Beijing time on June 13 before dawn, a station releases announcement to say the website encounters the hacker is atttacked, close ten million the discharge outside user data.
Nevertheless, in the announcement that in A the station issues, curtilage guest channel still discovers a few await exquisite detail, for instance, what leak says in announcement is the password that A stands to had increased close memory, since that is not password of proclaimed in writing, can be you defeated to solve by the hacker after leak? The stronger password that A station place says is politic, what be after all? The partial data that pulls a library can have seen on Github, the data leak that when knows an user is A station after all? Rub do obeisance to true library be pullinged? Already mixed in the website Shell of the sale on dark net inside is net attributive met after all what kind of to user and A station generation influence?
Taking these question, the editor was found know to achieve Yu Yunan complete controller on the west alliance.
Of 1. leak is the password that has increased close memory, not be proclaimed in writing, sequential and serious?
In announcement, acFun states the data that reveal includes user ID, nickname and the code that increase close memory.
That is to say, what the hacker takes is not password of your proclaimed in writing, whether are these passwords that increase close memory met then by very quick broken solution?
Alliance tells on the west curtilage guest channel, generally speaking, the website is to increase close memory to the memory of the password, how much is true password, a station also does not know.
For instance, your password is 345678, but in A station, the likelihood is next graphs 16 in red circle or a string of 32 number.
▲ some MD5 adds close algorithmic password to defeat solution website
Just, add close algorithm to have what defeat solution easily, also have difficulty bigger defeat solution not easily relatively. At present the commonnest on market adding close algorithm is MD5, compare as a result of use range wide, so also " successful " the attention that drew a hacker, current, add close algorithm in the light of this kind, already a lot of on-line defeat solution website, and the imagination that captures the ability of solution to may exceed you a bit.
If your password is the password of 6 less than, and the website that you log onto returns those who use is MD5 to add close algorithm, so, need not suspect, want this website to be stared at to go up by the hacker only, your password sweeps to allow (on what write in the graph is 100% ) .
2, what is stronger password strategy? How does average user do?
In announcement, we see A station says from July 7, 2017 later, used stronger add secret algorithmic strategy, what is this kind of strategy?
Alliance guesses on the west, a station is pulled this library, it is the problem of the password not just, before pulling a library, the hacker is to had passed SQL certainly or the flaw attack method such as XSS inbreaked website, ability is pulled library, so website itself is leaky, should stem first flaw.
After that, talked to be inbreaked really again, reassume what measure. What what say in announcement is stronger add secret strategy, alliance guesses on the west should be to upgrade to add close algorithm, abandon MD5 for instance, used the difficulty defeating solution such as Sha256 taller add close algorithm.
So, we see say in announcement, they will upgrade to add close algorithm July 7, but the ability when this inputs a password again in the light of the user only upgrades, if be not being inputted, a station does not know your original code, what store in its database is not reversible add secret data (although the part can pass the website defeating solution above possibly to defeat,solve) , also undertake be addinged afresh to primitive password directly without method close, the ability when unless the user is new,loginning can increase close memory afresh. And if a lot of users did not login afresh, final result is, come to the light, the hacker pulled a library to obtain many defeat solution more easily add secret data, go up in a state of anxiety of will of people of ten million user.
How should that tall danger user do now? Alliance gave out on the west groovy at 3 o'clock proposal:
1, important website does not use a code with common website.
2, password as far as possible complex dot.
3, the website that visits Https as far as possible.
Does 3. pull the ministry mark of the library to see according to can you been on Github? The data leak that when knows an user is A station after all?
Today, besides the check scheme that in A the station makes a statement to hawk data with dark net, the editor still saw the data that has published on Github partly, this is meant, black produce need not expend interest goes doing bit money to be bought on dark net, direct point goes in to be able to get the leak data of partial user.
The word says, doesn't the hacker plan to take this to sell fund?
Back-to-back, the editor saw this piece of cut next pursues again, carelessness is the hacker signs up for safe flaw to A to stand already, but the other side pays no attention to them, they are offended later wool ～
Hacker threaten, on June 13, 300 can be announced on Github, if still do not have a reply, 15 can back-to-back moves announce 3000, if do not have a reply again, 18 are 10000, still can include Admin user. . .
So A station chooses to send announcement today, because it just knows to have serious data leak today,not be!
4. rub did obeisance to true library be pullinged? If belong to solid, what consequence can you have?
The cut of dark net sale that circulates on the net pursues medium, still have with what A stands to appear side-by-side rub do obeisance to.
To rub do obeisance to medium the problem of action, alliance is responded to on the west, at present he has not seen the data that has real hammer into shape comes out, cannot affirm 100 percent so.
Current nevertheless, the cut plan that already had sale circulates inside the circle.
Alliance thinks on the west, if belong to solid, so, rub the individual information that does obeisance to an user, address, drive a record (arrive from which, often go by bike the hotel opens a room) , the data such as mobile phone, mailbox is likely also by leak.
Before this, csdn also has encountered leak of password of proclaimed in writing, more horrible! UniCom is medium also enrol too, what flaw can examine number of a mobile phone communicate record, often mix for instance date of which mobile phone is contacted (it is to catch simply small 3 gods implement) .
What consequence does the meeting after 5. obtains Shell produce?
Besides the data leak of the user, hawk in dark net still have a website SHELL and inside net attributive, what consequence can this cause?
Generally speaking, shell is the hacker inbreaks after website server, give website server embedded back door, go to the lavatory to face a server to undertake controlling in the future, get data. If that is taken by the hacker attributive, what consequence can you have?
On the west alliance with sensitive data citing, there can be oneself commonly inside the company inside net, public network cannot be visited directly, for instance inside net file server, inside net OA, if the hacker took website limits of authority, can know this company has how many user, brisk rate truly how, is the number that announces external when public relations at ordinary times actual? If false, can affect company financing directly, next. . . Dog belt?
He still summed up an of all kinds website to be obtained by the hacker the process of Shell and consequence, everybody can be experienced.
1, after a lot of websites pull a library, can take the mobile phone date of the user and password, what try those who issue you to pay treasure, small letter to be used next again is same a password and so on, perhaps contact the user of your website means sells other the company, borrow money for instance, those who sell a house.
2, after website of a few media is inbreaked, be used directly by the hacker ad of the color that deliver gain. (I should tell a boss this example)
3, the contribution website of modification commonweal website, change the contribution bank account that publishs external into oneself secretly, it is average person also looks the number not to understand anyway.
4, inbreak electric business website, charge a cost to oneself secretly, perhaps change the thing of 10 thousand money into a money, oneself are bought, change cost price again next go back.
5, inbreak game company, have him research and development, stole your code, go building illicit take or sell.
6, come back company contract data secretly, sell a competitor undermine the foundation next.
