It is currently Thu Mar 28, 2024 11:29 am View unanswered posts | View active topics |


Board index » Community » Computers & Technology


Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 9:45 am 
Decent Challenge
Decent Challenge
User avatar

Joined: Mon Jun 07, 2004 10:02 pm
Posts: 416
http://krebsonsecurity.com/2013/11/cupi ... passwords/

20
Nov 13
Cupid Media Hack Exposed 42M Passwords

An intrusion at online dating service Cupid Media earlier this year exposed more than 42 million consumer records, including names, email addresses, unencrypted passwords and birthdays, according to information obtained by KrebsOnSecurity.

The data stolen from Southport, Australia-based niche dating service Cupid Media was found on the same server where hackers had amassed tens of millions of records stolen from Adobe, PR Newswire and the National White Collar Crime Center (NW3C), among others.

The purloined database contains more than 42 million entries in the format shown in the redacted image below. I reached out to Cupid Media on Nov. 8. Six days later, I heard back from Andrew Bolton, the company’s managing director. Bolton said the information appears to be related to a breach that occurred in January 2013.

“In January we detected suspicious activity on our network and based upon the information that we had available at the time, we took what we believed to be appropriate actions to notify affected customers and reset passwords for a particular group of user accounts,” Bolton said. “We are currently in the process of double-checking that all affected accounts have had their passwords reset and have received an email notification.”
A redacted screen shot showing several of the stolen user accounts. Passwords were stored in plain text.

A redacted screen shot showing several of the stolen user accounts. Passwords were stored in plain text.

I couldn’t find any public record — in the media or elsewhere — about this January 2013 breach. When I told Bolton that all of the Cupid Media users I’d reached confirmed their plain text passwords as listed in the purloined directory, he suggested I might have “illegally accessed” some of the company’s member accounts. He also noted that “a large portion of the records located in the affected table related to old, inactive or deleted accounts.”

“The number of active members affected by this event is considerably less than the 42 million that you have previously quoted,” Bolton said.

The company’s Web site and Twitter feed state that Cupid Media has more than 30 million customers around the globe. Unfortunately, many companies have a habit of storing data on customers who are no longer active.

Alex Holden, chief information security officer at Hold Security LLC, said Bolton’s statement is reminiscent of the stance that software giant Adobe Systems Inc. took in the wake of its recently-disclosed breach. In that case, a database containing the email and password information on more than 150 million people was stolen and leaked online, but Adobe says it has so far only found it necessary to alert the 38 million active users in the leaked database.

“Adobe said they have 38 million users and they lost information on 150 million,” Holden said. “It comes to down to the definition of users versus individuals who entrusted their data to a service.”
34 million Cupid users registered with a Yahoo, Hotmail or Gmail address. 56 Homeland Security Dept. employees were looking for love here as well.

34 million Cupid users registered with a Yahoo, Hotmail or Gmail address. 56 Homeland Security Dept. employees were looking for love here as well.

The danger with such a large breach is that far too many people reuse the same passwords at multiple sites, meaning a compromise like this can give thieves instant access to tens of thousands of email inboxes and other sensitive sites tied to a user’s email address. Indeed, Facebook has been mining the leaked Adobe data for information about any of its own users who might have reused their Adobe password and inadvertently exposed their Facebook accounts to hijacking as a result of the breach.

Holden added that this database would be a gold mine for spammers, noting that Cupid’s customers are probably more primed than most to be responsive to the types of products typically advertised in spam (think male enhancement pills, dating services and diet pills).

Bolton adopted a softer tone in the second half of his email, indicating that the company may not have understood the full scope of the intrusion.

“Since you have now provided additional information we now have a clearer picture of what transpired back in January,” Bolton wrote. “We are currently in the process of double-checking that all affected accounts have had their passwords reset and have received an email notification.”

Bolton continued:

Subsequently to the events of January we hired external consultants and implemented a range of security improvements which include hashing and salting of our passwords. We have also implemented the need for consumers to use stronger passwords and made various other improvements.

