LinkedIn admits site hack, adds pinch of salt to passwords
Biz network says it has upped security
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
LinkedIn has confirmed that the list of 6.5 million user passwords leaked yesterday is genuine.
The social network for suits said it was still investigating the situation, but it said the SHA-1-hashed password list posted on a Russian Dropbox-alike site contained real user data. LinkedIn has chucked compromised users' passwords out and will be sending them emails to let them know how to get a new one (full details of the process here).
Although the website's engineers hashed the stored passwords - a process that converts each one into a new long string of characters that are tough or impossible to convert back into the original password - they did not apply any salt.
By overlooking this technique, it is easy for hackers to produce a so-called rainbow table of hashes from possible passwords and search for these in the leaked list, thus identifying a significant number of the original passwords. Salting adds extra arbitrary data to a password when it is hashed, thwarting pre-generated tables and making life difficult for password crackers.
The firm said that its security has been tightened.
"It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases," the network said in a blog posting.
The company also apologised to its users for the breach.
Dating site eHarmony was also hacked, possibly by the same attackers that hit LinkedIn. The site said it was resetting the passwords of affected users and assured members that it used "robust security measures, including password hashing and data encryption". ®
COMMENTS
wtf
Wait, as an organisation with millions of users, LinkedIn didn't salt its password hashes? W.T.F.
may we ask how El Reg does it?
Does El Reg salt & hash our passwords?
Oh, and why is it still not using HTTPS, so we are susceptible to cookie-jacking?
No salt or pepper?
Not salting (and peppering) passwords is completely and utterly unforgivable for any login system but particularly so for a high-traffic website with so many registered users.
Hashed with SHA-1? SHA-256 should be a minimum these days.
And how on earth has someone been able to dump such a large amount of data from their databases?
Surely LinkedIn has enough dosh to buy someone who knows about this stuff?
Rather than wasting everyones time with the cookie warning laws maybe it would be a good idea to force website operators to state their password security procedures on the signin/registration pages.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
