Overclock.net › Forums › Industry News › Technology and Science News › [Neowin] Amazon password flaw
New Posts  All Forums:Forum Nav:

[Neowin] Amazon password flaw

post #1 of 42
Thread Starter 
Quote:
The problem is with the way Amazon stores the password. The system first converts all of the letters to upper-case which makes “MyPaSsWd123†the same as “mypasswd123†or “MYPAsswd123.†Next, it strips off everything after the eighth character. What this means is that “MyPaSsWd123†is simply stored as “MYPASSWD†in Amazon’s systems. Knowing this information makes attacking the password a much easier task.

The issue is most likely due to the fact that Amazon was using an older crypt() function that takes only the first eight characters. This was common on UNIX servers where the username and password hash were stored in the /etc/passwd file. Newer implementations move the hash to a more secure location and allow longer passwords.
Source

Time to change your password.
Echo
(8 items)
 
   
CPUMotherboardGraphicsRAM
Intel Core i5-3570K Asus Maximus V Gene Asus Radeon HD 7970 3GB Mushkin Blackline 16GB 
Hard DriveHard DriveCaseOther
2x Samsung 830 256GB Seagate Barracuda 3TB Silverstone Temjin TJ08-E BeQuiet E9-700w 
CPUMotherboardRAMHard Drive
Intel i3-3225 ASUS P8B75-MLX Corsair Ballistix Tactical Western Digital Red 
OSPowerCaseOther
Ubuntu Corsair CX500M Norco RPC-4224 LSI SAS 9207-4i4e HBA 
Other
Chenbro CK22804 24-Port SAS Expander Card 
  hide details  
Reply
Echo
(8 items)
 
   
CPUMotherboardGraphicsRAM
Intel Core i5-3570K Asus Maximus V Gene Asus Radeon HD 7970 3GB Mushkin Blackline 16GB 
Hard DriveHard DriveCaseOther
2x Samsung 830 256GB Seagate Barracuda 3TB Silverstone Temjin TJ08-E BeQuiet E9-700w 
CPUMotherboardRAMHard Drive
Intel i3-3225 ASUS P8B75-MLX Corsair Ballistix Tactical Western Digital Red 
OSPowerCaseOther
Ubuntu Corsair CX500M Norco RPC-4224 LSI SAS 9207-4i4e HBA 
Other
Chenbro CK22804 24-Port SAS Expander Card 
  hide details  
Reply
post #2 of 42
I thought mine "passwordz" was impenetrable. Now that I know the z isn't included, I better change it.
Low Tide
(12 items)
 
  
CPUMotherboardGraphicsRAM
i5-3570K @ 4.7GHz Asus P8Z77-V Pro EVGA GTX 670 FTW 8GB G. Skill 2133MHz 
Hard DriveCoolingOSMonitor
Samsung 850 Pro 256GB Prolimatech Megahalems Rev. C Windows X Samsung T240HD 
KeyboardPowerCaseAudio
Ducky DK9008G2 Red Corsair TX850W V1 Corsair Carbide 300R X-Fi XtremeGamer 
  hide details  
Reply
Low Tide
(12 items)
 
  
CPUMotherboardGraphicsRAM
i5-3570K @ 4.7GHz Asus P8Z77-V Pro EVGA GTX 670 FTW 8GB G. Skill 2133MHz 
Hard DriveCoolingOSMonitor
Samsung 850 Pro 256GB Prolimatech Megahalems Rev. C Windows X Samsung T240HD 
KeyboardPowerCaseAudio
Ducky DK9008G2 Red Corsair TX850W V1 Corsair Carbide 300R X-Fi XtremeGamer 
  hide details  
Reply
post #3 of 42
Mine is 12345 so this doesn't affect me at all.
TK-421
(14 items)
 
  
CPUMotherboardGraphicsRAM
2600K @4.5 1.22v Asus P8P67 Gigabyte GTX 970 G1 8gb Gskill Sniper 1.25v 
Hard DriveCoolingOSMonitor
1tb WD Black Thermalright Venomous X Windows 7 Pro 64bit Asus 24" 144hz 
KeyboardPowerCaseMouse
Logitech Corsair 550w HEC Logitech MX-518 
Mouse Pad
squishy one 
  hide details  
Reply
TK-421
(14 items)
 
  
CPUMotherboardGraphicsRAM
2600K @4.5 1.22v Asus P8P67 Gigabyte GTX 970 G1 8gb Gskill Sniper 1.25v 
Hard DriveCoolingOSMonitor
1tb WD Black Thermalright Venomous X Windows 7 Pro 64bit Asus 24" 144hz 
KeyboardPowerCaseMouse
Logitech Corsair 550w HEC Logitech MX-518 
Mouse Pad
squishy one 
  hide details  
Reply
post #4 of 42
Quote:
Originally Posted by jacksknight View Post
Mine is 12345 so this doesn't affect me at all.
That on your luggage too?
Primary
(15 items)
 
