Topic: Groupon India leaks SQL database, plain text passwords

• Groupon’s Indian subsidiary Sosasta.com accidentally published an SQL dump of it’s users table, including email addresses and passwords. The file was indexed and cached by google, so even once it was taken down, it was still visible.
• This raises the question as to why the passwords were ever stored in plain text, instead of as salted hashes
• Does the North American version of Groupon also store user passwords in plain text?
• Leaked data was found by a security researching using a google search query for “filetype:sql” “password” and “gmail”
• Once Sosasta was notified of the issue, they started sending out emails to their customers recommending that they change their password. This is definitely the wrong approach, the passwords were leaked, in plain text. All accounts should have had their passwords forcibly reset and a password reset email sent to the customer. Otherwise, customers may have their account compromised before they can change their password, and customers who no longer use the service will have their personal information exposed.

shouldichangemypassword.com – Check your address

Submitted by: refuse2speak

Topic: EA Forums hacked, Sega Database Compromised

• a “Highly sophisticated cyber attack” was used to compromise the database of the forums for Bioware’s Neverwinter Nights.
• Stolen data included username, password, email, and birth date
• How many users were effected was not specified
• EA says no credit card information was in the stolen database
• Sega was also compromised, 1.29 million customers had their data exposed via the website of the European unit’s “Sega Pass” website.
• Again, username, password, email and birth date were exposed, but it appears that no financial information was leaked.

TechSNAP reminds you: use a different password for every service. We know it’s hard, but cleaning up behind an identity thief is worse.

Submitted by: Raventiger

Topic: US Government Study shows alarming attack vector

• 60% of Government or Contractor employees who found a USB stick or CD on the ground outside their office plugging the device in to their computer.
• 90% of the employees installed the software if it had an official looking logo on it.
• This is reminiscent of the StuxNet worm, which targeted isolated computers that were not on the Internet. It is believed that they were infected via a hardware device containing the payload.

Topic: Research reveals that pin numbers are predictable

• 15% of iPhones could be unlocked in fewer than 10 tries using the most common pin codes
• The most common first character in a pin number is 1
• The most common second character is 2
• The values 1980 through 2000 make up a huge portion of the top 100 pin codes, meaning if you know or can guess a users date of birth, you can increase your chance of cracking their code
• Other popular codes include repeating digits or patterns, such as 2222 or 1212, or lines drawn on the input screen, such as 2580, 0852 or 1241
• Another popular value is 5683, which didn’t seem to fit any pattern until you realize that is spells ‘love’ with standard phone letter substitution.
• This means that if you know the users birthday and relationship status, you can increase your chance of cracking their pin code just by applying a little statistical analysis. If you can shoulder surf them, and further reduce the pool of possible codes, you can almost guarantee success.
• Users tend to reuse passwords, if you guess their phone password, there is a good chance that is also their ATM pin. Either way, the exact same techniques can be applied to ATM, Voicemail and other pin codes.

Feedback:

Q: (Bob) How did Chris and Allan meet
A: Chris and Allan first met in April 2009 when Jupiter Broadcasting moved their IRC chat to GeekShed.net. In January 2010 Allan won a closed beta invite to Star Trek Online during a STOked trivia contest on IRC. During the ramp up to open beta, JupiterColony.com was receiving so much traffic that it was suspended by the web host, and was moved to ScaleEngine.com. Later on, Allan guest hosted a few episodes of the Linux Action Show while Bryan was away, and they went so well that Chris and Allan decided to start their own show.

Q: (Leon) How do you handle spam filtering on your servers?
A: For my web hosting customers, we use 4 main mail servers (running Exim with mail time SpamAssassin). The four mail servers ensure that incoming mail is always received, even if one or more of our servers is down at any time. These servers automatically run the incoming mail through the SpamAssassin scoring system, and if the spam score exceeds a specific threshold, then the mail is automatically rejected at SMTP time (so no bounce message is generated, an error is returned to the original sending server, this prevents misdirected bounces from spammers using forged from addresses). If the spam score is borderline, we do ‘grey listing’, temporarily rejecting the spam so it will be retried in a little while, this gives the DNS blacklists we use time to catch up, and most spammers never bother with retries. If the spam score is low enough then the mail is accepted. Once mail has arrived at one of our edge servers, it is then queued and sent on to our mailbox server, where it is sorted and delivered to the actual mailboxes of our users. SpamAssassin is run on the mail again, and users-specific settings determine what happens to the mail. Spam can be flagged (subject prefix, messages added as attachments to protect outlook from preview attacks) or directed to a spam folder.

Send us your questions and feedback!

Roundup:
Netflix shares insight on it’s cloud infrastructure
Netflix transitions to high availability storage systems
Researchers say Massive Botnet is Indestructible
DropBox CEO: Lone hacker downloaded data from ‘fewer than a hundred’ accounts
Spamming Becoming Financially Infeasible

Bitcoin BLASTER:
LinuxCoin – Bitcoin Live Linux CD – LOVES IT!
Article: Buying lunch with bitcoin – Submitted by Angela
Chris’ early bitcoin farm
Chris’ cheap and low power miner hardware.
Article: Bitcoin Comes Out Swinging off the Ropes
MtGox Apologizes