01:38 PM
Connect Directly

Gawker Media Hacked

The company's user database and content management system have been breached, prompting calls to change passwords.

Gawker Media on Sunday said that its user database had been hacked and encouraged all registered users of the company's Web sites to change their passwords.

Gawker Media's properties include Gawker, Gizmodo, Jalopnik, Jezebel, Kotaku, Lifehacker, Deadspin, io9, and Fleshbot.

Over 1.3 million accounts, with some 540,000 associated e-mail addresses, were exposed and the company's content management system is said to have been compromised as well. The hacked data base file, initially available on The Pirate Bay's Web site, has since been removed. Gawker says that although the passwords were encrypted, they're still potentially vulnerable to hackers.

A group identifying itself as Gnosis has claimed responsibility for the attack. The group says its motivation is to punish Gawker for being arrogant, according to Mediaite.

Someone -- apparently H.D. Moore, creator of the metasploit framework and CSO at Rapid7, whose e-mail address is listed -- has posted a CSV file of the domains of affected e-mail addresses and hashed e-mail address values as a Google Fusion Table. The file includes instructions for how to generate an MD5 hash of one's e-mail address and to search for that value among the posted list of compromised accounts. Finding one's e-mail address on this list means it's definitely time to change your password.

Gawker is also advising users who maintained linked Twitter accounts with the same password to change their passwords at Twitter.

There's currently a Twitter spam campaign that's promoting acai berries through compromised accounts and there's some speculation that Twitter accounts exposed through the Gawker database compromise are being exploited to deliver the tweet spam.

Gawker Media issued an apology for the security failure. "We're deeply embarrassed by this breach," the company said in a statement on its Web site. "We should not be in the position of relying on the goodwill of the hackers who identified the weakness in our systems. And, yes, the irony is not lost on us."

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.