Secondary
(13 items)
 
In progress
(10 items)
 
CPUMotherboardGraphicsRAM
5820K @ 4.3/3.6GHz core/uncore, 1.225/1.2v Gigabyte X99 SOC Champion (F22n) 2x Sapphire R9 290X Tri-X OC New Edition (10036... 4x4GiB Crucial @ 2667, 12-11-12-27-T1, 1.37v 
Hard DriveHard DriveHard DriveCooling
Plextor M6e 128GB (fw 1.05) M.2 (PCI-E 2.0 2x) 2x Crucial M4 256GB 4x WD Scorpio Black 500GB Cooler Master Nepton 280L 
OSMonitorKeyboardPower
Windows 7 Professional x64 SP1 BenQ BL3200PT Filco Majestouch Tenkeyless (MX Brown) Corsair RM1000x 
CaseMouseAudio
Fractal Design Define R4 Logitech G402 Realtek ALC1150 + M-Audio AV40 
CPUMotherboardGraphicsRAM
X5670 @ 4.4/3.2GHz core/uncore, 1.36 vcore, 1.2... Gigabyte X58A-UD5 r2.0 w/FF3mod10 BIOS Reference R9 290X w/Stilt's MLU 1000e / 1375m E... 2x Samsung MV-3V4G3D/US @ 2000, 10-11-11-30-T1,... 
RAMHard DriveHard DriveHard Drive
1x Crucial BLT4G3D1608ET3LX0 @ 2000, 10-11-11-3... OCZ (Toshiba) Trion 150 120GB Hyundai Sapphire 120GB 3x Hitachi Deskstar 7k1000.C 1TB 
CoolingOSPowerCase
Noctua NH-D14 Windows 7 Pro x64 SP1 Antec TP-750 Fractal Design R5 
Audio
ASUS Xonar DS 
CPUMotherboardGraphicsRAM
i7-6800K @ 4.3/3.5GHz core/uncore, 1.36/1.2v ASRock X99 OC Formula (P3.10) GTX 780 (temporary) 4x4GiB Crucial DDR4-2400 @ 11-13-12-28-T2, 1.33v 
Hard DriveHard DriveCoolingOS
Intel 600p 256GB NVMe 2x HGST Travelstar 7k1000 1TB Corsair H55 (temporary) Windows Server 2016 Datacenter 
PowerCase
Seasonic SS-860XP2 Corsair Carbide Air 540 
  hide details  
Reply
Primary
(15 items)
 
Secondary
(13 items)
 
In progress
(10 items)
 
CPUMotherboardGraphicsRAM
5820K @ 4.3/3.6GHz core/uncore, 1.225/1.2v Gigabyte X99 SOC Champion (F22n) 2x Sapphire R9 290X Tri-X OC New Edition (10036... 4x4GiB Crucial @ 2667, 12-11-12-27-T1, 1.37v 
Hard DriveHard DriveHard DriveCooling
Plextor M6e 128GB (fw 1.05) M.2 (PCI-E 2.0 2x) 2x Crucial M4 256GB 4x WD Scorpio Black 500GB Cooler Master Nepton 280L 
OSMonitorKeyboardPower
Windows 7 Professional x64 SP1 BenQ BL3200PT Filco Majestouch Tenkeyless (MX Brown) Corsair RM1000x 
CaseMouseAudio
Fractal Design Define R4 Logitech G402 Realtek ALC1150 + M-Audio AV40 
CPUMotherboardGraphicsRAM
X5670 @ 4.4/3.2GHz core/uncore, 1.36 vcore, 1.2... Gigabyte X58A-UD5 r2.0 w/FF3mod10 BIOS Reference R9 290X w/Stilt's MLU 1000e / 1375m E... 2x Samsung MV-3V4G3D/US @ 2000, 10-11-11-30-T1,... 
RAMHard DriveHard DriveHard Drive
1x Crucial BLT4G3D1608ET3LX0 @ 2000, 10-11-11-3... OCZ (Toshiba) Trion 150 120GB Hyundai Sapphire 120GB 3x Hitachi Deskstar 7k1000.C 1TB 
CoolingOSPowerCase
Noctua NH-D14 Windows 7 Pro x64 SP1 Antec TP-750 Fractal Design R5 
Audio
ASUS Xonar DS 
CPUMotherboardGraphicsRAM
i7-6800K @ 4.3/3.5GHz core/uncore, 1.36/1.2v ASRock X99 OC Formula (P3.10) GTX 780 (temporary) 4x4GiB Crucial DDR4-2400 @ 11-13-12-28-T2, 1.33v 
Hard DriveHard DriveCoolingOS
Intel 600p 256GB NVMe 2x HGST Travelstar 7k1000 1TB Corsair H55 (temporary) Windows Server 2016 Datacenter 
PowerCase
Seasonic SS-860XP2 Corsair Carbide Air 540 
  hide details  
Reply
post #5 of 42
I've just tried logging in with the first 8 characters of my 18 character password... It ddin't let me in.

