Hackers could use leaked Gawker info to attack government workers
Gawker apologized for the breach and urged users to change their passwords. If that password was used for accessing other sites or for other e-mail accounts, Gawker recommended that users change it for those destinations and accounts as well.
Hackers have already demonstrated that trying the leaked passwords works.
Earlier today, the head of Twitter's Trust and Safety team claimed that a spam campaign launched against users of the micro-blogging service had used Gawker account passwords to access Twitter accounts secured with the same passwords.
"Got a Gawker acct that shares a [password] w/your Twitter acct?" said Del Harvey in a Twitter message. "Change your Twitter [password]. A current attack appears to be due to the Gawker compromise."
Later Monday, she said, "The Gawker hack and resultant compromised passwords and e-mails bled over to Twitter."
One security expert said it is almost certain other attacks relying on the leaked e-mail addresses and passwords will follow.
"You can bet on it," said Andrew Storms, director of security operations with nCircle Security. "[Hackers] have already shown a propensity to use the data ... and there is no doubt it will be used again."
The problem, of course, stems from people using only a few distinct passwords for all the online accounts they accumulate, a fact that security professionals have repeatedly pointed out.
"I always tell people that with online services, the complexity of the password is not as important as the uniqueness," said Storms in an instant message interview. "Meaning to use different passwords for different sites [and not to use] your work e-mail [account]."
Storms urged government network administrators to take note of the leaked information, and reach out to their users.
"They should be using this warning in the [Anonymous] chat room about potential re-use of passwords as a chance to get out of cubeland and warn users," he said.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts