The Student Room – security breach

Any particular reason that the Union Flags have become coloured stripes since yesterday?

Why is there a woman smiling at us? I almost feel trolled.

That's an unrelated issue, if you clear your cache that will fix it

I do not disagree (http://www.thestudentroom.co.uk/showpost.php?p=38267483&postcount=47). There's plenty of blame to go around.

(Nice that we're agreeing on something for once)

Its pretty sloppy of web site owners and developers to rely on hashing paswords as some idea of security. Hashing is not encryption and the site should have used proper encryption in the first place instead of something that many websotes can decode for you in a minute or two.

Sloppy sloppy sloppy to risk members passwords like that

Hashing is a very common method of storing passwords, and it's not as easy to crack as you are suggesting. It's specifically designed to not be decrypted, and indeed can't be. To the best of my knowledge the only way to crack a password which is hashed using md5 is via a brute force method.

How would we hear about it? Anyone who has had their information comprised would probably have no idea how.

These people who now have our information; they have thousands of emails and potentially passwords so it'll take a long time to decode it if they want to make any use of it. The e-mails alone don't provide much to them.

They may be opportunists but now they have the information they can do as they please. With us now knowing we can try to make most of that information defunct by changing our passwords but a lot of people won't or might forget to change it on one or two websites.

Correct, although MD5 is very weak by modern standards, as its been about so long there are massive lists of precompiled hashes that can be used as a dictionary based attack (look up rainbow tables if you're interested).

Do we often disagree?

Agreed, although these rainbow tables are useless if you use a long and random salt with each password.

Before I start, I'd just like to say I know how much of a disaster and headache this must be for the TSR team.

Anyway, on the TSR blog you say this:


What confuses and annoys me is that TSR did not take 'every possible step to protect it's members data' when the number of other website were hacked. Why did TSR not jump into action after other websites (LinkedIn especially) was hacked?

You have thousands of members, which turns into thousands of email addresses and passwords, and you didn't bother to step up the security of the site in case you were hacked.

I'd like to know the answer to this, so please don't ignore it.

Hi there,

I thought I'd quickly respond - I can completely understand your frustration and we do take this situation incredibly seriously. In fact, TSR has always taken security incredibly seriously.

To clarify on one point, the actual security systems we have are very strong and they weren't hacked exactly. A single privileged user account was compromised, giving the individual access to do what they did.

As soon as we were notified, every privileged account and system password was changed immediately.

Unfortunately, if someone is intent on doing something like this we can't always predict how they will do it. We've learnt some tough lessons today and have already put in place even stronger processes and systems to protect our members. Thankfully, TSR doesn't store a great deal of personal information, so by updating a password people's data will be safe.

We are sorry this has happened and people have been working 24/7 to make sure it doesn't happen again. We'll keep you all updated on progress and news as it happens.

Jack

Just wondering why if this hacking took place on 14th June it is only today 8 days later we are being told to change our passwords...

Thanks for replying

What security measures do you have in place to protect these privileged accounts (before this happened)?

To be honest, I'd prefer not to go into detail with them for now because it's better not to share our security measures in a public way. In a few days we'll be able to explain more.