Commenting Accounts Compromised — Change Your Passwords [gawker.com]

Our user databases appear to have been compromised. The passwords were encrypted. But simple ones may be vulnerable to a brute-force attack. You should change your Gawker password and on any other sites on which you've used the same passwords.

We're deeply embarrassed by this breach. We should not be in the position of relying on the goodwill of the hackers who identified the weakness in our systems. And, yes, the irony is not lost on us. For tips on creating strong passwords, see this post on Lifehacker.

The passwords were encrypted.

Gawker claims that the passwords are safe, yet the hackers posted the unhashed clear passwords as well.

In additional, Gawker lost its source code and CMS as well to these Wikileak fans.

After bringing the company’s websites to a standstill Sunday, one or more hackers operating under the name Gnosis released a 500 MB file apparently containing Gawker’s source code, commenter and staff passwords, and internal conversations between the company’s employees.

Update: Wikileak fans now target Gawker user's Twitter accounts with stolen passwords.

Users of Gawker Media’s Web site have just learned a harsh lesson in in using the same password for different accounts. Spammers have taken over thousands of Twitter accounts after Gawker’s servers were hacked on Sunday, giving cyber attackers access to passwords for 1.3 million passwords.

“You would think a site that likes to mock people, such as gawker, would have better security and actually have a clue what they are doing,” wrote the authors, who made repeated references to previous skirmishes between the site and the Anonymous hacking collective.

“You would think someone like Nick Denton who likes to run his mouth and taunts such an unforgiving mass like Anonymous, would use a more secure password than '24862486,'” they write elsewhere. “The sad thing is he probably believes this password is 'secure' because he likes to use it everywhere!”

Pretty scary stuff.

I'm guardedly optimistic that the W)k(l*@ks releases were legal or ethical. Some of the resultant actions of Anonymous are clearly illegal. Hang 'em high.


_{[edited for clarity]}

[edited by: grandpa at 5:40 pm (utc) on Dec 13, 2010]

If you use a single password, and you were registered on any of the Gawker sites, you really ought to be changing your passwords right now.

This Wikileaks fans are sure classy people - they have attacked private corporations, banks, individuals, and now government websites.

A group of hackers on Sunday threatened to attack British government websites if WikiLeaks founder, Julian Assange, is extradited to Sweden, according to The Telegraph.

UK warns over threat of cyber attacks by pro-WikiLeaks hackers against government websites

[abcnews.go.com...]

The good news, authorities will be able to hunt down those griefers perpetrating the attacks via LOIC.

Anonymous Wikileaks attackers 'easy' to find says study

The tool used in the attacks leaks the net addresses of everyone who used it, reveal Dutch computer scientists....

A look at the packets of data generated by LOIC showed the net address of an attacker in every one and revealed that "the tool does not take any precautions to obfuscate the origin of the attack" wrote the researchers.

[bbc.co.uk...]

I have every sympathy for the ideas behind wikileaks though it sounds like the Assange guy is on a bit of an ego trip. No sympathy at all for those who attacked amazon, mastercard, etc even if I do disagree with those companies' actions.

This Wikileaks fans are sure classy people

You keep saying that. The hackers Anonymous are fans for the moment, but they jump from cause to cause for their own entertainment. Wikileaks has nothing to do with those people. One day it's scientology, another it's wikileaks, tomorrow it's going to be some cat abuser.

Anyway... US government fans started this whole DDOS attacks against Wikileaks, so you could say US government fans (classy people, right?) are at the origin of this mess.

Anonymous screwed up this time. Waiting for the first #*$!ly faced hacker rambo to do a perp walk for the cameras.

The FBI and the Justice Department's computer crimes unit are searching for the hackers who launched Operation Payback, the Internet attack against companies that stopped doing business with WikiLeaks and its founder, Julian Assange.

Oh, sorry, did not know that 2 wrongs makes a right.

So for example, if some one commits murder, it gives you permission to do the same?

Its called moral equivalence and a BS excuse.

