I was about to head to bed on the 27th and decided to check email. Good thing, too, since it was a report that DSLREPORTS.COM was hacked.
The owner of the site, Justin Beech, is a solid, good guy. For years, his site has been the go to resource for everything broandband.
The email he sent:
Message from Justin, owner of ISP review site dslreports.com
At about 5pm tuesday US eastern time (today) I found a distributed ‘sql injection attack’ targeting dslreports.com. I blocked it upon spotting it, but the attack had already extracted about 8% of our user email address / password pairs. Your email and password was one that was revealed: The email extracted was pgrote@gmail.com and it was paired with a password first three characters of xxx and 10 characters long (I hope this is a good hint for you to recognize the password that was obtained).
I would advise you IMMEDIATELY change this password IF YOU ALSO use it on other sites paired with the email address x@gmail.com.
I’ve no idea what the purpose of this attack was, or how long before they try using the data, but I imagine the data will be searched for possibly high value access elsewhere: paypal, ebay, gmail, banking sites. They got no other details, just email and password pairs.
I will post more details in this topic: http://www.dslreports.com/forum/r25793356- this week however at this stage I would rather get the information to impacted users fast BEFORE tipping the intruders off publically that we know exactly what was obtained. It would be helpful if you can wait a day or two before posting publically on the event.
Your compromised site password has been reset to a random one, please use the forgot password function www.dslreports.com/forgot to retrieve it.
I deeply regret that the site had this flaw and we had not updated to use of one way encrypted passwords, I will post in the topic referenced above but my priority right now is to get these emails out so you can act on them. If you use a different password and/or email address for key services online then you won’t be at any risk.
If you have any questions on this, don’t reply to this email as it comes from a script, instead please email me at justinbeech (at) gmail.com I will try to reply when I am able.
Egads. The password listed was one I use, with a slight variation, everywhere.
Within hours I received a text from Google with a code to change my password. I also noticed my Yahoo account received email requests from Google to change my password.
Super.
Luckily, my passwords were unique enough I didn’t have to worry, but I still changed them.
Justin handled this without a problem and should be commended. While it sucks someone was able to get the emails and passwords, Justin did handle it this openly and honestly.
Related posts:
Recent Comments