Billy Tompson: How hackers breached Gawker's security ? and how to protect yourself

Just how safe are your details after the emails and passwords of around 1.3m registered users were released by Gnosis?

What was hacked into?

Nine websites owned by New York-based Gawker Media, including the media and technology site Gawker and popular gadget site Gizmodo.

What was exposed?

The emails and passwords of around 1.3 million registered users ? including those of Gawker Media owner Nick Denton and its employees ? were accessed and subsequently published online. The group's publishing system and source code were exposed. All of these details were made available on filesharing sites, BitTorrent and The Pirate Bay.

The hackers managed to crack more than a quarter of a million passwords in the Gawker database. Within this group, more than 2,600 used the word "password" or "qwerty" ? the first six characters along the top line of English-language keyboards ? as their login. One of these users is registered with a government email address, while other accounts trace back to Nasa.

Who carried out the attack and why?

A group calling itself Gnosis claimed responsibility for the attack, apparently in response to a series of disparaging Gawker blogposts about the internet messageboard 4Chan. One Gawker post apparently described 4Chan users as "script kids", dismissing a number of internet attacks by groups borne out of the forum.

Gnosis are unrelated to the thousand-strong group, known as Anonymous, which last week crippled the websites of a number of companies that cut ties with WikiLeaks following the release of confidential US diplomatic documents.

How did they do it?

Probably by hacking into an external server rather than into the site content management system (CMS), say experts, because of the privileged access the hackers achieved. They were able not only to copy the contents of all the databases, but also the programs that are used to serve up the sites, known as their source code. The hackers also seem to have accessed its production and development servers, finding source code with extra details that would be removed from those servers users access.

To gain access to users' passwords, Gnosis used what is known as a brute force attack. This method tries every possible combination of letters and numbers against each other until the correct match is found. It is inevitable that the correct match will be found, of course, but the strength of the password lies in how long it will take.

Didn't Gawker encrypt users' passwords?

Yes, but not well enough. Gawker made the hackers' task simpler: if a user entered a password with more than eight characters, it dropped those after the eighth ? dramatically limiting the scope of the attack required.

Gawker users with a password of more than eight characters can rest easier than those with eight or fewer characters. The encryption method apparently employed by Gawker enabled the hackers to decode only the first eight characters of a user's password, meaning that longer passwords were unable to be decoded in full.

Has the Gawker hacking led to any other problems?

On Monday morning a Twitter scam posting more than 10,000 tweets a minute surfaced from the accounts of people who had registered using the same passwords for both Twitter and Gawker Media. Opportunistic fraudsters had used them to gain access to Twitter users' accounts and began posting scam tweets advertising "acai berries".

How safe is your password?

Unless you have different passwords for multiple websites, the likelihood is that it's not very safe. Just under a third of us still use a single password for a number of websites, according to recent research by computer security firm Sophos. If one of these accounts falls into the wrong hands a user's entire online profile may become compromised. Experts recommend that people don't use "dictionary" passwords at all, instead taking a memorable sentence and comprising a password based on the first letter of each word in it.

How do I know if I've ever created an account with Gawker Media?

If you have registered with Gawker.com, Fleshbot, Deadspin, Lifehacker, Gizmodo, io9, Kotaku, Jalopnik, Jezebel, Gawker.tv, Valleywag, or Cityfile at any point in the last seven years there's a chance your email address and password have been exposed.

Gawker advises that all users change their passwords for the site and any others where the same password is used.

You should do this on Gawker.com, and not on any links in emails you might receive: they might be legitimate, or they might be phishing scams.

guardian.co.uk © Guardian News & Media Limited 2011 | Use of this content is subject to our Terms & Conditions | More Feeds