More on the LinkedIn password breach

I found this analysis from a fellow network security geek in the UK to be quite interesting:

…which lends a little weight to the theory that the file primarily contains hashes which some script kiddie could not crack with basic tools, and hence makes us wonder what he’s done with all the ones which he did crack – and how much of the LinkedIn corpus that would represent?

He’s got a point. So many tools exist to easily crack these password hashes. I just tried hashcat on them using the standard Ubuntu dictionary file and cracked 20,000 of them in seconds using just my lowly laptop. So why would the hacker pretend to need help cracking them? Why post to a hacker forum where one is certain to face ridicule?

This leads me to speculate that the hacker is either enormously clueless or (perhaps more likely) aiming to embarrass and/or blackmail LinkedIn. Was this a staged demonstration of a hacker group’s power to disrupt a high-profile site? A warning to others, like Facebook and Google?

Another amusing aside is that just yesterday I used LinkedIn to send a message to a stranger who might know an old friend of mine. I tried several times to leave my email address in LinkedIn’s contact message but finally gave up: LinkedIn’s anti-spam measures are quite clever and blocked every iterations of email address obfuscation that I tried.

It’s amusing that LinkedIn can be so good at blocking spam to its users while being so bad on keeping their accounts secure!

LinkedIn password leak is confirmed

I did some hunting for the password hash list which reportedly includes the passwords of 6.5 million accounts. After downloading the file, I did a quick search on my password “tXrNNb706+” (which has since been changed, duh):

grep -n `echo -n tXrNNb706+ | shasum | cut -c6-40` hacked.txt

This spit out the following:

4096152:b0a6f8fba1a954de7d60bf4dbc3805d1056cf443

Boom! My hash appears on line 4,096,152. Yikes!! It’s a good thing I use unique, strong alphanumeric passwords for all of my accounts! That password was only used for LinkedIn, so I know the hash list was collected from LinkedIn.

But why is this file only 6.5 million hashes, if LinkedIn has over 161 million users? My guess is that an exploit was placed on the LinkedIn servers during a certain timeframe and during that time it collected the hashes of these 6.5 million users. My compromised LinkedIn password was last changed in December 2011, about six months ago.

The whole incident has given me reason to rethink the password problem, and the problem of authentication, to see what better methods exist for proving identity in a digital world.

Bonus link: read this detailed analysis on YCombinator (warning: heavy geek quotient).

Bad Day For LinkedIn: 6.5m Hashed Passwords Reportedly Leaked

This is bad. Very, very bad. Unhashed passwords are a no-no. I’m shocked that LinkedIn has been so careless.

If you have a LinkedIn account, you should change your password immediately!

And always, always use a unique password for each and every service you use.

Already in the spotlight over concerns that its iOS app collects full meeting notes and details from a device’s calendar and sends them back to the company in plain text, LinkedIn user accounts are now said to have been compromised, with 6.5 million hashed and encrypted passwords reportedly leaked.

Norweigan IT webite Dagens IT reported the breach, with 6.5 million encrypted passwords posted to a Russian hacker site. Security researcher Per Thorsheim has also confirmed reports via his Twitter feed, stating that the attackers have posted the encrypted passwords to request help cracking them.

via Bad Day For LinkedIn: 6.5m Hashed Passwords Reportedly Leaked.

House Creek Greenway opening in September now

I got the word about why Raleigh’s much-anticipated House Creek Greenway will be opening in early September now, rather than the July 19th I had initially mentioned. The delay comes as a result of the contractor needing to put up over 3,000 feet of railing along the top of the retaining wall.

House Creek Greenway covers some challenging topography. It’s a big project that has been anticipated for many years. While it would be great if it was open now, another few months are worth the investment to get it right.

Don’t Mean To Be Alarmist, But The TV Business May Be Starting To Collapse

This is right on the money. Business Insider is proving what I’ve been saying for years about the television business: it must change or die.

Today’s “cord cutters” might be considered the “early adopters” (if there is such a thing when people skip a service) but soon the masses will begin eschewing traditional television and then TV as we know it will collapse.

We still consume some TV content, but we consume it when and where we want it, and we consume it deliberately: In other words, we don’t settle down in front of the TV and watch “what’s on.” And, again with the exception of live sports, we’ve gotten so used to watching shows and series without ads that ads now seem extraordinarily intrusive and annoying. Our kids see TV ads so rarely that they’re actually curious about and confused by them: “What is that? A commercial?”

via Don’t Mean To Be Alarmist, But The TV Business May Be Starting To Collapse – Business Insider.

