The Internet Archive has more legal problems than it can count, but someone decided it needed a cyberattack on top of that. In the last few hours, many users reported the appearance of a pop-up on the main page that spoke about a leak of 31 million users. The Have I Been Pwned portal confirmed that the information is real, but the background question is… why?
As Alfred said in The Dark Knight, some men just want to watch the world burn. The web is not immune to that desire, but in recent times, the Internet Archive has become a kind of “priority target” for certain agents. Granted, many publishers would love for the archive to be reduced to ashes, however, this is different. Anyone who has visited the site in the last 24 hours probably encountered this pop-up:
What’s going on at the Internet Archive?
The folks at BleepingComputer got in touch with Troy Hunt, the person responsible for the Have I Been Pwned service, who received a file on September 30 with the name “ia_users.sql”, 6.4 gigabytes. The database contains authentication details for registered users, including email addresses, screen usernames, bcrypt-hashed passwords, timestamps of password changes, and much more.
The most recent timestamp belongs to September 28, and it is estimated that the extraction took place that day. Hunt assures that there are 31 million unique addresses in the database, and many of them already receive alerts from Have I Been Pwned. With the help of researcher Scott Helme (who compared his bcrypt-hashed password with the one that appears in the file), it was possible to verify that the information is real.
Hunt contacted the Internet Archive on October 6, indicating that the leak would be available on the site 72 hours later. But that’s not all: In the early hours of Wednesday the 9th, the site was attacked with a DDoS. The group BlackMeta claimed the attack… and never explained the reasons. There is no lawsuit, no protest, no claim. Their only warning is that the attacks will continue.
Needless to say, anyone with an account on the Internet Archive should change their password.
Sources: BleepingComputer, The Verge, Have I Been Pwned
