Formspring 420,000 lost passwords were encrypted, salted

Powered by SC Magazine
 

Moves quickly to disable passwords.

The social networking Q&A site Formspring has been hacked and had 420,000 password hashes stolen and published online.

The company disabled all user passwords following a tip off from a user who spotted the hashes on a forum early Monday morning.

An unknown attacker breached one of Formspring's development servers and managed to access account data stored in a production database, Formspring chief executive Ade Olonoh said in a blog post.

Usernames and other personal data were not posted along with the SHA-256 salted password hashes, according to Formspring.

"We apologise for the inconvenience, but prefer to play it safe and have asked all members to reset their passwords," Olonoh wrote.

Users will be prompted to change their passwords when they log back into Formspring.

Formspring has fixed the hole and upgraded its hashing mechanisms to bcrypt, a cryptographic hash function that is stronger because it is slow to compute. It was designed to become even slower to create lookup tables as processors became faster.

The incident is reminiscent of a breach announced last month by LinkedIn. Like Formspring, LinkedIn first learned of the compromise when a file containing hashes of member passwords appeared on a hacking forum.

However, LinkedIn had only hashed the passwords without using a salt.Hashing is a one-way encryption, where each string always returns the same cryptographic output.

It's not possible to take a hash and work out what the original input was, but lookup tables help figure out what the hashed value is.

Attackers create a rainbow table, which is essentially an immense directory of every conceivable string, including dictionary words, common surnames, well-known phrases, and just look up each hash to find the original input.

Formspring, however, had randomly salted these passwords before hashing them.

A salt is a random string unique to each user that is appended to the password, making the lookup process even more difficult and processor-intensive.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Formspring 420,000 lost passwords were encrypted, salted
 
 
 
Top Stories
ATO investigates 25 tech giants in tax hunt
Prepared to take tax evaders to court.
 
Immigration, Customs restructure IT leadership
Customs CIO promoted into transformation role.
 
NBN Co begins FTTB rollout
Will bring service to 6000 apartments.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 2921

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 906

Vote