860k Stratfor Accounts Dump

by mrb • 15 years ago

77 72 15 years ago

tansey• 15 years ago

Worth noting that these passwords are all MD5 encrypted but not salted. There were also no creation rules enforced, as a quick check reveals:

Highest reused password count: 12023 "stratfor"? 12023 "password"? 517 "password1"? 46 "Password1"? 24 "123456"? 625 "12345678"? 74 "jesus"? 2 "love"? 7 "war"? 1 "michael"? 39 "america"? 7 "xbox360"? 0 "heroes"? 0

Those last 2 are popular for the battlefield heroes dataset and other gaming-related ones, so I keep them in my script as gaming sites are both highly targeted and usually poorly secured.

Anyway, it's clear that no rules were enforced as a 3-letter dictionary word like "war" would never be allowed by any rule creation system. The fact that "stratfor" was used by nearly 1.4% of all accounts (!) tells me that either their users did not value these accounts or they simply have no idea how passwords are supposed to work.

mobileman• 15 years ago

Bad passwords really scare me.

majelix2• 15 years ago

> users did not value these accounts

Why would they value their password to one of 30ish different systems/websites?

gerhardi• 15 years ago

If the account does not hold any "vital" information, password "stratfor" could be quite a harmless password to leak, as I couldn't imagine anyone using that password for any other site/account. Although I don't know what user information is contained within the account.

Anyway, it is stupid to use such passwords and it tells something about the persons using those. Maybe they would use site names as passwords on other sites also.

russellallen2• 15 years ago

It was just a password to online news articles, not to my bank account...

pavel_lishin2• 15 years ago

In your case, sure.

meriksson• 15 years ago

I've been a Stratfor subscriber on and off since they got started about 15 years ago (I was 14 years old at the time). The last time around I got a new subscription, Stratfor set a new password for me, and it was... "stratfor".

This is just about the only bad thing I have to say about Stratfor. Being a long-time subscriber, I am always a few steps ahead of basically everyone else when it comes to global politics, and this has been very useful and enjoyable over the years.

One thing worth pointing out is that a Stratfor account like mine does not contain any sensitive information. It gives me access to exactly the same Stratfor reports as any other subscriber. As far as I know, it would not be possible to obtain e.g. my credit card details by using that password.

steve89183• 15 years ago

How did you get a breakdown of all the passwords used? Did you try to crack them yourself, or has the cracked passwords been posted? I'm trying to figure out if my own password has been compromised.

pavel_lishin2• 15 years ago

I assume that he just grepped for the md5 hash of the common passwords he tried.

e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l

MadGouki• 15 years ago

All you need to do to figure out the hash for a password is take the MD5 hash of it. My guess is the commenter you replied to just took some common passwords and some no-brainers and did a quick little "find all" for each hash.

Here's a tool you can use to generate MD5 hashes for given passwords: http://www.iwebtool.com/md5?string=stratfor

Going from the hashes to the passwords requires brute forcing, dictionary attacks, that sort of thing.

stouset• 15 years ago

Assume it has.

Jayasimhan2• 15 years ago

naive question. Is it a violation of law to download these files? I dont want to be in any kind of trouble for five minutes of excitement.

edit: I currently live in the US.

thesis• 15 years ago

I guess it depends on where you live... but I'm not touching anything with that much CC data in it.

Good luck.

redthrowaway2• 15 years ago

I'm not sure merely downloading the data from a public source is a crime, but I'm hiding behind academic research anyway.

Jayasimhan2• 15 years ago

I live in the US.

zobzu4• 15 years ago

IANAL.

Imagine the policy scans you computer and it contains dozen of valid CC numbers, or something that links to that.

You'd be in troubles. Thus I'd say, while it may or may not be illegal - it's probably a bad idea to get and store that stuff.

kennywinker• 15 years ago

"something that links to that" like my browser's cache of news.ycombinator.com ?

tomjen33• 15 years ago

So what exactly has Stratfor done? I mean aside from posting their own (informed) articles and running a business?