So what does this mean? All this seems to say is that if someone hacks Amazon's password collection, all they get are the first 8 characters of any given person's password?
Edited by AblueXKRS - 1/30/11 at 4:11pm
post #6 of 42
Quote:
Originally Posted by AdmiralThrawn View Post
I've just tried logging in with the first 8 characters of my 18 character password... It ddin't let me in.

So what does this mean?
It's probably 8 characters after it's encrypted.
Blitz II
(14 items)
 
  
CPUMotherboardGraphicsRAM
i5 750 MSI P55-GD65 GTX 660Ti 4GB Corsair Dominator 1600MHz 
Hard DriveOSMonitorKeyboard
600GB (2x300GB Velociraptors RAID0) Windows 10 24" ASUS VW246H Logitech Illuminated 
PowerCaseMouseMouse Pad
Corsair 750HX Lian Li Lancool PC-K62 G5/DeathAdder Desk 
Audio
Yamaha H80M + HS10W 
  hide details  
Reply
Blitz II
(14 items)
 
  
CPUMotherboardGraphicsRAM
i5 750 MSI P55-GD65 GTX 660Ti 4GB Corsair Dominator 1600MHz 
Hard DriveOSMonitorKeyboard
600GB (2x300GB Velociraptors RAID0) Windows 10 24" ASUS VW246H Logitech Illuminated 
PowerCaseMouseMouse Pad
Corsair 750HX Lian Li Lancool PC-K62 G5/DeathAdder Desk 
Audio
Yamaha H80M + HS10W 
  hide details  
Reply
post #7 of 42
does this mean that passwords below 8 characters are saved as the passwords? im confused
Red Cube
(16 items)
 
  
CPUMotherboardGraphicsRAM
skylake i6600 MSI B150 Mortar XFX R9 380 4GB XXX 16 GB G Skill 
Hard DriveHard DriveHard DriveOS
250 GB Samsung 850 Evo SSD WD Caviar Black 500 GB Seagate 7200.11 1 TB Windows 10 Pro 64 bit 
MonitorMonitorKeyboardPower
NEC AccuSync LCD2223WXM TCL Roku 32" Razer Black Widow SeaSonic 550W Modular 
CaseMouseMouse PadAudio
Cuboid Red G502 SteelSeries QCK Turtle Beach x32 
  hide details  
Reply
Red Cube
(16 items)
 
  
CPUMotherboardGraphicsRAM
skylake i6600 MSI B150 Mortar XFX R9 380 4GB XXX 16 GB G Skill 
Hard DriveHard DriveHard DriveOS
250 GB Samsung 850 Evo SSD WD Caviar Black 500 GB Seagate 7200.11 1 TB Windows 10 Pro 64 bit 
MonitorMonitorKeyboardPower
NEC AccuSync LCD2223WXM TCL Roku 32" Razer Black Widow SeaSonic 550W Modular 
CaseMouseMouse PadAudio
Cuboid Red G502 SteelSeries QCK Turtle Beach x32 
  hide details  
Reply
post #8 of 42
Quote:
Originally Posted by Blameless View Post
That on your luggage too?


 
Gaming Rig
(15 items)
 
 
CPUGraphicsRAMHard Drive
Intel 3.06 GHz C2D Radeon HD4670 12GB 1067MHz DDR3 1TB 7200RPM 
Optical DriveCoolingCoolingOS
8x SuperDrive Air Air OS X 10.7.2 
MonitorKeyboardPowerCase
27" 2560 x 1440 LED Wireless BT 310W PSU Aluminum Enclosure 
MouseMouse Pad
Magic Mouse None 
CPUMotherboardGraphicsRAM
Intel Core 2 Quad Q6600 Maximus Formula NVIDIA GeForce GTX 480 G.Skill 2x4GB DDR2 
Hard DriveOptical DriveCoolingOS
3x 500GB WD  Lite-On Air Windows 7 x64 HP 
MonitorKeyboardPowerCase
Gateway 24" 1900x1200 Razr Lycosa Corsair 750M Antec P180 
MouseMouse PadAudio
Razr DeathAdder Razr eXactMat Creative X-Fi Titanium 
  hide details  
Reply
 
Gaming Rig
(15 items)
 
