Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Troy Hunt Profile picture
@troyhunt
Oct 9 • 9 tweets • 3 min read • Read on X
Hi folks, yes, I'm aware of this. I've been in communication with the Internet Archive over the last few days re the data breach, didn't know the site was defaced until people started flagging it with me just now. More soon.
Looks like someone compromised a polyfill JS file on a subdomain to inject the alert, but that doesn't explain the root site being down
Looks like a combination of things with the site being DDoS'd as well:
Responsibility for the DDoS attack being claimed by @Sn_darkmeta:
Notifications are now going out to impacted @haveibeenpwned subscribers:
Let me share more on the chronology of this:

30 Sep: Someone sends me the breach, but I'm travelling and didn't realise the significance
5 Oct: I get a chance to look at it - whoa!
6 Oct: I get in contact with someone at IA and send the data, advising it's our goal to load within 72 hours
7 Oct: They confirm and I ask for a disclosure notice
8 Oct: I follow up on the disclosure notice and advise we'll load tomorrow
9 Oct: They get defaced and DDoS'd, right as the data is loading into HIBP

The timing on the last point seems to be entirely coincidental. It may also be multiple parties involved and when we're talking breach + defacement + DDoS, it's clearly not just one attack.
@haveibeenpwned Obviously I would have liked to see that disclosure much earlier, but understanding how under attack they are I think everyone should cut them some slack. They're a non-profit doing great work and providing a service that so many of us rely heavily on.
@haveibeenpwned This is good advice, however,,, you can’t change your password whilst the site has been DDoD’d offline. But then nobody else can log on with your password either, so 🤷‍♂️
@haveibeenpwned They’re back online for me, how about everyone else? Might be a good time to change your password if you have an account there: archive.orgImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Troy Hunt

Troy Hunt Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @troyhunt

Troy Hunt Profile picture
Oct 8
This was a very uncomfortable breach to process for reasons that should be obvious from @josephfcox's article. Let me add some more "colour" based on what I found:
Ostensibly, the service enables you to create an AI "companion" (which, based on the data, is almost always a "girlfriend"), by describing how you'd like them to appear and behave: Image
Buying a membership upgrades capabilities: Image
Read 21 tweets
Troy Hunt Profile picture
Sep 25
Another cool little @Cloudflare thing that snuck out recently is this very simple security.txt creator: Image
It's a simple form-based configuration that takes the basics of a security.txt file in the following interface: Image
Because @cloudflare sits in the middle of the traffic, they can then intercept requests to the appropriate path and serve up the file. Here's one I just created: troyhuntsucks.com/.well-known/se…
Read 4 tweets
Troy Hunt Profile picture
Jul 29
Our Aussie Cyber Security Act is going to be interesting to watch unfold not just in it's initial form, but as it evolves over the years. IMHO, great steps forward, but let's look at those arguments *against* it abc.net.au/news/2024-07-3…
"Business groups say the new disclosure rules, and the proposed $15,000 fines for failures to disclose a payment, could sink some small operators." - you only get fined if you don't disclose, so... don't hide the breach!
"They are also pushing back against the decision to include businesses with an annual turnover of more than $3 million, arguing the threshold is too low" - appx 90% of Aussies businesses have turnover <$3M/y, so the scope is still very small
Read 7 tweets
Troy Hunt Profile picture
Jul 19
Something super weird happening right now: just been called by several totally different media outlets in the last few minutes, all with Windows machines suddenly BSoD’ing (Blue Screen of Death). Anyone else seen this? Seems to be entering recovery mode: Image
The issue is worldwide: dailymail.co.uk/news/article-1…
Hearing multiple reports of a Crowdstrike agent issue
Read 22 tweets
Troy Hunt Profile picture
Jul 6
Let's start with what should be obvious: any infosec story that includes a headline about "largest", "greatest", "worst", or similar superlatives should be regarded with suspicion right from the outset. That said, let's delve into this one: cybernews.com/security/rocky…
Firstly to the title - "RockYou". This harks back a decade and a half to a 2009 data breach that exposed 34M records. It was particularly noteworthy as the passwords were in plain text: en.wikipedia.org/wiki/RockYou
Following this breach, the "RockYou password list" became almost the defacto standard list for password crackers. It's one of many breaches that seeded the data in @haveibeenpwned's Pwned Passwords list.
Read 9 tweets
Troy Hunt Profile picture
May 25
A thread on this because the more I looked into it, the more I wanted to say about it:
Firstly, this has come after @zackwhittaker's article which boils down to "it's stalkerware and it has appeared in a bunch of hotels it maybe shouldn't have and we know this because it has vulns disclosing what's captured and the company isn't responding" techcrunch.com/2024/05/22/spy…
It appears that in response to that piece, someone has gone and found a very easily exploitable bug that boiled down to a SOAP based API with an associated WSDL that documented the endpoints, one of which returned valid AWS creds Image
Read 18 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(