These people aren't protesting anything reasonable anymore -- they are flat out against people who earn money. Personally I consider them traitors to America.

cipherpunk• 15 years ago

Traitors to America? What the hell does that even mean in this context?

Are all anti-capitalists traitors to America?

tomjen33• 15 years ago

America is the country it is and people have it as good as they have it because America embraces capitalism.

You would call a soldier a traitor if he gave a nuke to Al Quida right? Yet America would survive. Without capitalism, America would not.

dantheman• 15 years ago

I'm a fan of Stratfor (I read it to get a handle on international news - they provide a background/context to enable me to understand what's going on, unlike traditional news), and I don't agree with this type of activity, but calling someone a traitor is a serious allegation, especially when these people are merely criminals and are not committing treason, which is what traitors do. Given that I don't understand the point of posting account details with password hashes, and CC#s - what are they trying to achieve?

gruseom• 15 years ago

I read it to get a handle on international news - they provide a background/context to enable me to understand what's going on, unlike traditional news

That sounds like it might be worth looking at. Is there a publicly accessible example you could provide a link to?

zobzu4• 15 years ago

I though you were talking about banks for a moment.

dandelany2• 15 years ago

  It's time to dump the full 75,000 names, addresses, CCs and md5 
  hashed passwords to every customer that has ever paid Stratfor. 
  We almost have sympathy for those poor DHS employees and australian 
  billionaires who had their bank accounts looted by the lulz

Wow. Apologies for venting, but this is fucking ludicrous. I am a middle-class mid-20s programmer who purchased a Stratfor subscription because their material is incredibly well-researched and about a million times more enlightening than your average CNN article. And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous.

Congratulations, you've exposed the personal details of the rich bankers and military analysts that recognized Stratfor as the intelligent news service it is. And in the process, you've managed to completely alienate the rest of the Stratfor community, members of the "99%", who care enough about understanding global politics that they were willing to give up a portion of their hard-earned paychecks to become better-informed. Something tells me it won't be worth it.

I just can't understand it. These guys are either agent provocateurs, or complete morons.

robryan2• 15 years ago

I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.

Mithrandir• 15 years ago

If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.

dandelany2• 15 years ago

You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault.

Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.

TheCowboy• 15 years ago

My information was released without warning. They dumped everything days ago. They could have informed Stratfor about the vulnerability, or even waited to give people a chance to cancel their cards.

Stratfor probably is to blame for lax security. But the hackers are as much to blame for violating my privacy.

I think Dan's point about alienating the wrong people by picking the wrong battles is the most important. Treating innocent people as 'collateral damage' is dehumanizing.

Edit for zobzu: They posted everything days ago.

My post contains none of the implied strawmen you assume. I believe we're on the same side, so I'm not sure why you are flaming me. You didn't address anything I said in my post.

Please review the guidelines so we can keep the discussion civil and useful: http://ycombinator.com/newsguidelines.html

majelix2• 15 years ago

> And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous.

Just an FYI -- you probably already know this -- but Stratfor is offering credit protection. Link: http://www.forbes.com/sites/alexknapp/2011/12/30/stratfor-of...

JoshTriplett• 15 years ago

At least according to http://pastebin.com/8yrwyNkt , Anonymous didn't do this. They claim that they like Stratfor, and wouldn't attack it. (To the extent Anonymous can coherently claim anything, but it makes sense.)

zobzu4• 15 years ago

Anonymous doesn't really have centralized power though.

So technically it can still be people "from Anonymous". It can even be just a few who decided to say "its not us!". In fact, it can be anyone. It could even be US agents. Seriously.

grandalf3• 15 years ago

I think this was likely a US Government backed attack to find out who the whistleblowers giving tips to Stratfor are.

