A hacker has stolen over 1.9 million user accounts from Dota2.com, the forum of the popular esports game Dota 2, according to LeakedSource.
The stolen data includes email addresses, IP addresses, usernames, and passwords. The passwords are hashed—effectively a password scrambler meant to keep the data safe—using the MD5 algorithm, a long-antiquated and weak function that reportedly allowed LeakedSource “to convert over 80 percent” of the passwords to their true plain text values, a format anyone can read.
That amounts to over 1.5 million passwords stolen outright.
The weakness of MD5 isn’t new. In 2012, LinkedIn was hacked and 6.46 million passwords were exposed due to the weak MD5 algorithm. The software’s author said then—over four years ago—that the scrambler is “no longer considered safe.“
Worse yet, security expert Bruce Schneir said in 2005 and 2004 that “MD5 is broken” because a large number of passwords can be computed and decrypted by an attacker at rapid speed. That’s over a decade go.
Why was Valve, the publisher of Dota 2 and the company behind the breached forum, relying on it for security in 2016?
The company has yet to respond to questions about its security.
The theft came in the lead up to The International 2016, the game’s global championship, which boasts over $20 million in prize money, a record-breaking amount.
Originally breached on July 10 using an SQL injection vulnerability on vBulletin forum software, ZDNet reports, the hacked database ended up on LeakedSource.com, a site meant to chronicle breaches and give easy access to users searching for their own stolen credentials.
You can search LeakedSource.com to see if your credentials have been stolen. Users should immediately change their passwords if they may be impacted, especially if they share passwords across multiple sites. If you used your Dota2.com password anywhere else, change those, too.
H/T ZDNet