 
CPUGraphicsRAMHard Drive
Intel 3.06 GHz C2D Radeon HD4670 12GB 1067MHz DDR3 1TB 7200RPM 
Optical DriveCoolingCoolingOS
8x SuperDrive Air Air OS X 10.7.2 
MonitorKeyboardPowerCase
27" 2560 x 1440 LED Wireless BT 310W PSU Aluminum Enclosure 
MouseMouse Pad
Magic Mouse None 
CPUMotherboardGraphicsRAM
Intel Core 2 Quad Q6600 Maximus Formula NVIDIA GeForce GTX 480 G.Skill 2x4GB DDR2 
Hard DriveOptical DriveCoolingOS
3x 500GB WD  Lite-On Air Windows 7 x64 HP 
MonitorKeyboardPowerCase
Gateway 24" 1900x1200 Razr Lycosa Corsair 750M Antec P180 
MouseMouse PadAudio
Razr DeathAdder Razr eXactMat Creative X-Fi Titanium 
  hide details  
Reply
post #9 of 42
Even if hackers did get into someone's account the hacker still couldn't go on a shopping spree. Billing and shipping addresses have to match, most places enforce a Visa check now and you have to enter a password to verify that you're purchasing from that particular site. Kind of Amazon's fault though not handling the database transfer correctly.
Skylake Is Here!
(17 items)
 
  
CPUMotherboardGraphicsRAM
Intel i7 6700K Batch #L535B021 4.7Ghz @ 1.296V GIGABYTE G1 Gaming GA-Z170X-Gaming 7 EVGA Geforce GTX 970 SSC ACX 2.0+ G.SKILL TridentZ 16GB DDR4 3000 
Hard DriveHard DriveHard DriveCooling
Samsung 950 Pro M.2 512GB  Crucial BX100 250 GB SanDisk SSDPlus 240 GB NZXT Kraken X61  
OSMonitorKeyboardPower
Windows 8.1 & 10 Dell UltraSharp 2913WM 21:9 2560x1080 Ducky Shine 4, CODE WASD, Deck Legend, G710+ EVGA SuperNova G2 850W 
CaseMouseMouse PadAudio
Phanteks Enthoo Evolv ATX Mid-Tower Ducky Secret SteelSeries Fostex Purple Heart TH-X00 
Audio
AKG K553 Pro, Philips SHP9500, Superlux 668B, S... 
  hide details  
Reply
Skylake Is Here!
(17 items)
 
  
CPUMotherboardGraphicsRAM
Intel i7 6700K Batch #L535B021 4.7Ghz @ 1.296V GIGABYTE G1 Gaming GA-Z170X-Gaming 7 EVGA Geforce GTX 970 SSC ACX 2.0+ G.SKILL TridentZ 16GB DDR4 3000 
Hard DriveHard DriveHard DriveCooling
Samsung 950 Pro M.2 512GB  Crucial BX100 250 GB SanDisk SSDPlus 240 GB NZXT Kraken X61  
OSMonitorKeyboardPower
Windows 8.1 & 10 Dell UltraSharp 2913WM 21:9 2560x1080 Ducky Shine 4, CODE WASD, Deck Legend, G710+ EVGA SuperNova G2 850W 
CaseMouseMouse PadAudio
Phanteks Enthoo Evolv ATX Mid-Tower Ducky Secret SteelSeries Fostex Purple Heart TH-X00 
Audio
AKG K553 Pro, Philips SHP9500, Superlux 668B, S... 
  hide details  
Reply
post #10 of 42
People are so ignorant when it comes to passwords. My buddy works in an office environment for IT support and the like and says he is just amazed on how many idiots put their passwords sticky noted to their desktop or under their keyboard as if it's "safe" Epic Failures
Never Enough
(17 items)
 
  
CPUMotherboardGraphicsRAM
Xeon 5650 4Ghz@1.26 Asus P6X58D Premium Sapphire R9 Fury  12GB Corsair XMS 3 
Hard DriveHard DriveHard DriveOptical Drive
Seagate 1 TB 7200 + Crucial M4 64gb Crucial M4 Crucial MX 300 Plextor 
CoolingOSMonitorKeyboard
Corsair H50 Win 7 Dell u2711 G510 
PowerCaseMouseMouse Pad
Modded Antec CP-850 Modded Antec 1200 DeathAdder Whats that? 
Audio
Yamaha RX-V373 
  hide details  
Reply
Never Enough
(17 items)
 
  
CPUMotherboardGraphicsRAM
Xeon 5650 4Ghz@1.26 Asus P6X58D Premium Sapphire R9 Fury  12GB Corsair XMS 3 
Hard DriveHard DriveHard DriveOptical Drive
Seagate 1 TB 7200 + Crucial M4 64gb Crucial M4 Crucial MX 300 Plextor 
CoolingOSMonitorKeyboard
Corsair H50 Win 7 Dell u2711 G510 
PowerCaseMouseMouse Pad
Modded Antec CP-850 Modded Antec 1200 DeathAdder Whats that? 
Audio
Yamaha RX-V373 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Technology and Science News
Overclock.net › Forums › Industry News › Technology and Science News › [Neowin] Amazon password flaw