Cyberattacks can hit where you least expect them, and this time it was the turn of the social network Taringa. Its administrators reported at the beginning of August an "attack" that compromised the internal databases, forcing them to temporarily block access to affected accounts and force the corresponding password changes. However, in recent hours a leak has been confirmed that raises the number of compromised accounts to more than 28 million, and as if that were not enough, the use of the MD5 algorithm caused the data to be easily decrypted.
The Attack on Taringa
Some cyberattacks are the work of perfectly planned and coordinated operations that exploit the weaknesses of a poorly maintained platform. The average user learns this the hard way when they discover that a malware variant hit their computer due to an unpatched version of Windows, but the situation is much more serious if the attack focuses on a popular service such as a social network. That is exactly what happened to the Taringa portal.
In the first days of August, the administrators of the social network published a general message through which they announced an external attack that compromised both the databases and the site's code. The text also highlighted the possibility that the attackers may have obtained a copy with nicknames, email addresses, and encrypted passwords, but credentials from other networks were not affected, nor were the Bitcoin wallets of the Taringa Creadores program. Taringa proceeded to contact affected users and force a password change, in addition to strengthening its encryption method. Unfortunately, the attackers did manage to extract a copy of the database, and a few hours ago the LeakBase portal confirmed its leak. The total number of exposed accounts was 28,722,877.
The Data Breach and the MD5 Problem
The most serious thing is that the passwords were encrypted with the MD5 algorithm, which was declared obsolete due to its multiple security flaws. The recovery process is so simple that LeakBase managed to crack almost 94 percent of the encrypted passwords in a matter of days. This allowed generating a list with the 50 most used passwords, the most popular password length, and the main email services. In this particular case, the use of a weak or strong password is not entirely relevant, since the fault lies in the implementation of MD5.
Taringa said it will be replaced with SHA256… but it is obvious that it arrives a little late.
