- Actor Amanda Seales pushes back on #FreeRodneyReed movement Monday 10:58 PM
- Netflix thriller ‘Earthquake Bird’ can’t solve its own mystery Monday 4:45 PM
- Goop is selling an expensive ‘restraining arts’ BDSM kit Monday 4:17 PM
- Body positivity actress Lili Reinhart calls out Photoshopping app Monday 3:42 PM
- ‘Rick and Morty’ zeroes in on connections and leans into familiar territory Monday 3:30 PM
- People are sharing photos of how much they’ve changed in a decade Monday 2:30 PM
- A few of our favorite things on Newegg are on sale for Black Friday Monday 2:15 PM
- Disney adds ‘Bob’s Burgers’ movie back to release schedule after accidentally yanking it Monday 2:02 PM
- Ocasio-Cortez launches petition demanding Stephen Miller’s resignation Monday 1:24 PM
- Prince Andrew’s defense against child sex crimes stokes conspiracy theory flames Monday 1:20 PM
- More people may be looking to cancel Disney+ than Netflix Monday 1:09 PM
- Monday Night Football: How to stream Chiefs vs. Chargers live Monday 1:00 PM
- After days of deadly protests, Iran implements ‘largest internet shutdown ever’ Monday 12:55 PM
- ‘Disney Plus and thrust’ is apparently the new Netflix and Chill Monday 12:32 PM
- Woman fired, sued after coworker shared their sexts Monday 12:22 PM
The stolen data includes email addresses, IP addresses, usernames, and passwords. The passwords are hashed—effectively a password scrambler meant to keep the data safe—using the MD5 algorithm, a long-antiquated and weak function that reportedly allowed LeakedSource “to convert over 80 percent” of the passwords to their true plain text values, a format anyone can read.
That amounts to over 1.5 million passwords stolen outright.
The weakness of MD5 isn’t new. In 2012, LinkedIn was hacked and 6.46 million passwords were exposed due to the weak MD5 algorithm. The software’s author said then—over four years ago—that the scrambler is “no longer considered safe.“
Worse yet, security expert Bruce Schneir said in 2005 and 2004 that “MD5 is broken” because a large number of passwords can be computed and decrypted by an attacker at rapid speed. That’s over a decade go.
Why was Valve, the publisher of Dota 2 and the company behind the breached forum, relying on it for security in 2016?
The company has yet to respond to questions about its security.
The theft came in the lead up to The International 2016, the game’s global championship, which boasts over $20 million in prize money, a record-breaking amount.
Originally breached on July 10 using an SQL injection vulnerability on vBulletin forum software, ZDNet reports, the hacked database ended up on LeakedSource.com, a site meant to chronicle breaches and give easy access to users searching for their own stolen credentials.
You can search LeakedSource.com to see if your credentials have been stolen. Users should immediately change their passwords if they may be impacted, especially if they share passwords across multiple sites. If you used your Dota2.com password anywhere else, change those, too.
Patrick Howell O'Neill is a notable cybersecurity reporter whose work has focused on the dark net, national security, and law enforcement. A former senior writer at the Daily Dot, O'Neill joined CyberScoop in October 2016. I am a cybersecurity journalist at CyberScoop. I cover the security industry, national security and law enforcement.