GitHub Security Update: Reused Password Attack

https://github.com/blog/2190-github-security-update-reused-password-attack

by ejcx • 10 years ago

250 135 10 years ago

github.com

natch• 10 years ago

What the page doesn't tell me is: What is their definition of an "affected" account?

Obviously one where an attempt was made, and succeeded, would count as affected.

But would an account where an attempt was made, and failed, also count?

What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view?

paulannesley• 10 years ago

But would an account where an attempt was made, and failed, also count?

I wouldn't think so. There must be countless incorrect password attempts all the time.

What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view?

Interesting question. I'd hope they'd inform me if somebody had my password and was only blocked by 2FA.

DanCardin• 10 years ago

Wouldnt you have gotten unexpected 2fa notifications if that were the case?

qnk• 10 years ago

My guess is that all affected accounts are those that had multiple successful and/or unsuccessful login attempts coming from the same source.

jrockway2• 10 years ago

I hadn't noticed that Github started supporting U2F. Nice to finally use my keys for something other than Google accounts.

vulpino• 10 years ago

Dropbox does too! Unfortunately, those are the only sites supporting U2F I know of at the moment.

jonafato• 10 years ago

http://www.dongleauth.info/ maintains a list of sites supporting U2F devices. There aren't many yet, but it looks like a Wordpress plugin exists that may end up in core. There are also a handful of additional sites listed in issues and pull requests on the site's GitHub page (https://github.com/Nitrokey/dongleauth).

(I'm not affiliated with the site, I just check it periodically and thought it might be of use here.)

bojo• 10 years ago

Bitbucket as well.

k33l0r• 10 years ago

Google also supports U2F

godzillabrennus• 10 years ago

For those of us who don't already know, this is U2F: https://www.yubico.com/about/background/fido/

anamexis2• 10 years ago

I wish AWS would!

pibefision• 10 years ago

Why U2F is betthern than using an Authenticator?

pfg5• 10 years ago

U2F is immune against phishing.

8_hours_ago• 10 years ago

Here's a brief comparison between OTP (Authenticator) and U2F: https://www.yubico.com/2016/02/otp-vs-u2f-strong-to-stronger...

One big advantage of U2P is protection against phishing and mitm attacks, which OTP is vulnerable to. There is more information here: https://developers.yubico.com/U2F/Protocol_details/Overview....

kstenerud• 10 years ago

So what happens if you lose the dongle?

danneu• 10 years ago

You use the customer support backdoor.

pfg5• 10 years ago

You can add multiple keys, so you could have a primary one that's with you and another one that's stored somewhere safe. You can also configure OTP and/or SMS-based 2FA and backup/recovery codes as a fallback mechanism.

jrockway2• 10 years ago

I have YubiKey Nanos "permanently installed" in each computer I use, as well as a portable one. If I lose all my computers, and my keys, and my phone... I guess I'll have to make a new Github account. It's all open-source anyway!

connorshea• 10 years ago

GitLab supports it as of a few days ago :)

akerl_• 10 years ago

"We immediately began investigating, and found that the attacker had been able to log in to a number of GitHub accounts."

jlarocco• 10 years ago

Did you even read what the OP asked?

As he said, those counts are obviously affected, but the article (and your quote) give no indication of if accounts in the other categories (attempted but failed, attempted but stopped by TFA) are also notified that attempts were made.

dang2• 10 years ago

The site guidelines (https://news.ycombinator.com/newsguidelines.html) ask you not to post did-you-even-read comments to HN:

Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

In this case a comment rather than an article, but the rule still applies. Consider how much more polite your comment would be with just the second paragraph.

dang2• 10 years ago

We detached this subthread from https://news.ycombinator.com/item?id=11913690 and marked it off-topic.

tuna-piano3• 10 years ago

Anecdote: I use an email account and a relatively simple password (3 relatively common words together) on LinkedIn. I don't use that email account much, but it was affected by the Linkedin hack. Today I get an email saying my Twitter account was accessed suspiciously (same credentials).

Power of the network effect that I won't leave Linkedin, and wouldn't think twice before spending money on the platform if I needed to recruit someone or do b2b sales. But screw Linkedin for not taking proper precautions.

niij3• 10 years ago

You're using a dictionary password and subsequently reusing that password on multiple sites.... and you're mad at LinkedIn for allowing your account to be compromised? Umm.

Taek• 10 years ago

You are blaming the victim. Yes, they could have taken more steps to protect themselves, but those steps are inconvenient and cost everybody headspace and headaches. And if we're all being honest we don't use best practice every time we log into a website.

The real problem is the way that we do passwords. Passwords should either be managed by your browser or your operating system. When you log in to your computer, you log in one time with a public key. And then your OS/Browser automatically logs you into every website you visit by signing challenges instead of by giving your private key (that's essentially what a password boils down to) to everyone who wants to verify your identity.

The same is true for credit cards.

If we want a more secure web, we will replace the password system. It's difficult to use passwords correctly, even if you have the common sense (which a lot of people don't, because they just don't realize it's a bad idea).

It should be a higher priority. People are clearly losing money and losing quality of life over today's insecure password infrastructure.

tuna-piano3• 10 years ago

I can walk around a bad part of town at 2am, but if I get shot, I'm still going to be mad at the shooter.

A mix of laziness, apathy and habit lead me to reuse that password on many sites. But I have 5+ email addresses, tons of shopping accounts, multiple banks, brokers, airlines, hotels, etc. I do use more secure passwords for other sites.

I really can't be bothered into using a password manager, so what's the alternative besides reusing passwords?

Ntrails• 10 years ago

I'm more annoyed about my email address being in the dump than my password (which is/was the shittest of my password set because I don't care about my LinkedIn account).

I, too, may even have used that pw on twitter (RIP both followers of my 4 tweet history). Again, because I don't really care.

I have essentially been re-using passwords for 15 years now (although my very first password on my AOL "gandalf" has long been retired), every now and again upgrading my "default strong" and using a the historical weaker ones on things I don't care about/don't trust.

Password Manager is definitely a smarter solution but I can't see myself setting it up.

ledude• 10 years ago

just a random tidbit.. but the system currently allows you to set your password to what you previously had

emilong• 10 years ago

I actually hope this is true as a consequence of them storing salted hashes for passwords. That is, Github should not ever see my password, only validate that I know what I entered previously.

e28eta• 10 years ago

It's pretty easy to keep a list of old salted hashes, and copmare the new password's salted hash against the previous ones. It doesn't require saving the old passwords.

pfg5• 10 years ago

I'm not following that logic. Using salted password hashing would not prevent them from checking your new password against the previous hash.

kiwidrew• 10 years ago

I received this e-mail and had my password reset by Github. Based on the "security history" shown in my Github account's setting page, my account wasn't compromised as there was no login activity during the past week.

I'm thinking that this is fallout from the LinkedIn breach, because this is the first high-profile breach which includes one of my e-mail addresses. (How do I know this? I'm using haveibeenpwned.com -- a free service that I highly suggest registering with.)

jqueryin• 10 years ago

Just a thought, but GitHub could be handling this proactively to ensure the security of their members given the sensitivity of private repositories:

    Step 1: Grab LinkedIn breach data
    Step 2: Compare email addresses/usernames from LinkedIn to GitHub
    Step 3: Check if passwords are the same
    Step 4: Reset password and notify if they match

zaroth• 10 years ago

Step 3 is not possible without one of the following;

  GitHub keeps a copy of the password in plain-text
  GitHub keeps a copy of the SHA1 hash of the password
  GitHub cracks the SHA1 hash and checks against their hash
  GitHub calculates the SHA1 hash of the password after a valid login

The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.

tptacek2• 10 years ago

That's good and all, but, really: get a password manager and start using it. Nobody can afford to share passwords between services anymore.

eterm3• 10 years ago

Any password managers you would recommend?

Anyone looking right now is stuck with the paradox of choice[1], it's easy to look at the list and say for any given manager, "yeah but <x> says that one is rubbish" and end up picking none and just using ~/password.txt.

