Be Aware, Hacking Group Releases 1000s of Account Info

[gschwendt]

Report: LulzSec hacking group releases thousands of account logins, includes Xbox Live and Facebook
Adding to the list of game-related companies it has attacked, LulzSec yesterday claimed to have stolen and leaked the login and password information for approximately 62,000 "internet accounts," reports the CBC. The stolen info is said to comprise logins/passwords from Facebook, Twitter, "dating sites," PayPal and, notoriously, Xbox Live. It is also claimed that the majority of accounts are from the United states, though several other countries are named in the report.

The account database info is still currently available through the LulzSec website (though we'd suggest not visiting) -- various folks on Twitter responding to the group claim to have done a variety of things with the information, from having a large pack of condoms delivered to an elderly woman, to one person saying they bilked a PayPal account for £250 ($404).

Earlier this week, the group attacked and successfully took down a handful of game industry websites, including EVE Online, Minecraft and The Escapist. All three sites quickly recovered and have been online since. Microsoft has yet to respond to request for comment on yesterday evening's alleged breach.

Update: Microsoft has released a statement, which states that Xbox Live was not compromised to the best of Microsoft's knowledge, and the logins/passwords were released at random, with people encouraged to try said information on services like Xbox Live (among others). "This group appears to have posted a list of thousands of potential email addresses and passwords, and encouraged users to try them across various online sites like Xbox Live in the event one of the users happens to use the same password and email address combination. At this time we do not have any evidence Xbox Live has been compromised. However we take the security of our service seriously and work on an ongoing basis to improve it against evolving threats."

----------

Best to use caution, if you haven't changed your passwords in six months, it's best that you change them now.

If you use a Google account, you can setup alerts that notify you when your name, email address, or other info is posted somewhere on the web. To do so, goto http://google.com/dashboard, then modify the Me on the Web settings to your liking.

With Anonymous and LulzSec hacking left & right, it's best to be as safe as possible.

[psusnoop]

Thanks G, always good to get this information out and just give the heads up to be careful and err on the side of caution.

[gschwendt]

Dazzlepod (web development group) has put together a searchable list to see if your account was listed among the recent LulzSec accounts.
http://dazzlepod.com/lulzsec
For your privacy, do not enter your complete email in the search box. Try using the first part of your email instead, e.g. example instead of example@example.com.

[baseballplyrmvp]

they bought $120 worth of stuff from the xbl marketplace with my xbl account.

*edit....my email isnt on the list, but the time period fits with this attack. stupid fuckers

[gschwendt]

What I'd probably recommend to everyone that is concerned (which everyone should be to some degree depending on how big your online profile is), is if you use the same password everywhere, stop. While i realize that sounds difficult, what you can do is come up with a password scheme, and then modify that for various sites.

I am by no means a web security expert but here is where I would suggest everyone start:

1) Come up with a 5 letter word or phrase. I can be anything your heart desires.
2) Change one of the characters to a capital letter
3) If a phrase, add in a special character somewhere in place of a space like a ! or a ~; if a word, just insert it in the middle randomly.
3) Next, replace one or more of the characters with a number, something that will make you realize why you did so... example, a 6 looks like a G or a 8 looks like a B.
4) Finally, on each site that you have a password, insert 2-3 characters in front of your password to designate which site it's for. For example, your password could be t6T_gR!ll [tgt_grill] (I don't recommend using that anywhere).

It basically goes back to the old commercials for ADT, a hacker would rather have an easy job hacking your account rather than a hard job. I don't remember the specific statistics but I remember reading once that a hacker using an automatic data-entry software can run through every possible variation of a lowercase 8 letter phrase in less than 5 minutes. By including a number, that adds X number of minutes, and then by including capital letters and special characters, it multiplies it even greater to where the hacker has essentially wasted his time.

Now add in the recent cases of hackers stealing account info and then posting it, there's a good chance that if you are using the same password everywhere, so they'll start trying that information on paypal, large banks, facebook, email, etc. until they finally get a match.

[JBHuskers]

Dazzlepod (web development group) has put together a searchable list to see if your account was listed among the recent LulzSec accounts.
http://dazzlepod.com/lulzsec
For your privacy, do not enter your complete email in the search box. Try using the first part of your email instead, e.g. example instead of example@example.com.

Thanks for posting that....in the clear on that list.

[SmoothPancakes]

Thanks for the heads up man. My email is in the clear and doesn't show up, but I'm definitely going to start changing shit up. I, unfortunately, have over time turned into the habit of using the same password for multiple stuff. As well, I haven't changed my password on a number of sites in a long ass time. Something I actually like about work since corporate forces us to change our email and employee account passwords every 3 months.

I'll just have to go buy a little palm size notepad or something and write down my list of sites and the current password for them (after I change them) and keep that located in a drawer near my laptop so I don't end up forgetting the password, but also so I can keep changing my passwords up every so often and just scratch out the old and write in the new.

With as batshit insane as Anon and Lulzsec are getting lately with this hacking shit, definitely time for very drastic measures to stay protected.

[morsdraconis]

Even adding just one number to a word that's 7-9 letters long results in an exponentially longer amount of time for them to figure out the password. It helps that much more if you don't use a common word/phase. I use something far different from the normal stuff with a number juxtaposed in there and it's worked fine for me for a long time (granted, I've never had my shit stolen before either).

[SmoothPancakes]

Even adding just one number to a word that's 7-9 letters long results in an exponentially longer amount of time for them to figure out the password. It helps that much more if you don't use a common word/phase. I use something far different from the normal stuff with a number juxtaposed in there and it's worked fine for me for a long time (granted, I've never had my shit stolen before either).

Yeah, my main password has multiple numbers interspersed amongst a bunch of entirely random letters, all in completely random order, all different numbers, all different letters. It was actually the password that I was assigned by the IT department when I first started college, and it was complex enough, that it would take a hell of an effort to figure it out.

I've gotten a little bit lazy, making my passwords recently based on my original password I got from the IT department at work, which isn't as complex or great as my password I had in college. So I'll probably start changing password on various sites and accounts, mainly those dealing with my bank account (Xbox, eBay, Paypal and email, which at least thankfully is through my ISP and not something like Yahoo, MSN or Gmail) and change them to a variation of the very complex, extremely randomized, 10+ character password.

If anything, it'll be just to update my passwords on those sites since they haven't been changed in a while, and make the password exponentially harder to possibly figure out for those accounts for increased security.