Don't panic: That Russian hack bombshell isn't what you think

Infoworld ^ | 8-7-2014 | Caroline Craig

[markomalley]

FUD over the current state of cyber insecurity reached a fever pitch this week as thousands gathered in Las Vegas for Defcon and Black Hat. While the hacking conferences served up their usual paranoia-inducing mix -- demos of Dropcam hacks and warnings that mobile apps are spying on us -- first prize for panic mongering this week goes to the New York Times story on Russian hackers who allegedly amassed 1.2 billion stolen Web credentials and half a billion email addresses.

Hold Security, which uncovered the database of stolen info, called it "arguably the largest data breach known to date," but failed to provide key details about the stolen data -- which should have raised questions about the seriousness of the discovery. Regardless, the Times report quickly went viral, as news outlets ranging from CNN, USA Today, and MSN to Ars Technica and Cnet hammered home the message: Your password may have been stolen. Many of the reports compared the latest "breach" to the theft of 110 million users' data in the hack of retailer Target earlier this year.

So kudos to Forbes' Kashmir Hill for being the first to stick a great big pin in the hype, calling it "the freakiest security story since Heartbleed." Hill pointed out that the story provided few details beyond hyperbolic numbers, and "no specifics about the state of those [stolen] passwords: whether they're in clear-text -- the worst case scenario -- or in encrypted form." It's worth noting that even small websites usually don't store passwords in plain text anymore. The system used to protect passwords, called "hashing," offers varying degrees of protection, some which can be broken in minutes and others that take longer and are more costly to break.

[SoFloFreeper]

I put it all up to Team Obama and its sycophant media minions trying to blame the Russians for stuff.

Wag the dog, etc.

This current regime is a bunch of liars so I don’t believe really much of anything they say.

[353FMG]

If you believe that this current regime is a bunch of liars, you can keep your beliefs.

[Bloody Sam Roberts]

The system used to protect passwords, called "hashing," offers varying degrees of protection, some which can be broken in minutes and others that take longer and are more costly to break.

I seriously doubt that. Once hashed, the original cannot be rebuilt from the hash.

[molson209]

I still think these Hackers(LOL) have a very big pile of nothing

[henkster]

When I saw the headline “Russian bombshell,” I came here looking for photos.

I am disappointed...

[EinNYC]

I had no end of aggravation after the Target breach. Had to close all my bank accounts and reopen new ones, close many online accounts and reopen under a new name, etc. Had to argue my way out of late fees and such when monthly-repeating bills tried to pay utility bills and such out of my old bank account, so had to update the account number with them, etc. In other words, a real big mess. Now I read that hackers stole info AGAIN. I immediately changed all passwords to really weird character strings on websites where I do any financial dealing. How the heck ELSE can we protect ourselves? The NSA is only interested in INVADING our privacy, not protecting it.