Linux Mint site and forum hacked, contaminated ISOs and stolen passwords


Klumpen

Run away! Run away!
Joined
Nov 19, 2011
Messages
8,571
Location
Uncanny Valley
@Klumpen : you should never use the same password for everything...

Not for everything but I've got two passwords for all boards, another one for eMail and another one for system stuff.
They were a bit similar though so I made them less alike this morning.
I have to be able to remember this stuff when I'm out of town, so I guess having a variation at the end depending on the website's name is the way to go then.

BTW: Here's a nice site to check which of your eMail addresses have been compromised due to hacks of websites:
https://haveibeenpwned.com/
It correctly showed the Mint hack for the connected address, how do they do that?
Another eMail-address had an entry for a hack of nexusmods.com. -.-
 

PowerGod

Forum Addict!
Joined
Jun 20, 2011
Messages
4,018
I think that site just point out where the lists containing the email where released, not the forums where you were subscribed with it.

I tried searching for one of mine and showed me some forums I have never been, but were all pointing about a leak that gmail had years ago.

EDIT: and actually all the sites contains exactly the same list
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
14,739
Location
Somewhere off the coast of the EU
Yeah, it just scans various hacker forums and notifies you if your email address turns up on them. Those forums, or pastebin, or what have you is not where you have an account, it's where various hackers who have your email address have accounts.
 

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
As long as they're using a suitably salted hashing algorithm it shouldn't make a difference, the hash for one board would be completely useless for any other board, even with rainbow tables.
I'm really hoping that the mint forum is only informing you to change your password as a precaution for publicity, not because they didn't properly store the passwords.
 

lunixbochs

Moderator
Staff member
Joined
Sep 18, 2011
Messages
742
As long as they're using a suitably salted hashing algorithm it shouldn't make a difference, the hash for one board would be completely useless for any other board, even with rainbow tables.

You don't submit a hash to login. You submit the actual password, so salt won't affect the ability to login to another forum. Per-hash salt just prevents an attacker from using rainbow tables and slows down cracking (because you must crack hashes individually instead of as a group).
 

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
You don't submit a hash to login. You submit the actual password, so salt won't affect the ability to login to another forum.
Yes, but that's all these hackers should have: hashes. Assuming a salt, they can't use rainbow tables (as we've both said now), the only way to recover a password is brute force, but that doesn't recover *the* password, just *a* password. Even if they do hit a collision, the odds of that collision actually being your password are staggeringly small as to be pointless to even consider (baring simple passwords less than 8 characters long): at worst they will get a password which matches the salted hash for that one forum, if they put it in to any other forum with a different salt it won't work. At best they'll just waste their time trying to find a collision that won't come for several years of computation.
 

Björn

Member
Joined
Aug 18, 2013
Messages
92
That's why I started using a password manager. I avoided it for a very long time, because that one password database is a single point of failure, but honestly I trust myself more than I trust half a dozen sites with not compromising my password.
 
Top