Anonymous provides perfect cover for such operations.

russellallen2• 15 years ago

As someone who has also just cancelled my credit card because of these morons, I feel your pain.

vl• 15 years ago

On the bright side I haven't heard about Stratfor before and now I'm considering purchasing an account because so many people on HN give it positive reviews.

Symmetry• 15 years ago

I had an account for a while. I eventually stopped because its much better than TV news, it was only a bit better than The Economist.

justsee3• 15 years ago

Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target?

The question of identities and motives of the actors is certainly interesting, but there are a bunch of plausible theories:

* WikiLeaks sympathetic individuals who subscribe to the Assange theory of conspiracy (see: http://estaticos.elmundo.es/documentos/2010/12/01/conspiraci...). If you grok this, it's a textbook play in the 'throttling weighted conspiracies' game, ain't it?

* Agent provocatuers, as you already mention. That you'd pre-announce a hack like this days before releasing credit card numbers makes absolutely no sense from a Project Mayhem, anarchist perspective, does it? You're giving everyone enough time to cancel cards and minimize mayhem but still maximize reporting of the reckless, misguided behavior of hackers. It only seems to benefit the establishment over the longer-term with a public release like this. If you really care about undermining the system you'd quietly analyze the data and build up an under-the-radar picture of the establishement network to act on, no?

* morons. They got lucky with a target, and care less about gifting SOPA supporters in Washington a delightful Christmas present.

I'm not clever enough to have a view either way, but getting irate based on superficial internet evidence as to the identities and motives of players is not conducive to good health in 2011.

anamax2• 15 years ago

> Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target?

Then surely the New York Times and Washington Post are as well.

jonhendry4• 15 years ago

"Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target?"

And presumably you think anyone who writes a book about, say, the Nazis is therefore a Nazi sympathizer?

You're expressing a desire to censor information and opinion. As you state it, Strafor is several degrees of separation from actual policy enactment. The provide analysis, which "shapes world-view". Any given fact, or analysis thereof, can potentially result in many different reactions.

Is Wikipedia a valid target because it, too, "shapes world-view"? Wikileaks certainly does, so is it a valid target?

How about Amnesty International? They produce reports, that provide analysis, that shape world view. Are they a valid hacking target?

If you disagree with Stratfor's analysis, then produce your own analysis that proves them wrong.

gst• 15 years ago

When downloading the file from the .onion URL given in the link, the archive contains a member "._stratfor_users.csv". Seems that this is some OS X metafile that also includes a UUID of some sort.

Anyone more familiar with the format? Does the UUID allow to identify the user that originally downloaded the CSV and/or posted the archive? (Assuming that you have access to Apple's or Google's data).

dhx• 15 years ago

AppleDouble format version 2. Home file system is "Mac OS X". There are 2 entries in the file.

Format specifications for this file are available: https://tools.ietf.org/html/rfc1740

General information on the file format: https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_fo...

jonhendry4• 15 years ago

Might be related to a custom icon applied to the document, or something like that.

steve89183• 15 years ago

About 10 years ago, American Express had a service where you could create one-time credit card numbers for using it online. I loved it.

For whatever reason, a couple of years later, they got rid of the service. It's times like these when a service like that would have been perfect.

politician• 15 years ago

So, Citi provides a similar "Virtual Account Number" service which allows a cardholder to create a new cc# with a new expiration date and a specific balance, but the billing address cannot be customized which reduces the usefulness of the service.

As far as I know, it's also free.

CGamesPlay• 15 years ago

Interestingly, http://www.stratfor.com/ is "down for maintenance" at the moment.

jonhendry4• 15 years ago

If Anonymous thinks they're making a strike against American militarism with this, why didn't they hack some place that has more influence, like the American Enterprise Institute, which is blatantly ideological and employed a number of people who went on to the Rumsfeld Pentagon?

The people who support the Stratfor hack keep painting a picture of Stratfor which would far more accurately depict the mendacious hacks at AEI.

im3w1l• 15 years ago

They hack whatever sites their scripts work on.

860k Stratfor Accounts Dump

Related Stories