Notes

Hackers Profit from Millions Of Minecraft Passwords

Hackers take millions of Minecraft passwords



29 April 2016



Hackers have stolen login data for more than seven million members of the Minecraft site Lifeboat.



Lifeboat lets members run servers for customised, multiplayer maps for the mobile version of Minecraft.



Evidence suggests that stolen information including passwords and email addresses, is being sold by websites that trade in hacked files.



Research suggests that passwords were weakly protected so attackers could easily work them out.



Minimise damage



Information about the breach was shared with independent security expert Troy Hunt who said he got the list from someone who trades in stolen credentials. A number of people had informed him that the information was being circulated on dark net sites.



Mr. Hunt said the data was stolen in the beginning of 2016, but the breach has only recently been made public.



Passwords for Lifeboat accounts were washed, he said, but the algorithm used offered little protection.



Hashing is a method of encryption that encrypts passwords, making it difficult to read in the event the data gets lost.



He said that a Google search for a hashed passcode will often give the exact plain text value. The most well-known cracking tools can accelerate and automatize this process, he said.



He also stated that "a significant portion of these passwords would need been converted to plain text in a very short period of time" in an article on his blog about the breach.



He said that this can result in other security issues because many people use the same passwords for multiple sites which means that attackers could figure out which passwords are being used to hack accounts on other websites.



In a statement given to Motherboard, Lifeboat said it took action to minimize the damage.



"When this happened [in] January, we decided the best solution for our user was to to force a password reset, without letting hackers know that they had limited time to act," it said to the news site, adding that it now uses more secure hashing algorithms.



It stated: "We have not received any reports of anyone being damaged due to this."



Mr Hunt was dissatisfied with the company's decision to "quietly" forcing the password reset saying this policy made him "speechless".



He stated that Lifeboat should have been more proactive in notifying users to let them quickly change passwords in the event that they were used on other websites.



"How can we minimize the damage to our customers?" secure content is the first thing any business should think about after an incident of this kind. he said.



Minecraft leaps into virtual reality



28 April 2016



Beautiful People data sold online



26 April 2016



An estate agent is looking for Minecraft builders



30 March 2016



Minecraft to give AI a helping hand



14 March 2016


Website: https://securecontent.co/