Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

Drupal.org User Accounts Compromised 60

Posted by samzenpus from the protect-ya-neck dept.
An anonymous reader writes "The Drupal.org team released a bulletin this evening notifying users of a breach in their infrastructure. From the bulletin: 'The Drupal.org Security Team and Infrastructure Team has discovered unauthorized access to account information on Drupal.org and groups.drupal.org. This access was accomplished via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. This notice applies specifically to user account data stored on Drupal.org and groups.drupal.org, and not to sites running Drupal generally. Information exposed includes usernames, email addresses, and country information, as well as hashed passwords... All Drupal.org passwords are both hashed and salted, although some older passwords on some subsites were not salted.' Users are encouraged to update their Drupal.org passwords and the passwords of any accounts that could be linked via the compromised information."
This discussion has been archived. No new comments can be posted.

Drupal.org User Accounts Compromised More

Drupal.org User Accounts Compromised

Comments Filter:

  • Passwords? More like passsentences. (Score:5, Funny)

    by Anonymous Coward on Wednesday May 29, 2013 @07:32PM (#43856127)

    As a recent Ars Technica article has uncovered, it is possible for a dedicated and knowledgeable attacker to reveal as many as 90% of passwords in a database. The sophistication of password cracking has never been higher, and common advice such as "use a mix of numbers, symbols, and uppercase letters" is no longer sufficient to fully ward a salted and hashed password from either compromise or ultimate flavor.

    While brute force cracking is rendered useless by any properly implemented password system, hackers have responded by tailoring dictionary attacks using techniques such as the following:

    • * Uppercase, in languages such as English, Japanese, or Spanish, typically appears at the beginning of a password, while symbols and numbers usually show up at the end.
    • * Combinations of words, such as the famous "horsebatterystaple" or the lesser known "walruspusflange", while suggested to extend the length of a password and reduce its susceptibility to brute forcing techniques, may nevertheless leave it vulnerable to directory combining attacks. Common passwords attached to each other sometimes reveal other passwords.
    • * Upwards of 50% of passwords contain the winner of the most recent Super Bowl, World Series, or Eurovision Song Contest, or some combination of letters used to spell such.
    • * Custom password dictionaries are available for passwords created by mashing the palm of the hand from left to right on the keyboard, and more are in development for mashing right to left (for RTL languages.)

    So, how to keep your password safe in this age of uncertainty? Well, there is no sure way. But consider the following to stay one step ahead of the bad guys:

    • * Use a password length of 100 characters or greater, including a mix of uppercase letters, numbers, and symbols.
    • * Work out what your usual password is in EBCDIC, and enter it using the Alt key and your keypad.
    • * Invent a language with a million characters, get it accepted in Unicode, and develop a gigantic keyboard for it. Or learn written Chinese.

    Once compromise happens, you have to assume your passwords will be known by the attackers before you do. Regularly changing your password is part of good Internet hygiene, so you may want to look for software that can automatically do this for you every minute or so. You may also want to consider two factor verification, typically a password and an application on your cellphone that gives you an access code, or three factor verification, which includes with the preceding an application on your friend's cellphone that gives a second access code that he'll send you on request. You cannot be too safe these days.

    • I think... what a time to have no mod points!

    • Your post is almost totally plausible. Where it particularly falls down though is that Japanese doesn't have any conception of capital and lower case letters. The kanji are just Chinese characters (by and large), and the kana only have one form for most (there are small versions of some kana, but they play a different role in words to the large versions, unlike in English where the capitals still play the same role in the word, but affect grammar). (Though there are two types of kana, the point still stands

    • Re: (Score:3)

      by pongo000 ( 97357 )

      Combinations of words, such as the famous "horsebatterystaple" or the lesser known "walruspusflange", while suggested to extend the length of a password and reduce its susceptibility to brute forcing techniques, may nevertheless leave it vulnerable to directory combining attacks. Common passwords attached to each other sometimes reveal other passwords.

      A silly and false assertion. Assume standard passwords in use. Your "dictionary" would consist of a list of characters ([A-Za-z]), digits ([0-9]), and punct

  • They blame a third party software but fail to name it...

  • stupid! (and I have many mod points that can't be used).