We would like to thank you for bringing this issue to our attention and I can confirm that we are committed to investigate this matter further and make any additional improvements still required. Protecting our customer’s privacy and data is important to us and we will continue to make additional investments in improved security for our members. We sincerely apologize for the inconvenience this has caused our members.

It is entirely likely that the records I have seen are from the January breach, and that the company no longer stores its users’ information and passwords in plain text. At least Cupid Media doesn’t send your password in plain text when you request a password reset, like far too many other companies do. It’s also remarkable that a company with this many users would not have seen this coming. Back in Feb. 2011, I broke a story that received considerable media attention; it was about a hack that exposed some 30 million customer records at Plenty Of Fish (pof.com), an online dating service that also admitted to storing its users’ passwords in plaintext.

In any case, since I didn’t have to crack any of the passwords, I thought it might be useful to have a look at the top passwords used by Cupid Media customers. It seems that many Cupid users did not place much value in their accounts when picking passwords, because a huge percentage of them chose downright awful passwords. By my count, more than 10 percent of Cupid’s users chose one of these 10 passwords:

Image

The top 10 non-numeric passwords are probably typical for a dating site, but still horrible nonetheless:

Image

_________________
Image


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 10:27 am 
Onionhead
Onionhead
User avatar

Joined: Thu May 20, 2004 6:38 pm
Posts: 7559
Location: Houston
33,000 people randomly came up with "azerty" that seems hard to believe

_________________
RIP Shiloh - I'll never forget ya


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 11:48 am 
Decent Challenge
Decent Challenge
User avatar

Joined: Mon Jun 07, 2004 10:02 pm
Posts: 416
It's just a variation of 'QWERTY'

Also, it's 33000 of 42,000,000 passwords
It's not even 1 tenth of a 1%.

_________________
Image


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 12:55 pm 
Crumpet
Crumpet
User avatar

Joined: Thu Jul 01, 2004 5:57 am
Posts: 5363
Location: England
Whisp wrote:
33,000 people randomly came up with "azerty" that seems hard to believe

AZERTY is the French keyboard layout.

Image

Random trivia time:

The modern keyboard layout is designed around spacing commonly used letters far away from each other, so other languages (that have different letters as their more common ones) use different keyboard layouts.

The actual reason for this was because typewriters that used a simple ABCDEF alaphabet layout were too fast to type on, causing seasoned typists to constantly jam their typewriter. QWERTY (and all it's language variants) were therefore designed to make people type slower.

We ended up keeping it because having commonly used letters spaced far apart ended up being even faster once accustomed to it, due to being able to use both hands more efficiently to type. Luckily by then we'd moved away from old jamming typewriters. The more you know!


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 1:34 pm 
Decent Challenge
Decent Challenge
User avatar

Joined: Mon Jun 07, 2004 10:02 pm
Posts: 416
The more you know indeed :)

_________________
Image


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 1:39 pm 
Spammer, to the max!
User avatar

Joined: Mon May 17, 2004 1:29 pm
Posts: 1887
yea, I was going to post that AZERTY is the European keyboard layout, but glad I didn't since I would have been generalizing if it's only used in France :P

I'm also surprised that "summer" didn't show up as one of the most common passwords since it was used a lot back in the AOL days.


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 4:18 pm 
Honey Muffin
Honey Muffin
User avatar

Joined: Fri Nov 05, 2004 8:05 pm
Posts: 1459
its kinda sad, seeing all the love related passwords for a dating site. poot lonely, hacked, peoples :(


Top
 Profile  
 
 Post subject: Re: Cupid Media Hack Exposed 42M Passwords
PostPosted: Wed Nov 20, 2013 4:26 pm 
Posts way too much
Posts way too much
User avatar

Joined: Fri May 21, 2004 1:07 am
Posts: 4142
Location: Oregon
I don't have anything against the site, but I'd probably (playfully) tease anyone who used a password like.

Bunch of Stage 5 Clingers! :D

_________________
Image


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

Board index » Community » Computers & Technology


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group