Kickstarter Hacked, Customer Data Stolen

CommanderFrank

CommanderFrank

Cat Can't Scratch It
Joined
May 9, 2000
Messages
75,399
Kickstarter disclosed today that its security was breached this week and an unknown amount of customer data was stolen. The breach was fixed quickly, but the company recommends that all accounts change their passwords as a precaution.

The company learned of the breach on Wednesday from law enforcement officials.
Click to expand...
 
Bloody fools were using SHA1 for the passwords. Might as well be flipping plaintext.

They have switched to bcrypt now.
 
Saw this earlier, already changed my password..... Didn't know they were using SHA1..... <sigh>.....
 
Slow hash algorithms and multi-factor authentication are the only things that are going to stop this, until then fucking everything is going to keep getting hacked because there is too much profit in it.
 
I think every website should have to publish what hash they are using so people can avoid ones that use weak and old ones.
 
This isn't going to help my Kickstarter. Jeez hackers wait till my campaign is over! :p
 
Older passwords were uniquely salted and digested with SHA-1 multiple times. More recent passwords are hashed with bcrypt.
Click to expand...

Just to help inform those who have issues reading.
 
LonerVamp said:
I'd hate to see the logs every time someone accesses their system. :)
Click to expand...

Normally you don't look at who logged into the system through normal means, you look at who accessed the system through ways that a system admin would be logging into the system. you look for commands that normally shouldn't be ran or if they do you want to know about it.

you want to know if somebody dumps a copy of the database. Even if you are doing a backup yourself you would like to know ever time that is ran that way if you notice a time it is ran when nobody should have been doing something you know you might have a breach. If somebody logs into SSH on a server at 1am from Asia and you only have American employees and are normally only in the servers between 8 am to 5 pm unless there is an issue you know somebody got in that shouldn't have...
 
Shit I don't remember if I ever set up an account... there have been times I wanted to donate but haven't.

Either way chalk it up to making it easier for the consumer to give money by storing all their information online... YAY!
 
You must log in or register to reply here.
Back
Top