37

Entering my email at https://haveibeenpwned.com/, I was told that I have been pwned. I am in http://pastebin.com/SCLNRHJQ

I already tried

  • to find out my password by simply md5-hashing all my passwords I could think off and comparing them to the hash in pass
  • to check whether someone could easily crack my password by putting the hash into some online md5 "rainbow table service" myself.
  • to find the breached web site by searching my mail for registration notifications received on the registration date given in joined_on
  • to find email received from any mail address in the list.
  • to send an email to the first in the list, asking him whether he knows which site it is and/or whether he possibly is the owner of that site.

All of these loose ends came up blank.

I could only deduce that it has to be a really small LEGO-themed website, but that's it.

So I have changed all my passwords of my most-used accounts, especially the email accounts. The many old and sleeping accounts I don't know that I have, they are out of reach.

What else can I do?

Improve this question
10
  • 2
    Looking at the paste there's references made to LEGO in a number of the usernames which supports your small LEGO-themed website theory
    – GreatSeaSpider
    Dec 15, 2015 at 9:40
  • 3
    That's a great page for collecting email addresses!
    – pipe
    Dec 15, 2015 at 16:30
  • 8
    @pipe Pages like that is one of the reasons I have my own domain and generate addresses as needed. I have entered an address on that page and did not use it anywhere else. So if the addresses entered through that page are abused, I will know.
    – kasperd
    Dec 15, 2015 at 16:34
  • 5
    @kasperd People with gmail accounts don't need their own domain. I frequently use the trick of telling sites my address is _____+<site_abbreviation>@gmail.com. For instance, [email protected] could sign up as john.doe+[email protected], and all emails would go to his Inbox just fine. I
    – Monty Harder
    Dec 15, 2015 at 23:20
  • 4
    This was probably wallofbricks.com , which is run by one dwalton76, and which domain name was registered a week before his first login...
    – Michael Hampton
    Dec 16, 2015 at 1:18

4 Answers 4

Reset to default
27

The first rule is to clean up your act: use a password manager and have unique, long and random password for EACH and ALL your important services (email, google, etc.) and change all your passwords.

Then check if there are some mysterious transactions made on your accounts (not specifically bank accounts, mind you: anything that could be accessed using the email that was compromised). That should give you a good indication if the possible risk of being breached was realized.

Finally, take each possibly compromised account and think of how it could lead to a continuing issue: could some information extracted from that account be used in the future ? If yes, is there any action you might take to reduce the consequences ? Is the risk you're running worth the price you're going to pay to mitigate it ? If you can't mitigate it, can you ensure it ? Is it even worth insuring ?

Improve this answer
0
10

@Stephane makes good points in his answer.

On top of those points, you should also enable two factor authentication wherever it is supported, and especially for your email accounts and for places where you might have stored payment information.

In terms of the out-of-reach accounts, you might be able to get information about some of them by looking at your browser cookies, or the saved passwords from your browser. Modern browsers all have similar options. If you have it enabled, Chrome can sync passwords online so you could look there, and if you are on Windows, IE uses the Credential Manager, accessible from the control panel.

Improve this answer
2

Changing passwords and checking that no unusual activity has taken place is pretty much all you can do. Even if you manage to discover which site leaked the hash, there's nothing they can do now. Note that:

  1. It may take months between the leak and the moment someone cracks your password hash and attempts to attack. Observing no unusual activity doesn't mean you're safe, passwords still need to be changed.
  2. Even if your password is associated with a particular login (e-mail), it is unsafe to use with any login from now on. Once your password is revealed, it will be added to password lists which may be used in attacks on any site in the future. Hackers do this because many people tend to reuse passwords.

Hashing your passwords and trying to find the hash online is a useless test, since you don't know which salt was used when your password was hashed.

Improve this answer
5
  • 1
    Regarding your last sentence: Nope, it is not useless. I tried out which obstacles an attacker may have to take. If the site owner uses salts at all, I am safer than without, because I may hope that no rainbow table entries exist for now. If they use not salt at all, on the other hand, and I can crack my password in a matter of seconds using available online resources, this is far worse of a problem.
    – Alexander
    Dec 15, 2015 at 12:07
  • 2
    Not really - as Dmitry said, it can be months between a breach and a dump. It could be that they worked out how to access on a regular basis, and only dumped when the hole was fixed. They could have been attacking your password for months. It's unlikely, but even so, your best option is to consider than the password used is compromised. Given that dump, the most logical per-user salts would be the other columns in the database, which could be incorporated into a cracker easily.
    – Matthew
    Dec 15, 2015 at 12:26
  • @Alexander, you're right, this check rules out the extreme cases. I meant to say that it's not surprising you didn't find a match using this primitive technique.
    – Dmitry Grigoryev
    Dec 15, 2015 at 12:30
  • @Alexander Still, why take the chance? Generate a new, strong password or passphrase, update the one thing you used it on (because you did use it for only one thing, right?), and toss it in your password manager. No big deal.
    – Blacklight Shining
    Dec 16, 2015 at 10:29
  • @BlacklightShining Well, now that I know which site it is, I do update my passwords at all affected sites. But yesterday I didn't know which site, and I didn't know which password...
    – Alexander
    Dec 16, 2015 at 10:32
0

I would pay particular attention to financial services. e.g. any banking facility or payment methods. I recommend getting a new credit/debit card if you have ever used one online as you don't appear to know exactly what accounts or services you have used.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .