If you’ve ever registered an account at Kotaku, or any Gawker media site—which would include Lifehacker, Gizmodo, and Gawker—your email address, username, and password are probably now in the hands of at least 500 people whom you’ve never met and probably never will. And they’re not people authorized to have that data.
A group identifying itself as “#Gnosis” gained access to all of Gawker’s assets including their entire user database, internal sites, confidential login information for restricted media access sites, and logins and data for external resources Gawker Media used. They then engaged in a campaign of harassment over several days while copying a very inadequately secured MySQL database containing over 1.3 million users of all of Gawker Media’s sites. They then proceeded to package this up and ship it off to nobody knows where in addition to putting up a Torrent—currently with over 300 seeds.
Gawker has issued a public apology, and recommended to all users that they immediately change their passwords on all of their sites—though you only need to change your password once. If you use the same login information on any other site—then those accounts are compromised as well.
Unfortunately, the majority of the claims do appear true. And anyone with a remotely modern computer can easily crack your password—Gawker elected to use the very obsolete DES algorithm, which can only handle a maximum of 8 characters. Gawker didn’t take enough precautions when coding to handle users and passwords, and “#Gnosis” almost certainly got in through some known exploit that Gawker or their host had missed.
The group #Gnosis released a document taunting and mocking Gawker, as well. The document is rife with spelling, grammatical and gross technical errors, as well as juvenile humor, obscenities, and slurs that are favored by Anonymous and the self-described /b/tards – who are also specifically greeted.
Articles RSS