Last week there was no escaping news of the latest data breach. The LinkedIn hack of 2012 which we thought had “only” exposed 6.5M password hashes (not even the associated email addresses so in practice, useless data), was now being sold on the dark web.
It was allegedly 167 million accounts and for a mere 5 bitcoins (about NZ$3.3k) you could jump over to the Tor-based trading site, pay your Bitcoins and retrieve what is one of the largest data breaches ever to hit the airwaves.
From LinkedIn officially:
|You may have heard reports recently about a security issue involving LinkedIn. We would like to make sure you have the facts about what happened, what information was involved, and the steps we are taking to help protect you.|
|On May 17, 2016, we became aware that data stolen from LinkedIn in 2012 was being made available online. This was not a new security breach or hack. We took immediate steps to invalidate the passwords of all LinkedIn accounts that we believed might be at risk. These were accounts created prior to the 2012 breach that had not reset their passwords since that breach.|
|What Information Was Involved?|
|Member email addresses, hashed passwords, and LinkedIn member IDs (an internal identifier LinkedIn assigns to each member profile) from 2012.|
|What We Are Doing|
|We invalidated passwords of all LinkedIn accounts created prior to the 2012 breach that had not reset their passwords since that breach. In addition, we are using automated tools to attempt to identify and block any suspicious activity that might occur on LinkedIn accounts. We are also actively engaging with law enforcement authorities.|
|LinkedIn has taken significant steps to strengthen account security since 2012. For example, we now use salted hashes to store passwords and enable additional account security by offering our members the option to use two-step verification.|
|What You Can Do|
|We have several dedicated teams working diligently to ensure that the information members entrust to LinkedIn remains secure. While we do all we can, we always suggest that our members visit our Safety Center to learn about enabling two-step verification, and implementing strong passwords in order to keep their accounts as safe as possible. We recommend that you regularly change your LinkedIn password and if you use the same or similar passwords on other online services, we recommend you set new passwords on those accounts as well.|
|For More Information|
|If you have any questions, please feel free to contact our Trust & Safety team at firstname.lastname@example.org. To learn more visit our official blog.|
A list of the worst passwords in the LinkedIn hack is remarkably familiar, but unremarkably depressing.
A list of the most popular passwords used by LinkedIn in 2012, at the time of the hack that recently came to light (again), was published by LeakedSource. The cache of 117 million accounts were hashed with the SHA-1 algorithm, a once-strong hashing system that was recently pushed into deprecation as it could be cracked.
But because the passwords weren’t salted — a process that makes it harder to decrypt.
It’s estimated that about 90 percent of the passwords were decrypted — a figure that will likely grow over time.
Last year — which would’ve been two years after the LinkedIn breach — the most popular password was, unsurprisingly, at the top of this list.
Anyone with 123456 as their password deserves to have their account hacked in my opinion.