with "I can't use the web; I can't get to pokemon.com; why isn't Miro working?" etc.
So, long screed made short: The pain, there's more than enough to go around, even for the undeserving.
Or, in the the now immortal, um... expression, of an anonymous /b/tard: Fuuuuuuuuuuuuuu...!!
Re: (Score:3)
I received a similar email from Blizzard. Here it is:
We've received a request to reset the password for this Battle.net account. Please click this link to reset your password: (link omitted)
If you no longer wish to make the above change, or if you did not initiate this request, please disregard and/or delete this e-mail.
You didn't have to change it. They just thought they'd do the right thing and offer to help protect their customers before it was needed. An ounce of prevention and all that.
Re: (Score:2)
They obviou'sly work for the greengrocer's guild.
Re: (Score:2)
What the hell is insightful about being a grammar Nazi? I don't have objections to pointing out the problem, but modding it insightful? Gosh. The towering intellect and insight required to make this stunning observation is just overwhelming to mere mortals.
Re: (Score:2)
Nice use of the apostrophe on a plural form.
Has it been fixed? Because I don't see what you're writing about. Or are you referring to apostrophe in "Gawker's"? In American English, an organization, business, etc. is usually considered singular: "IBM has released its annual report." "Xerox's profits are down." "The NRA opposes gun-control legislation."
Re: (Score:2)
Userseresss's'ss''''sss.
Re: (Score:2)
Userseresss's'ss''''sss.
OMG. Apparently I'm so accustomed to the "Here comes an 'S'" usage I didn't even see it.
Re: (Score:2)
Userseresss's'ss''''sss.
OMG. Apparently I'm so accustomed to the "Here comes an 'S'" usage I didn't even see it.
OMG, I was so annoyed that I missed it I forgot how to use nested quotes . . .
Re: (Score:2)
Neither of which apply to the case in question.
Re: (Score:2)
Epic fail.
His, hers, its. Those aren't true posessives and don't take apostrophes. Bob's, Sally's, and the computer's are and do.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Steve's ball.
Dog's ball.
It's ball.
The problem with grammar nazi attempts to correct people's apostrophe abuse is that hardly anyone explains why "the ball belonging to it" isn't contracted as "the ball belonging to Steve".
Re: (Score:2)
Mmmmmmm... unsalted passwords.
Re: (Score:2)
I think of it as more like dancing in a rattlesnake pit. It's a funny dance, but it does not last very long.
I also like to say my scripts are as awesome as a unicorn that shits out Milk Duds.
Analogies are fun, aren't they!
Re: (Score:2)
If Gawker had any sense, they'd hire professional programmers to design their system instead of letting it grow organically from what the "programming guy" originally came up with. Their comment system is THE WORST ever implemented.