Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Security researchers have set up a website that allows punters to check whether or not their email addresses have appeared in data dumps slurped from compromised databases.

Hacking attacks on sites including Gawker and the network of Sony's gaming division have led on to the publication of hundreds of thousands of users' credentials online, sometimes (but not always) by activists at Anonymous.

A new site - called Pwnedlist.com - aims to plug this information gap. Users enter a username or email address into the site’s search box to find out if their username has appeared in any recent public data dumps. Users are not prompted to enter their password itself.

If a username or email address appears on the list, users are advised not to panic and to simply change their passwords. There's also sensible advice of offer on password security even if credentials are not on the list.

The service includes five million records and was established by Alen Puzic and Jasiel Spelman, security researchers from DVLabs - a division of HP TippingPoint.

"Data entered is not stored, re-used, or given to any third parties," the terms and conditions of the site explain. Tech savvy users can submit a SHA-512 hash of their email address or username as input instead of the plaintext version.

Puzic and Spelman explain the pwnedlist project, and how they would like to develop it, in an interview with KrebsOnSecurity.com here.

Pwnedlist.com is nicely done and serves a useful purpose, for example, in cases where net users needed proof that their online identity has been compromised.

However any similar services that crop up might not be so well done: encouraging users to hand over even part of their logins credentials to supposed security checking sites is not necessarily good thing, Carole Theriault of Sophos notes.

"These types of service could also raises a concern: what is to stop a malicious site, masquerading as a helping hand, request usernames (or even passwords) from internet users? Indeed, we have seen many nasty sites pretend to be legitimate or reputable over the years," Theriault writes.

Theriault concludes that if users even think their logins might have been compromised they ought to change their credentials, whether or not they are able to confirm that they have indeed been pwned. She concludes with some password tips of her own in a blog post here. ®

Agentless Backup is Not a Myth