  • The End of Passwords (Score:4, Insightful)

    by rueger ( 210566 ) * on Wednesday May 29, 2013 @09:36PM (#43856873) Homepage
    I'll admit to a) reusing the same password on most forums, since it largely wouldn't matter if someone accessed them. b) using shorter passwords for most stuff, and long complex ones for the handful of places that actually need security, a c) Using the "Forgot Password?" link on most web sites that I don't visit often and just accepting whatever reset they offer.

    It's time to acknowledge that passwords are an idea that has come and gone. Too much hassle. Too many different password specifications from site to site. Too many to remember. Too many poorly constructed sites trying to tell users that bad security is their fault for not have super long and complex passwords. Too many sites where I actually now have three or four user IDs and passwords because I couldn't remember the last password I used there, or had changed my e-mail address since last visiting.

    And too many sites, banks especially, that still demand to know my mother's maiden name, or worse yet, arcana from my youth that I don't even remember. My first pet's name? My favourite TV show? I have no idea. Or likely would answer that differently a month from now.

    It's no wonder that most people ignore all of the password edicts that are thrown at them, and never change anything, and use the same password everywhere.

    Surely we can develop some new way of confirming people's identity that allows us to abandon the idea of passwords? I vote for an RFID pinky ring with a plug in USB reader on my computer.

    • Re: (Score:1)

      by cen1 ( 2915315 )
      Guity as charged. I reuse the passwords too but not on every single site. For random forums and less important stuff I use the same password but for those which could potentially leak my credit card details or some other imprtant information I usually create unique strong passwords.
    • Sounds like you need a simple mechanism for unique passwords. I have a suggestion for you to consider. Personally - I "salt" a standard password with the name of the website: the first initial of each of the words in a site's name for example. If my 'standard' password was for example "Aware20130530ness", and I was signing up for slashdot, I can simply add the letters to the start of the password, resulting in "sdAware20130530ness"

      • Re:The End of Passwords (Score:4, Insightful)

        by SplatMan_DK ( 1035528 ) on Thursday May 30, 2013 @08:20AM (#43859737) Homepage Journal

        Sounds like you need a simple mechanism for unique passwords. I have a suggestion for you to consider.

        Personally - I "salt" a standard password with the name of the website: the first initial of each of the words in a site's name for example. If my 'standard' password was for example "Aware20130530ness", and I was signing up for slashdot, I can simply add the letters to the start of the password, resulting in "sdAware20130530ness"

        Right, clever boy, and now that you have revealed this, it will be trivial for any cracker to include this pattern in their decryption script ... if it isn't already there (which is not impossible at all). Commonly used patterns such as the one you describe can be identified mathematically and easily applied to the decryption process. The added work of even 100 patterns absolutely pales in comparison to real brute-force, so you should expect crackers to get past your "salt" real easy.

        Making patterns like yours from the name of the website, or information in the usertable, is standard operating procedure when cracking.

        Stop doing it. It does little to help you. At the very least you should use a pattern containing characters not present in the website name, and not present in your user properties on the site in question.

        - Jesper

    • I've "given up" too. Until the pony is delivered, LastPass [lastpass.com] is a good solution. It supports Firefox, Chrome, and Dolphin on Android (have to subscribe to get the mobile support), which covers my needs, and uses local strong encryption so the LastPass people's can't get at your data. My first dog's name was jRffr9CDMNhD (I just generated that automagically with Alt-G - different for every site). It should be %6mjDYs*uwysVz%YYwTz2!7rcAt8!B%H, but too many websites don't sanitize input and have length limit

  • What method was used? (Score:3)

    by SplatMan_DK ( 1035528 ) on Thursday May 30, 2013 @07:54AM (#43859483) Homepage Journal

    While current phpass implementations support bcrypt it has not always been so, and the framework support many different methods.

    The article doesn't admit which method was used (suggesting they're not proud of their choice perhaps?). Does anyone know what method was used?

    The articles at Ars mentioned by multiple ./ers here, were based on MD5 (which is totally unsuitable for passwords btw). So don't panic until the method used by drupal.org has been revealed.

    - Jesper

Slashdot Top Deals

Keep up the good work! But please don't ask me to help.

Close