Oh, sorry, did not know that 2 wrongs makes a right.

I haven't made a judgment call about who's right or wrong, I mention what you conveniently ignore by focusing only on Anonymous' actions without the full context, and deliberately associating them with Wikileaks with a very biased rhetoric.

Sure, I am focusing on Anonymous's criminal action.

Let's review the differences.

DDOS attack on Wikileaks the work of one person protesting the release of stolen content that endangers innocent lives. Illegal.

DDOS attack on Paypal, Amazon, banks, governments, private individuals, dns provider, politicians, prosecutors, defense attorneys, alleged rape victims the work of an 'Anonymous' sponsored conspiracy involving thousands of individuals. Illegal and malicious.

Can you spot the difference?

Biased rhetoric?

It is very interesting that you characterize disdain for those who engage in criminal behavior like the Anonymous crowd as 'very biased rhetoric'.

[edited by: frontpage at 11:52 pm (utc) on Dec 13, 2010]

So now ANY comment on ANY Gawker media website should be viewed as fake. Nice to know, not that many of them didn't have motives before.

Operation Payback Has New Target: Corporate Fax Machines

[news.netcraft.com...]

WikiLeaks-inspired Java script DDoS planned

Tal Be'ery, web research team lead at Imperva, says: "By monitoring back channel communication, we have found recommendations to create a DoS utilizing Java script that can be run from browser with no installation required. The Anonymous Group plans to camouflage the Java script behind appealing content -- such as #*$!ographic images, to entice users into unknowingly executing attacks."

[blogs.csoonline.com...]

Absolutely no moral high-ground, just common criminals.

I wonder how the FBI investigation into the DOS attack on wikileaks is going.

Oh...

For those who want to find out if their email was compromised in the hacking of Gawker, there is a website available to check.

If you ever created an account at Gawker, Gizmodo, Jalopnik, Jezebel, Kotaku, Lifehacker, Deadspin, io9, or Fleshbot, your information was probably released (over half a million unique e-mail addresses and hashed passwords were released).

[slate.com...]

I wonder how the FBI investigation into the DOS attack on wikileaks is going.

Oh...

Why would the FBI investigate a DDOS attack on a website posting stolen content with intent to damange US national security? Sure, DDOS is illegal but so is hosting stolen content.

The FBI is focusing on hacking of legitimate websites.


FBI investigating Gawker hacking

[nypost.com...]

The intentional disruption of innocent bystanders lives by Wikileak supporters posting Gawker users email/passwords on the web has far reaching complications.

[blogs.forbes.com...]

Biased rhetoric?

Yes, biased. Because you disagree with Wikileaks, you keep trying to blur the line between Wikileaks and Anonymous in an effort to tarnish their name. That's disingenuous. Examples:

(...) to these Wikileak fans.

Wikileak fans now target (...)

This Wikileaks fans are sure classy people (...)

the work of an 'Anonymous' sponsored conspiracy

Yet attacks on wikileaks site would be the work of a single individual with good intentions. You don't know that. Your conspiracy theories only targets Wikileaks, not the other side.

the work of one person protesting the release of stolen content

I agree two wrongs does not make a right, however, I never said Anonymous actions were right, I only explained the context.

Sure, DDOS is illegal but so is hosting stolen content.

I thought we just said... nevermind.

Is Gawker at all responsible for weak password encryption? Or was Anon just able to publicize the credentials of those whose password was "password", etc.?

It's important to note that they didn't just leak usernames/passwords. Frank internal discussions were also leaked, analogous to the leaked embassy cables. See the comment by "MattyMattMatt" [lifehacker.com], in which a chat transcript is posted documenting Gawker employees referring to Gawker commenters as "peasants".

In fairness, I would imagine that the employees of every large online community have occasionally referred to its members in a derogatory manner, even if only in a passing, half-joking jab.

Tal Be'ery, web research team lead at Imperva, says: "By monitoring back channel communication...

