Perfect Passwords | TechSNAP 11

chris

11 years ago

We’ve got the details of an FBI raid that knocked several popular sites off-line.

The WordPress plugin repository was compromised, and backdoors were added to a few popular plugins, and we’ll share the details.

Plus Dropbox’s shockingly bad security issue this week, and we’ll cover why you always want a little salt with your passwords!

All that and more, on this week’s TechSNAP!

Direct Download Links:

Subscribe via RSS and iTunes:

[ad#shownotes]

Show Notes:

TechSNAP has a new Sub-Reddit, submit links and questions for the show, and vote away!

Topic: FBI raids data center and takes 3 entire racks

At 1am on Tuesday the FBI raided the Virginia, USA data center of Swiss web hosting company DigitalOne.
DigitalOne’s website was still offline late Wednesday
DigitalOne does not have any staff on-site, and relies on remote hands from the data center operator, CoreSite. DigitalOne was not aware of what the problem was until hours later when the data center contracted them and passed along the name of the agent in charge and a phone number for DigitalOne to contact the FBI.
When requested DigitalOne had given the FBI information on the IP address they inquired about and told them the exact location of the server. However the FBI seized 3 entire racks of servers rather than only the server they were after.
There are rumours that this raid was related to an investigation in to LulzSec
A number of services like Pinboard and Instapaper were effected.

Topic: WordPress.org gets hacked, plug-ins compromised

WordPress.org is not sure exactly what happened
Plug-in repository compromised
Malacious code was found in commits to popular plugins like W3 Total Cache, AddThis and WPTouch
WordPress took the prophylactic step of forcing all users to reset their passwords to prevent any further compromised code from being pushed out.

Topic: Adobe patches two 0-day exploits in 9 days

Adobe issued a second ‘out of band’ security update for Flash player in only 9 days due to another exploit
Reportedly, one of the 0-day exploits was being used to steal users’ gmail passwords
The vulnerability was listed as critical, as it might allow an attack to take complete control of a system
Nightmare scenario is a trusted page is compromised and flash malware is inserted
Make sure you update to the latest version of Adobe Flash

Topic: Dropbox goes passwordless, for 4 hours

A flaw at dropbox allowed users to login with any password, and access the account
This means anyone who knew your email address could have accessed your account and files. They could have authorized additional devices so they can continue to access your files even once this flaw was fixed.
Dropbox claims less than 1% of users logged in during that time (seems low)
Official Notice from Dropbox
If dropbox used proper encryption with one key per user, files could not be accessed without the correct password. However this security measure would take away a lot of the ‘easiness’ of dropbox that people are so fond of.

Topic: Bitcoin currency exchange compromised

The major bitcoin currency exchange MtGox had it’s database compromised and was taken offline when a large number of fraudulent trades were made, swinging the market.
The compromised account sold all of it’s coins, forcing the market price down, then bought them all back, and tried to cash out
Accounts that had not been used recently, had not had their passwords upgraded from the original unsalted md5 hash to the standard FreeBSD crypt() md5 salted hash.
MtGox managed to get a hold of someone at google and google forced all users with gmail accounts at MtGox were forced to reset their passwords
Once MtGox is back up, they plan to switch to SHA-512 salted hashes.
MtGox claims that the computer of a 3rd party auditor who had read-only access to the database was compromised, and then insecurely hashed passwords were cracked and those accounts were then used by the attackers.

Q: (Keith) Can you explain salted hashing and two factor authentication in more detail?
A: Some websites, especially older forums and bespoke software, will store your password as a plain md5 or sha1 hash. These can easily be broken by a rainbow table, and can also be brute forced rather quickly using GPUs. To protect passwords against rainbow tables, modern password hashing algorithms use a ‘salt’. A salt is just some random characters added to the password to make it better. In the FreeBSD crypt() MD5, the default is 8 base64 characters. This means that the rainbow table would have to include those extra 8 possible characters to be able to crack the password. Also, the salt is different for each account, so that means a separate rainbow table would be required for each user, and that two users with the same password won’t have the same hash. What many people don’t realize when they try to implement their own password hashing using regular md5, is that the FreeBSD crypt() md5 does 100 rounds of hashing, not just one. This was sufficiently slow when ti was design, but is much less so now. That is why other algorithms, like SHA-512 and Blowfish have become more popular. On top of having larger salts (16 and 22 characters respectively), they use an adjustable number of rounds of the hashing algorithm. This allows the administrator to decide on a performance/security trade off that best fits their needs.
Lecture notes by Allan on how Password Hashing Works

To answer the other part of your question, multi-factor authentication means using more than one way to confirm the user is who they claim to be. Two-factor authentication just means using 2 of the 3 factors to confirm the users identity, rather than just one. The three types are:

Something you know (username/password, secret question, pin #)
Something you have (ID card, security token, RFID, Cell phone)
Something you are (Fingerprint, Retina Scan, Signature, Voice sample)

So, the typical ATM card system, is who factor authentication, something you have (bank card) and something you know (pin number), however, the pin number is not a very strong authenticator. As we’ve seen in recent weeks, even a security token can be compromised, and some forms of attack like the ZeuS trojan, just wait until you authenticate to perform their attack.

Show Notes:

Bitcoin Blaster:

Lulz Roundup:

Lightning Round:

Download & Comment: