FBI Investigating Gawker Media User Database Password Ownage


After the non-stop action with WikiLeaks last week, the big news this week is the hack carried out on Gawker Media which exposed their users e-mail addresses and passwords. More than 200,000 password hashes (very lightly encrypted with DES) and e-mail combos can be downloaded on-line as a torrent file.

Now this has had some epic fall-out as we all know many people use the same passwords for all their online services, so a whole bunch of Twitter accounts were owned and used for spamming Acai berries – causing Twitter to block/delete these accounts and reset a whole lot of passwords.

Now if you search through the files, there are a whole lot of major corporate domains inside – including some government organizations. This is the fact that is obviously worrying to the FBI and is leading them to carry out an investigation.

The FBI confirmed to PC World that it is investigating the recent intrusion by a group of hackers into Gawker Media’s servers last weekend. The hack exposed more than 200,000 reader e-mail addresses and passwords, and the data is now circulating online as a peer-to-peer torrent file. An FBI representative declined to comment further about the ongoing investigation; however, Gawker Media founder and CEO Nick Denton was scheduled to meet with federal authorities on Monday, according to The New York Post .

On Sunday, an online hacker collective calling itself Gnosis broke into the servers of Gawker Media, which owns a variety of popular online blogs including Deadspin, Fleshbot, Gawker, Gizmodo, Jezebel, io9, Jalopnik, Kotaku and Lifehacker. The hackers obtained the e-mail addresses and passwords for the company’s employees, and the source code for Gawker Media’s content management system. Gnosis hackers also obtained the login credentials for readers who were registered to leave comments on Gawker Media websites.

Gawker Media said most user login information was encrypted, but Gnosis managed to crack the credentials for more than 200,000 accounts. The exposed login information is now part of a data dump contained in a torrent file available on peer-to-peer file sharing networks.

It’s a pretty serious breach as Gawker is one of the major on-line media owners and their network reach is wide. 200,000 accounts with exposed passwords is not a small number and do remember just because people aren’t tech savvy (use weak passwords) it doesn’t mean they don’t hold some high position in some huge MNC.

There’s a big debate going on at Hacker News too about the ethics of e-mailing all the users in the file to notify them their passwords may have been breached. Apparently some people are already doing it, and other are writing scripts to extract the e-mail addresses and notify everyone to ensure no-one gets left behind.


It’s not entirely clear what inspired the attack against Gawker, but a person claiming to represent Gnosis recently told the blog Mediaite that the hacker group broke into the company’s servers because of Gawker’s “outright arrogance.” Previously, it was suggested the Gawker hack was related to the company’s ongoing feud with members of 4chan, an online message board. The Gnosis representative said there was no connection between the hacker group and 4chan.

Despite the potentially criminal acts perpetrated by Gnosis hackers, more high-minded hackers (among software engineers the term hacker refers to someone who is a programming expert) were coming to the defense of Gawker Media users. Readers of Y Combinator’s Hacker News — a news aggregator and discussion thread for technology start-up entrepreneurs and software engineers — banded together to create an automated e-mail program to alert the 200,000 people whose e-mails and passwords were exposed by Gnosis.

You can find a CSV of the file online here where you can check if your details are inside – gawker.csv

There is also another service which will help you hash your username/email and search through the hashes – http://gawkercheck.com/

Source: Network World

Posted in: Exploits/Vulnerabilities, Legal Issues, Privacy, Web Hacking

, ,


Latest Posts:


Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)


Comments are closed.