[1] http://uk.pcmag.com/password-managers-products/4296/guide/th...

eterm3• 10 years ago

I knew I had already been "pwned" from adobe, but I just checked again and I was done in again from x-split.

I've since switched to using secure (60bit) passwords everywhere, but these are just the ones that have been made public, for every public release of info there are likely cases where the data has been kept privately.

Passwords suck, I wish everywhere had support for 2fa.

Here's a "did you know" about passwords: Did you know blizzard only uses the lower-case for passwords? You can enter any case of password and still match, so for blizzard always use a longer password because 'a' and 'A' are not unique.

knd775• 10 years ago

Oh wow, that's awful. How can companies think that this is okay?

Natanael_L• 10 years ago

I suggest 80+ bits to avoid getting caught by rainbow tables and similar batch attacks, which can get you in cases of password database dumps. 64 bit keys have already been cracked many times over in various distributed efforts.

If some site just uses plain MD5 then raw bruteforce might have already come across your password, or might do so anytime in the future.

v0x• 10 years ago

Regarding Blizzard passwords: an old acquaintance generated his own SHA-1 hashes for his Battle.net account - which did not resolve to characters which could be input by a regular client - so nobody else would be able to login to his account even if they had the information. Pretty neat.

ComodoHacker• 10 years ago

This is far better than TeamViewer's response to the same threat lately.

lifehome• 10 years ago

All I can see is panic for TeamViewer's incident.

lucb1e• 10 years ago

They had an example to learn from.

ikeboy10• 10 years ago

I feel like sites should somehow preemptively disable passwords that have leaked publically. Is there a simple way for them to do so without downloading every leak themself? Is there a simple way for whitehats to help out? Whitehat means you can't test the site without their permission, but someone could have a database that they provide partial access to for sites without leaking and spreading it further themself?

Here's an idea I just thought of: sites should have a standardized, secondary place to log in, where if the login is correct it automatically disables the password and requires a reset. "Report a compromised account", as it were. Anyone (or maybe specific whitehat groups) should have explicit permission to try any logins they want there: after all, if they succeed in logging in then the right thing happens and the account is locked. It's impossible to gain any illicit advantage from such access because any correct credentials are locked as soon as you try them. (Is this assumption robust?) So whitehats could then take lists and throw them against sites that implement this standard, but no attackers can gain from this.

The only problem I see is that disabling rate limits would open you to DOS (also if multiple people use the same list, although better coordination would help solve that): maybe allow bulk uploads which take less bandwidth overall.

Does this idea have any value?

anamexis2• 10 years ago

have i been pwned has an API: https://haveibeenpwned.com/API/v2

ikeboy10• 10 years ago

Doesn't help without passwords, which present some ethical problems with helping spread them especially from that site as he gets some dumps that aren't public.

With my idea the people with the data would be able to directly shut down the accounts ethically.

Maybe the proposal could also hash and salt the passwords before sending it to the site, which sounds even better for security and wouldn't be too much of a hassle for whitehats who want to help.

bigiain• 10 years ago

Troy doesn't (for very good reasons) keep the passwords or hashes from breaches - just the email address. That make his API not quite capable of doing what's proposed here - Github can't use Troy's HIBP API to detect whether a breach containing my email address included a password that authenticates with them. (And I'm not sure there's even a way to make that service without creating _way_ more security problems than it solves...)

riquito• 10 years ago

What if one or many "leak" on purpose tons of passwords? We end up forcing people to use password managers (or post-it)?

ikeboy10• 10 years ago

If an adversary or potential adversary knows your password, there's a strong case to be made that it should be changed, at least for services that require strong security.

I don't quite get your concern. Isn't that better than them getting their account hacked?

ludamad• 10 years ago

The password space is big. They could release trillions.

briandear• 10 years ago

AWS did that for me. They sent an email saying that my AWS password was the same as one found in a breech, so they reset my password proactively.

