How to check if your password was exposed in Gawker hack

Researcher HD Moore spells out how to see what accounts were among 1.3M accessed by hackers

A security researcher today provided a way for users to see whether their e-mail addresses and passwords were among the 1.3 million compromised in a hack of Gawker Media's sites.

HD Moore, chief security officer at Rapid7 and the creator of the open-source Metasploit penetration-testing toolkit, came up with a down-and-dirty way for users to search the list of purloined account information without having to download the 487MB file from the Internet.

On Sunday, Gawker, which operates several popular technology sites, including Gizmodo and Lifehacker, confirmed that its servers had been hacked , and that hundreds of thousands of registered users' e-mail addresses and passwords had been accessed. A group calling itself "Gnosis" claimed credit for the attack, and said it had obtained more than 1.3 million accounts.

Gawker apologized for the breach, and urged users to change their passwords. If that password was used for accessing other sites, Gawker recommended that users change it for those destinations as well.

"It's best to assume that your username and password were included among the leaked data," Gawker said in an FAQ it posted on the Lifehacker site.

Moore had a better idea, and has assembled a way for people to check whether their account, including their password, has been compromised.

In an e-mail to Computerworld Monday, Moore spelled out the technique:

Step 1: Go to http://pajhome.org.uk/crypt/md5/ , enter an e-mail address in the 'Input' field, click the 'MD5' button, then copy the hash from the 'Result' field.

Step 2: Go to http://www.google.com/fusiontables/DataSource?dsrcid=350662 , click 'Show Options,' then paste the already-obtained hash in the field to the right of the '=' symbol. Change the left-most field to 'MD5.' Click 'Apply.'

If the e-mail address is among those compromised, the search will show a result.

Although Gawker said it encrypted users' passwords, some passwords have already been decrypted by Gnosis.

Moore used MD5 hashes of the e-mail addresses in the list he posted as a Google Fusion Table so users could check whether their accounts had been compromised without exposing the addresses a second time.

"This is a little clunky, but [it] works," he said.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com .

Read more about security in Computerworld's Security Topic Center.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacy

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Shining a light on creativity

MSI has long pushed the boundaries of invention with its ever-evolving range of laptops but it has now pulled off a world first with the new MSI Creative 17.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?