The news on Wednesday sounded like the setup for a lame Silicon Valley joke. Russian hackers stole 6 million passwords from LinkedIn. Did they mistranslate “world’s largest professional network” as “professional network that people actually use”? Where will they strike next, Google+? What are they going to do now that they’ve hacked all of those accounts, sell a bunch of résumés on the black market? Use your contact list to spam you with even more LinkedIn email invitations than you already get?
Amid the yawns and derision, one small group of people took the LinkedIn breach very seriously: security experts.
The answers to the facetious questions above are, in all probability, no, no, yes, and yes. No, the Russian hackers aren’t stupid, and they don’t care whether you actually use LinkedIn or not. No, they did not strike next at Google—too secure—but at the massively popular dating site eHarmony. Yes, stealing résumés and other personal information is almost certainly part of the plan, and a potential gold mine at that. And yes, sending you bogus emails that appear to be from people you know is one of the main ways they’ll hook you. It’s a lot more effective than sending emails from someone posing as a Nigerian prince.
The full dimensions of the breach are not yet clear. LinkedIn and eHarmony have not been particularly forthcoming about when and how it happened, perhaps because even they don’t know all the details yet. But computer security types are becoming increasingly convinced that the attack was more complex and sinister than the companies initially made it seem.
The bottom line: If you have a LinkedIn or eHarmony account, you should be concerned. And if you use the same password for other sites—particularly sensitive ones such as PayPal or Facebook—you should be very concerned. If you fall into either of those categories, you should go change your passwords immediately. (Well, you should finish reading this article first. But then go change those passwords!)
The first reports about the breach indicated that some 6.5 million LinkedIn user passwords had been published online, but without the email addresses needed to tie them to individual accounts. That sounded reassuring but raised a bunch of questions: Why would hackers post people’s passwords on an Internet forum for all to see? How could those passwords be used once they became public? And if your password wasn’t among those “cracked and leaked, ” did that mean you were safe?
Security experts have arrived at a surprising hypothesis: The hackers may have posted the passwords online because they needed the public’s help cracking some of them. If yours isn’t among those publicized, it may mean you’re not safe at all—it’s possible the hackers already figured out your password on their own. If that theory is true, that might also explain why no emails or other personal information was posted. Not because they don’t have it but because they’re keeping it to themselves, possibly with the intent of selling it to criminal hackers on the black market.
The majority of systematic security breaches, according to Symantec’s Marian Merritt, are orchestrated by criminal gangs with a profit motive. A smaller number are the work of “hacktivist” groups such as Anonymous or LulzSec whose main goal is to embarrass, expose, thwart, or intimidate their targets, often large corporations that run afoul of the hackers’ ideology. The LinkedIn breach bore a passing resemblance to past LulzSec hacks, including one that compromised the personal information of 1 million Sony users last summer. But no hacktivists have claimed responsibility, and the fact that the data were first posted on a Russian forum dedicated to password decryption suggests that publicity was a by-product of this attack, not its main intent.
So how exactly do cyber-crooks use these passwords once they have them? There are multiple potential uses, explains Chester Wisniewski, senior security adviser for data security firm Sophos. For hackers around the world, the huge trove of new leaked passwords is an opportunity to update their “rainbow tables”—vast databases that serve as a digital key for cracking encrypted passwords, called “hashes.” The most-secure websites use an extra layer of password encryption, called “salting, ” so that two users with the same password—say, “123456”—will have different hashes. But LinkedIn didn’t do that, so the same key will unlock the accounts of every user who has that password, not only on LinkedIn but on any other site that uses the same hashing algorithm. (eHarmony apparently used an even weaker algorithm, also sans salt.)
runescape gold
guild wars 2 gold
buy diablo 3 gold

Good info.