Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[zirk]

Check if you have an account that has been compromised in a data breach

haveibeenpwmed.com

Just checked all my email addresses, do far so good.

[zirk]

Hmm, link not working try this -

https://haveibeenpwned.com/

This was in the News this week, for those wondering wtf is this about, -

http://www.bbc.co.uk/news/technology-41095606

[moggy]

Hmm, link not working try this -

https://haveibeenpwned.com/

This was in the News this week, for those wondering wtf is this about, -

http://www.bbc.co.uk/news/technology-41095606

Hi Zirk,the site says i have been pwned,so what do i do about it Dean.

[Gaffers]

For those accounts that are listed as pwned, change the password to one which is complex enough (10 characters min pref 16, mix of upper/lower case, numbers and symbols)

If any cards are listed in pastebins get them reissued.

If bank details are there inform your bank.  It's up to them to act, but if they are informed and anything goes wrong it helps with your claim.

If personal details are there then look at changing any security questions that overlap such as mother's maiden name, etc.

[Gaffers]

For info I have 2 entries on there, mainly from harvested details from a couple of websites that should have done better to protect themselves.  Follow the basics above and you'll be fine 

[Sir Tigger KC]

So this haveibeenpwmed site is genuine and not some sort of data harvesting scam itself?     

[zirk]

Hi Zirk,the site says i have been pwned,so what do i do about it Dean.

Change your Password as Guffer said, and if your using the same password across multiple accounts stop doing that, thats the key here, lose the same password on one account then your other accounts are also at risk, thats what the Hackers are banking on.

After changing your Site Login Passwords, dont forget to change your actual email account(s) Password, a lot of people actually change all there Logins and forget their emails accounts.

On the same Site - https://haveibeenpwned.com theres a Password Checker as well (Dont check active passwords, only old ones that your not using anymore), this will tell you whether your old Password has also been indexed with there Data Base info. 

[zirk]

So this haveibeenpwmed site is genuine and not some sort of data harvesting scam itself?     

I did check, as well as the Sites Owner, comes back as Trusted, but hey this is the Twinterweb.

[Gaffers]

So this haveibeenpwmed site is genuine and not some sort of data harvesting scam itself?     

I did check, as well as the Sites Owner, comes back as Trusted, but hey this is the Twinterweb.

I work in IT/Info Security and it is well known as one of the good guys.  Respected is a bit strong but certainly no evidence to suggest it's a data harvester.  In fact there are some companies that use it as a service offereing for identity theft protection etc..

[aaronjb]

What Matt said - yes, the site is trustworthy (as in, they are not harvesting your details).

They don't really need to, because they already hold 1,400,000,000 records of email addresses collated from various breaches.

I may be paraphrasing what's already there to read in the BBC article (I haven't read it - I read Troy's own report when it came out) but basically, HIBP built a database of ~700m records over the last two years by pulling freely available data (if you know where to look) dumped on the internet by black-hat (bad) hackers after they had breached various organisations (LinkedIn, Plex, various internet forums, Adobe, P*rnhub, etc).

This week they were made aware of a new, single, dump containing ~711m records of email addresses, passwords, locations etc. The analysis is that this data was being used by spammers to target and send emails - the passwords were those of peoples SMTP (mail) servers (i.e. likely your ISP or gmail etc password) which means the spammers can send mail as you.

Most of those passwords were traced back to a couple of breaches (LinkedIn being one of them) where the SHA1 hashes of peoples passwords were exposed. SHA1 is now fairly trivial to reverse (and should not be used as a hashing mechanism anymore) and so those passwords have been reversed and matched to other accounts.


So, basically:

1) Don't use the same password everywhere
2) Do use a good password manager, so that you don't do #1
3) If you have been pwned, and you know you were in a breach that contained password information or use the same password everywhere - change your password on the affected service and enable two-factor authentication where possible or, if you used the same password everywhere, change your password everywhere.

Sadly a large number of UK banks don't offer two factor authentication (i.e. a token you must physically possess) which, IMHO, is irresponsible on their part - and clearly demonstrates that they are rich enough or well insured enough to not care about your money going missing and potentially having to refund it to you, rather than wanting to actually protect you from that in the first place.

Incidentally, using SMS messages to implement the second factor is not fool-proof as it is reasonably trivial to redirect your SMS messages to anywhere in the world (the messaging system mobile phone companies use to manage delivery destinations is thoroughly insecure - it's already been used to impersonate politicians, steal information etc); but it is better than nothing, where available.

[edit] My mistake, they hold 4,712,017,449 records now!

Also, for the record:

Oh no — pwned!
Pwned on 9 breached sites and found 1 paste (subscribe to search sensitive breaches)

Now ask me if I'm concerned? (No, I'm not - I have low password re-use, use a password manager and have two-factor auth where possible on sensitive accounts)

[Allenm]

I might be being thick here  , the email address I put in showed as pwned on 1 site.

How am I supposed to find out what information has been compromised - the info just looks like a list of what sites have been hacked and looked up.

[aaronjb]

Which site?

Most give a description like this that clearly say what you should believe has been compromised (taken from one of mine):

Adobe: In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text.

If you were found in a 'paste' then you can't always know, you just have to assume it may contain a password you use. If you don't use the same one everywhere, I wouldn't worry.. if you do, I'd be changing it.

[aaronjb]

For info I have 2 entries on there, mainly from harvested details from a couple of websites that should have done better to protect themselves.  Follow the basics above and you'll be fine 

Incidentally - I figure it's likely only you who'll be interested in this A colleague of mine has the source files from the recent leak (the ~711m records) and has cracked 100% of the hashed passwords contained therein..

..it took 32 NVidia GeForce 1080TIs under 12hrs to do.

I don't know if I'm more impressed that he found the source files, or that he has 32 (expensive!) graphics cards to dedicate to hash cracking..

[Kevin Wood]

For info I have 2 entries on there, mainly from harvested details from a couple of websites that should have done better to protect themselves.  Follow the basics above and you'll be fine 

Incidentally - I figure it's likely only you who'll be interested in this A colleague of mine has the source files from the recent leak (the ~711m records) and has cracked 100% of the hashed passwords contained therein..

..it took 32 NVidia GeForce 1080TIs under 12hrs to do.

I don't know if I'm more impressed that he found the source files, or that he has 32 (expensive!) graphics cards to dedicate to hash cracking..

.. and clearly gets bored easily.

[Allenm]

Which site?

Most give a description like this that clearly say what you should believe has been compromised (taken from one of mine):

Adobe: In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text.

If you were found in a 'paste' then you can't always know, you just have to assume it may contain a password you use. If you don't use the same one everywhere, I wouldn't worry.. if you do, I'd be changing it.

Under "Breaches you were pwned in"  it says "Online Spambot"

I can't see how a spam bot would have got the password though - I don't follow email links unless I absolutely trust them, and even then, I go to the homepage of the site by typing it in on the address bar.