Coyotes and deer in Raleigh

A discussion on the Mordecai email list about our urban deer got me wondering about their natural predators. It just so happens that the rumors about coyotes in our area appear to be real.

I found this interesting report from an exotic animal veterinarian of a coyote brought in last December. It’s cool that so many critters are finding room to live here in downtown Raleigh.

Well, the guy comes back in carrying a canine of some sort by the armpits, rear end dangling, with a large bunch of towels wrapped around the head to keep him from being bitten (Good idea!). The animal was in bad shape: skinny, wet, matted fur, lice crawling all over, and a strong odor of filth. I had him lay his bundle on the exam table, donned a pair of leather falconer’s gloves, and began to unwrap the front half of this dog to see what we were dealing with. To my surprise, staring back at me was a genuine, bonafide, roadrunner-eating COYOTE!

via It’s a Coyote, for Real! | Avian and Exotic Animal Care, Raleigh, NC.

Neighborhood break-in causes little concern

RPD is just a phone call away


Thursday provided a bit of unexpected excitement in the neighborhood. I had just stepped away from my home office desk for lunch when I read an email from a neighbor, saying that she had seen suspicious men at another neighbor’s home and had called the police. Looking out the window, I was amazed to see three Raleigh Police cruisers parked down the street!

I found out from other neighbors who were outside that the house at the end of the neighboring street had been broken into. Officers had the house surrounded, believing the perpetrators were still inside. I chatted a bit with my neighbors until a K-9 officer returning his dog to his car let us know that no one was inside.

It seems the perpetrators left out the back door as officers arrived, having had time to stack TVs and an Xbox outside but no time to take them with them. Fortunately for the police, the burglars very thoughtfully left their getaway car sitting in the driveway! I smiled as I watched the car being towed away, knowing how much evidence the burglars must have left in it. I’m sure it’s only a matter of time before the hapless burglars are caught.
Continue reading →

Save the date. Every one of them.

Along with Kelly, I went to a volunteer luncheon at Conn Elementary yesterday. One of our favorite teachers, Nicole Jackson, sat down with us and chatted a bit.

“He was the cutest little boy!” she said of Travis as she told another volunteer how he used to play “peek-a-boo” with her as he passed through the hallways with us, not yet old enough to attend Conn himself.
Continue reading →

Running low on road revenue

The Republican leadership in the North Carolina General Assembly wants to cap our state’s gasoline tax. How is this anything but a stupid idea? Sure, it’d be nice for folks not to pay anything, anytime, but that’s not how it works. If you build roads, you damn sure better be willing to maintain them.

The gasoline tax pays for roads: roads that are in dire need of repair. We either pay to fix them or we pay when commerce in our state grinds to a halt.

Another ill-advised bill making its way through the NCGA would bar I-95 from becoming a toll road. One legislator said that companies would move their operations elsewhere if the tolls went into effect. If you think tolls will drive business away, imagine what will happen if I-95 becomes a pothole-filled parking lot because it’s crumbling and outdated.

There’s no complicated problem without a solution that’s simple, logical – and wrong. H.L. Mencken said something much like that years ago, and life still has a way of proving the caustic journalist right. Take the gasoline tax.

North Carolina’s state tax on gasoline sold at the pump, currently 38.9 cents, is relatively steep. It ranks sixth highest in the land (an additional federal tax of 18.4 cents on each gallon applies throughout the country). Our state’s tax is also an unusual one, in that a portion of it adjusts every six months in tune with the wholesale price of gasoline. So: Higher-priced gas equals a higher state gas tax.

To motorists with wallets pumped dry, that doesn’t seem fair, or right. No wonder politicians eagerly offer solutions

via Running low on road revenue – Editorials – NewsObserver.com.

NC Considers Making Sea Level Rise Illegal

My friend Scott Huler takes down the attempt by coastal developers and the Republican leadership in North Carolina General Assembly to pretend climate change doesn’t exist.

According to North Carolina law, I am a billionaire. I have a full-time nanny for my children, I have won the Pulitzer Prize, and I get to spend the entire year taking guitar lessons from Mark Knopfler. Oh, my avatar? I haven’t got around to changing it, but by law, I now look like George Clooney. There’s also a supermodel clause, but discussing the details would be boasting.

You think I’m kidding, but listen to me: I’m from North Carolina, and that’s how we roll. We take what we want to be reality, and we just make it law. So I’m having my state senator introduce legislation writing into law all the stuff I mentioned above. This is North Carolina, state motto: “Because that’s how I WANT it to be.”

via NC Considers Making Sea Level Rise Illegal | Plugged In, Scientific American Blog Network.