Exactly my point, who's the more dangerous hacker now? those wanting to target sites or those who are "trusted" yet into monitoring (*cough* spying *cough*) in places they don't have a legal right to access.

Government and authority seems to be 10x worse than any common criminal could ever dream of being in terms of accessing things they don't have owner permission to access. Of course authority wants to monitor anyone who may monitor them too, such as wikileaks.

If government had no lies (like not knowing how that routers employee was killed during their appache slaughter) to hide there would be no wikileaks.

I'm not pro, or anti, government or hacker here either, it's just that the stupidity level has reached grand proportions on both sides and what heats me up is that EVERYONE gets dragged into it, everyone pays via loss of privacy.

Koan spot on, and my suggestion would be not to bother too much, some people are just meant to have their minds controlled.

see his interpretation from one of his previous comments

frontpage

You can literally purchase the Wikileaks cables from Amazon yet Wikileaks supports are targeting Amazon still for 'censorship'.

Just goes to show most of these folks really don't know what is reality.

So Amazon did not want to host Wikileaks, yet you can now purchase books with the Wikileaks cables as quotes from Amazon now, and this guy's main problem are these script kiddies who didn't even take Amazon down for one second. O sure that is where the real threat is.

what the people doing this dont realize is that Gawker is set up on the UK tabloid model and that Nick Denton is an ex tabloid man and that gives him an in with old media - and boy do the newspaper types all stick together even the Posh broadsheets and the NUJ will close ranks and protect their scumier brothers.

say Nick passes on some choice examples of 4chan behavior or real world ID's to the Daily Mail or the News of the world (who seem to have the Met police in there back pocket).

You would not want to be a 4chan user outed on the front page of the Daily Mail they would learn what the quaint english tabloid custom of "Monstering" is like - being busted by the Security Service would be more pleasant.

The spirited defense of Wikileaks posting stolen content and its supporters actively trying to damage innocent third parties is astounding.

However, in the public's eye the actions of Wikileaks supporters have unwittingly eroded sympathy for Assange. All those millions of innocent parties dragged into this situation by having their livelihood affected and private data leaked on the internet have been "Wikileaked".

you keep trying to blur the line between Wikileaks and Anonymous in an effort to tarnish their name.

"Earlier today Assange also backed the cyber attacks on Visa, Mastercard and PayPal from his prison cell, branding the companies 'instruments of U.S. foreign policy'.

"We now know that Visa, Mastercard, Paypal and others are instruments of US foreign policy. It's not something we knew before," Assange said in a statement likely to add new impetus to the spate of cyber attacks being perpetrated by Anonymous in support of WikiLeaks.

"I am calling on the world to protect my work and my people from these illegal and immoral acts."

[dailymail.co.uk...]

The poster instructs participants in the attack to use the MyFax free fax service at [myfax.com...] and recommends using a proxy to keep Anonymous, well, anonymous.

They sure didn't keep themselves anonymous DoSing from their home IP addresses hahah

"Earlier today Assange also backed the cyber attacks on Visa, Mastercard and PayPal from his prison cell, branding the companies 'instruments of U.S. foreign policy'.

Ahem, if someone says: "VISA and Mastercard are instruments of US foreign policy" this means he is backing cyber attacks? Thats a little far fetched.

Actually he made not a single statment backing any cyber or ddos attacks.

Actually he made not a single statment backing any cyber or ddos attacks.

If you actually read the link I posted, that statement is verbatim from the paper.

Another interesting development is that the attacks on the Wikileaks sites are coming from China and Russia but somehow the USA gets blamed.

Mark Stephens, a defense attorney for Assange "said that WikiLeaks’ technicians believe that the attacks on Wikileak websites appear to be coming from Russia and China."

this guy is drinking a little too much of his own kool aid.

@ J_RaD

hehe good one, and true in the same time...he has his mind set

If you actually read the link I posted, that statement is verbatim from the paper.

I know that it is verbatim from the paper, and it's not a very good paper if they draw conclusions that are not based on actual statements.