Internet Archive hacked, data breach impacts 31 million users

www.bleepingcomputer.com Just a moment...

Technology @beehaw.org

www.bleepingcomputer.com /news/security/internet-archive-hacked-data-breach-impacts-31-million-users/

154 13

48 comments

It's always heart breaking to see IA in trouble :(
- Yeah, what kind of hacktivist group would go against Internet Archive? Not activists for good at least.
  Edit: according to another article they are a pro-Palestinian group. Still not sure about their motives for Internet Archive.
  BlackMeta, also known as SNBlackMeta, appeared in November 2023 and has a history of claiming responsibility for attacks against organizations in Israel, the United Arab Emirates, and the United States. In May, the group claimed responsibility for a multiday denial-of-service attack on the San Francisco-based Internet Archive. In April, the group claimed to have attacked the Israel-based infrastructure of the Orange Group, a French provider of telecommunication services in Europe, the Middle East, and Africa. The group also targeted organizations in Saudi Arabia, Canada, and the United Arab Emirates.
  Dark Reading
  
  They're not hacktivists, they're just assholes.
  
  Probably corps
  
  When someone asked the group who claimed responsibility on Twitter, they said this:
  They are under attack because the archive belongs to the USA, and as we all know, this horrendous and hypocritical government supports the genocide that is being carried out by the terrorist state of "Israel".
  Later they made a long Tweet saying even more.
  I'll be fully honest, I do not get it. At all.
  You'd think they'd be attacking some government website or even FAANG if they really wanted to say something.
  Looking through their feed, seems like most of their attacks are DDOS. Guess IA was one of the few they actually managed to breach.
  Picking on easy targets is lame.
  
  hmm, a faux hacktivist group certainly would be an excellent and easy way for an intelligence agency to try and redirect anger. hypothetically speaking, of course.
- IA is a pillar of internet activism, and an exceptional instance of the spirit of the web pioneers. No real hacktivist would take them on. These guys are spooks, black hat, or corporate actors.

But why?
- no idea
  but google cache is being shut down, then google announces they'll be participating with IA.
  now this.
  really not a good time in history for our ability to easily document web history to be getting messed with.
  
  I feel like google cache has been gone for years. Remember when you could choose to see the cached version of almost any site that came up in your search results? I want to have nice things again.
  
  Google shut down their cache and "teamed up" with IA to offload the work to someone else's server, so they don't pay for it.
  
  I just hope they backed up geocities
- if assholes are willing to ransom a pediatric burns hospital for money, they would have the required lack of empathy to attack the IA.
- Horrible people like to see the greatest things humanity has ever done burn to the ground. That's my guess.
  
  I mean in terms of a hacking accomplishment, it's like you beat up a disabled person. 😐

Those corporate scums (Hachtte, HrperCollins, Pnguin…) paid for it. I am 100% sure. Don't prove me wrong.
They claimed to be pro-Palestinian because they want Israel to be on the right

Friendly reminder: If you haven't diversified your passwords yet, get a password manger and do it!
Its not an if someone gets hacks, its when.
I don't know if this hack included any user and password, but if it did, they will try the combo on other sites.
KeePassXC, works great but you are responsible for your own file and syncing it between devices. (I use syncthing, but a cloud drive is a viable sync method, its all encyptyed) (iOS options limited)
Bitwarden, great if you don't want to worry about the file and everything syncs on its own. (There is a self hosted version, if you prefer).
Avoid anything paid or tied to a major corporation, they have proven time and again they cn not be trusted to keep our data safe.
- I’m using 1Password and have been happy using it. Any reason not to use it, aside from not being open source?
  
  For something that literally holds all your credentials, just it being closed source should be enough of a concern.
  
  You're trusting a third party to store, protect and not loose your passwords behind a vault you never see.
  Google had messed up pretty bad a few months ago. Last pass has had issues. I'm unaware of 1pass having issues, but I don't exactly pay close attentions. https://www.keepersecurity.com/blog/2024/08/01/google-password-manager-loses-millions-of-passwords/
  These days its not if something bad happens, its when and how bad.
  Keeping your database private, also reduces the risk of random attacks a lot. If you're passwords aren't part of a big data leak, they can't use them. Hackers are after the big payouts or the easy payouts. They're less likely to spend a lot time trying to crack your one database, when they can move on to the next guy who keeps them all in a word doc.
  If you do have reason to keep using 1pass for whatever reason, be it convince or lack of time to switch, I highly recommend at least getting your important (email, bank, etc) passwords duplicated to something like Keepass (back that file up too) so if/when 1pass ever looses your passwords, you at least have a solid starting point for recovery. Its also good way to familiarize/try out a few options with out dedicating to a full switch.
- And if self hosting bitwarden seems tough, look at vaultwarden instead. It's a one-container all in one bitwarden-compatible container.
- They only got salted hashes AFAIK. Still it is absolutely good advice to use a password manager.

Reminds me of those people who tested how fireproof the library of Alexandria was. Thanks a lot assholes!
- This really happened?
  
  I have actually no idea, who exactly burned it down finally.

What user data do people have on ia?
- Haven't looked much into the breach, but probably the biggest issue is passwords. If unencrypted, and a user uses the same generic password for their email or bank or whatever, that possess a serious concern.
  This highlights the importance of not reusing passwords
  Edit: looks like passwords were hashed with bcrypt, which is really quite excellent. Very unlikely anybody is getting actual passwords from this leak.
  
  If someones reusing their passwords then their passwords will likely be found very easily with rainbow tables.
  
  I'd hope that passwords would be unencrypted, really they should be hashed ;)
- Hopefully they didn't store to much financial info from donations, otherwise I am a bit coocked...
  
  This is why monero should be the future.

well well well, the archiver becomes the archivee

fucking edgelords... IA has trouble staying on its feet without this sorta crap.
this has "kicking puppies for palestine" energy - not sure where I've read this but it's an apt analogy.

Now I'm glad that I made disposable email addresses for most of my accounts a couple of months ago. With all the data breaches, it seems that email aliases are essential. I use SimpleLogin.
For the sake of simplicity, I also bought a domain to use for all those email addresses

48 comments