Notes

Hackers Profit from Millions Of Minecraft Passwords

Hackers are able to steal millions of Minecraft passwords



29 April 2016



Hackers have stolen login data for more than seven million members of the Minecraft site Lifeboat.



Lifeboat members can run servers to create custom maps of multiplayer for Minecraft's smartphone edition.



Evidence suggests that stolen information such as email addresses and passwords is being offered by sites that sell hacker files.



Analysis shows that passwords were not secure enough to allow attackers to easily access them.



Minimise damage



Troy Hunt, an independent security expert, received information about the breach. Nomad.so He claimed that he obtained the list from a person who deals in stolen credentials. A number of people had informed him that the data was circulating on dark net websites.



Mr. Hunt said the data was stolen in the beginning of 2016, but the breach has only recently come to light.



He claimed that passwords for Lifeboat accounts had been washed however the algorithm employed provided very little protection.



Hashing is a method used to encrypt passwords so that they aren't easily read when the data is lost.



Often, he said it is the case that a Google search for a password that has been hashed would instantly give the exact plain text value. He said that well-known cracking tools could be able to automate this process and speed it up.



He also stated that "a significant portion of these passwords will have been converted to plain text in a short amount of time" in a blog post on the breach.



This can lead to other security issues the expert said, as many people re-use passwords so that they can be exposed to attackers to hack accounts on other sites.



In a letter to Motherboard, Lifeboat said it took action to mitigate the damage.



"When this happened [in] January, we determined that the best option for our user was to force them to reset password without telling hackers they were only allowed to take action," it said to the news site, noting that it now uses stronger hashing algorithms.



It also stated that it had not received any reports that any person was hurt due to this.



Mr Hunt was dissatisfied with the company's decision to "quietly" forcing the password reset saying the policy rendered him "speechless".



He said that Lifeboat could have been more proactive in advising users so that they could swiftly change passwords if they used on other websites.



"The first thing that should be on the minds of any business following an incident like this is'How can we minimize the damage to our users?" He added.



Minecraft makes virtual reality a reality



28 April 2016



Beautiful People data sold online



26 April 2016



An estate agent is searching for Minecraft builders



30 March 2016



Minecraft to give AI assistance



14 March 2016


My Website: https://nomad.so/