Biz & IT —
MySpace, Tumblr, and Fling are the latest services to join discredited LinkedIn.
Dan Goodin -
Less than two weeks after more than 177 million LinkedIn user passwords surfaced, security researchers have discovered three more breaches involving MySpace, Tumblr, and dating website Fling that all told bring the total number of compromised accounts to more than 642 million.
"Any one of these 4 I'm going to talk about on their own would be notable, but to see a cluster of them appear together is quite intriguing," security researcher Troy Hunt observed on Monday. The cluster involves breaches known to have happened to Fling in 2011, to LinkedIn in 2012, and to Tumblr 2013. It's still not clear when the MySpace hack took place, but Hunt, operator of the Have I been pwned? breach notification service, said it surely happened sometime after 2007 and before 2012. He continued:
There are some really interesting patterns emerging here. One is obviously the age; the newest breach of this recent spate is still more than 3 years old. This data has been lying dormant (or at least out of public sight) for long periods of time.
The other is the size and these 4 breaches are all in the top 5 largest ones HIBP has ever seen. That's out of 109 breaches to date, too. Not only that, but these 4 incidents account for two thirds of all the data in the system, or least they will once MySpace turns up.
Then there's the fact that it's all appearing within a very short period of time - all just this month. There's been some catalyst that has brought these breaches to light and to see them all fit this mould and appear in such a short period of time, I can't help but wonder if they're perhaps related.
All four of the password dumps are being sold on a darkweb forum by peace_of_mind, a user with 24 positive feedback ratings, two neutral ratings, and zero negative ratings. That's an indication the unknown person isn't exaggerating the quality of the data. The megabreach trend is troubling for at least a couple of reasons. First, it demonstrates that service providers are either unable to detect breaches or are willing to keep them secret years after they're discovered. Second, it raises the unsettling question where the trend will end, and if additional breaches are in store before we get there?
Of the four recently discovered breaches, the one affecting the most number of people is the MySpace hack, which compromised 360 million accounts. While that's the biggest known breach to hit a single online service, password cracking experts are already dismissing the value of the compromised data. That's because Myspace engineers truncated passwords to 10 characters and converted all letters to lower-case.
Still, the MySpace dump, like the other recently unearthed breaches, is likely to create problems for any of the affected users who employed the same user ID and password on other sites. Readers who are among this group should change their passwords as soon as possible.
Promoted Comments
-
Rommel102Ars Praefectuset Subscriptor hlv wrote:
Rommel102 wrote:
No idea if this is related but my normally calm main email account got hammered today with spam. I had to manually filter out 40+ emails.
Very interesting... same thing happened to me. My Hotmail email was bombarded with spam all day.
Double interesting as mine is also Hotmail.
-
oldtakuArs Praetorianet Subscriptor So anyone using a decent password manager and big unique random PWs is fine, which is hopefully everyone here.
What's disturbing is the Tumblr thing - that was 3 years ago, they just decided to notify people about it this month, presumably because they were tipped that it was going to be made public, and they tried to play it down with the completely lame
https://staff.tumblr.com/post/144263069 ... -party-had
.
It took someone else to look at the data and tell us it was 65M accounts, not some iddle widdle passive voice breach. That's three years someone could have been messing with your Tumblr account, if anyone had the stomach for it.
Promoted Comments
-
Rommel102Ars Praefectuset Subscriptor hlv wrote:
Rommel102 wrote:
No idea if this is related but my normally calm main email account got hammered today with spam. I had to manually filter out 40+ emails.
Very interesting... same thing happened to me. My Hotmail email was bombarded with spam all day.
Double interesting as mine is also Hotmail.
-
oldtakuArs Praetorianet Subscriptor So anyone using a decent password manager and big unique random PWs is fine, which is hopefully everyone here.
What's disturbing is the Tumblr thing - that was 3 years ago, they just decided to notify people about it this month, presumably because they were tipped that it was going to be made public, and they tried to play it down with the completely lame
https://staff.tumblr.com/post/144263069 ... -party-had
.
It took someone else to look at the data and tell us it was 65M accounts, not some iddle widdle passive voice breach. That's three years someone could have been messing with your Tumblr account, if anyone had the stomach for it.