"Hello,

At Amazon we take your security and privacy very seriously. As part of our routine monitoring, we discovered a list of email addresses and passwords posted online. While the list was not Amazon-related, we know that many customers reuse their passwords on multiple websites. Since we believe your email addresses and passwords were on the list, we have assigned a temporary password to your Amazon.com account out of an abundance of caution."

markokrajnc• 10 years ago

Passwords became hard to manage... now you have to choose >>different<< password for every site... Who can remember all those passwords? Only a password manager...

eximius• 10 years ago

We need to ditch passwords, not continue to proliferate them with sandboxed databases.

voidz• 10 years ago

Yeah? What kind of a secret can replace a password/passphrase? Not biometrics, those are username replacements, not password replacements.

austerity4• 10 years ago

Shameless plug time! Instead of remembering different passwords or using a password manager (and thus storing all your passwords somewhere) you can use https://salty.pw/

spion4• 10 years ago

Thats cool! Does it use simple concatenation or HMAC?

anowlcalledjosh2• 10 years ago

Problem with this is when you need a password with a capital letter, or with no symbols, or only 8 characters long.

Additionally, how do you determine the service name? e.g. I have a wordpress.com account; do I call that 'WordPress' or 'wordpress' or 'wordpress.com'? I guess using the domain name is fairly robust, but then you get stuff like Stack Exchange, or the service changes its domain name, or international variants - google.com vs. google.co.uk.

y4mi• 10 years ago

fantastic!

now a site has been breached and your username/password was leaked... yay, you'll have to either start using a traditional password manager for this special case or change every.single.password.you.have.

so useful ...not!

knz• 10 years ago

An interesting idea. Any thoughts on how to use this on websites that force a password change periodically? Using a versioned salt maybe, although that could get tricky after a few iterations.

wtbob• 10 years ago

It's really not hard. Generate passwords with 'pwgen -s 22' and store them in a gpg-encrypted file. emacs will prompt for your password when you open & when you save the file (there's probably vim code to do the same). Done.

It's not a completely ideal password manager, but it works.

If you can remember your password, then you shouldn't be typing it into a remote system, period.

DasIch• 10 years ago

That's really an awful solution compared to something like 1Password which has browser integration and synchronization between different devices. They even have a solution for groups.

arxanas• 10 years ago

I got an email from Bitbucket earlier today warning me about unusual behavior on my account as a result of reused credentials. Is it an attack across several version-control services?

ThePhysicist• 10 years ago

I got the same mail, seems like a coordinated attack. Luckily I had 2FA enabled, I'd recommend everyone to do that as well as it protects your account in these cases.

Bitbucket provides an audit log and a list of recent login sessions where you can see if your account has been accessed and if anything destructive was done to it. Github has a similar feature I think.

hallman76• 10 years ago

I got a note over the weekend from Steam (steamguard) indicating that someone attempted to log into my account. They're hitting everything.

brador• 10 years ago

Why not do a site wide reset on every account?

finnn• 10 years ago

Probably because the only accounts that were compromised were those dumb enough to use the same password on multiple sites, and one of those sites to be compromised.

Ensorceled• 10 years ago

It doesn't scale. I'd be fucking furious if services reset my password on every site because some other people reused passwords on one site that got hacked.

We'd all be dealing with password resets on a daily basis.

Pyppe• 10 years ago

Related to password security: any of you guys using Chrome's ability to sync passwords to "Google cloud"?

I just started using it a few weeks ago. Supposedly it uses a password to encrypt the data, but I still don't feel too confident syncing them there. On the other hand.. damn it's so convenient between multiple devices.

zamalek2• 10 years ago

There was recently a TeamViewer breach. Hackers somehow managed to access people's machines. Everything was denied and it wasn't investigated. Regardless, passwords were retrieved from Chrome. Some people lost a great deal of money.

Your browser is not a competent password manager and you should stop using it for that immediately.

Dashlane and LastPass make their money by keeping your passwords safe. This is far more preferable than a free browser feature. Both can sync across devices (if you pay). Sounds like you will like Dashlane for the same reasons that I do.

praxulus• 10 years ago

How would LastPass protect you against another TeamViewer breach?

geostyx• 10 years ago

I use and love 1Password. Chrome is a terrible place to keep passwords due to what @zamalek said.

GitHub Security Update: Reused Password Attack

Related Stories