Mozilla råkade lägga ut 44000 användarkonton

Mozilla meddelade häromdagen att man råkat lämna 44.000 inaktiva konton på en publik server, men att det inte ska vara någon fara.

On December 17th, Mozilla was notified by a security researcher that a partial database of addons.mozilla.org user accounts was mistakenly left on a Mozilla public server. The security researcher reported the issue to us via our web bounty program. We were able to account for every download of the database. This issue posed minimal risk to users, however as a precaution we felt we should disclose this issue to people affected and err on the side of disclosure.

The database included 44,000 inactive accounts using older, md5-based password hashes. We erased all the md5-passwords, rendering the accounts disabled. All current addons.mozilla.org accounts use a more secure SHA-512 password hash with per-user salts. SHA-512 and per user salts has been the standard storage method of password hashes for all active users since April 9th, 2009.

It is important to note that current addons.mozilla.org users and accounts are not at risk. Additionally, this incident did not impact any of MozillaÃ¢â‚¬â„¢s infrastructure. This information was also sent to impacted users by email on December 27th.

Chris Lyon
Director of Infrastructure Security

Det är inte första gången som information hamnar på villovägar på grund av serverbyten, se bara på polisen i Colorado som råkade lämna en databas öppen med bland annat informatörer gällande droghandel. Den här gången är det inte lika allvarligt, men trenden med data som hamnar på villovägar känns ändå lite alarmerande, speciellt som allt mer data om oss ligger i databaser som vi inte har någon kontroll över.

Sign In

Mozilla råkade lägga ut 44000 användarkonton

Discuss the Guide

Recommended Comments

Please sign in to comment

My Swedish Blog

Categories

Most Contributions

About Me