Security flap as Finnish password hashes posted online
PrintLogin looting not unlikely
Posted in Crime, 15th October 2007 16:51 GMT
Free whitepaper – Systems management simplified
Hacking pranksters have caused a rumpus in Finland by posting the account and login details of thousands online.
The information - usernames, email addresses, some passwords and many more uncracked password hashes of almost 79,000 user accounts - are largely from different Finnish web forums. By itself that's bad enough, but the possibility that many on the list use the same password for more sensitive online banking accounts and the like creates an even more significant security risk.
Matching the hashes corresponding to weaker passwords on list to their plain text values is straightforward enough using password dictionary tools and the like. So the 4.5MB list could serve up rich pickings for potential fraudsters.
The motives for and methods used in the attack, much less its perps, remains unclear.
Local security firm F-Secure compares the attack to the publication of hundred of passwords to different embassies and government organisation by Swedish hacker Dan Egerstad six weeks ago. Egerstad siphoned off this information by running rogue TOR exit node servers. In this case, the password hashes were probably obtained by hacking into the servers of several Finnish web forums, F-Secure reckons. ®
What Exchange can't do - and Dell can
Enabling The Agile Data Center
Analyst Keynote: The Register Agile Data Center Summit
Analyst Keynote: The Register Agile Data Center Summit
Breaching Fort Apache.org - What went wrong?
Snow Leopard security - The good, the bad and the missing
US Dems fill inboxes with 419 scams
BlockMaster SafeStick hardware-encrypted USB drive