Pattern Recognition

If you're infosec-savvy, this post will make you curse and mutter under your breath, because it is filled with oversimplifications. These are deliberate, because this post is not for you; you don't need it. :P This post is intended for people who have a vague, passing, or very casual acquaintance with keeping your digital shit secure.

As many of you are probably aware, sarahtales's LiveJournal was broken into early this morning. Whether it was someone with a grudge or one of the Russian poetry crackers who also got shoebox_project is *generally* irrelevant. The SBP crack exploited a hole in LJ's security -- if there had ever been a Hotmail account associated with your LJ, it was once possible to get the journal password sent to that account (or any other previous e-mail account) and reassign ownership of the journal to it. LJ now allows users to remove any and all e-mail addresses used in the past, including the one used to create the journal (this wasn't possible before the attacks, of which SBP was but one victim).

The security hole was actually caused by Hotmail's ridiculous practice of allowing "dead" usernames to be recycled. So if you let your harrypotter@hotmail.com account lapse at any point, someone could later come along and claim the same account for themselves. So if you used harrypotter@hotmail.com to register for any sites, they would be able to retrieve your login information from those sites using your old hotmail address. Whoever hijacked sarahtales's journal did this differently; they first broke into her gmail account and then simply had LJ reset her password. As all the password-reset communication goes to the currently active e-mail account, anyone monitoring the account will have access.

So here are some (okay, many >.>) words about protecting yourself from such attacks and similar ones. The first thing you need to understand is that no one is ever 100% safe. The only way you can be sure that your computer is safe from attack is not to own a computer. But there are ways you can significantly reduce the chances of someone gaining unauthorised access to your data. This is far from an exhaustive treatise on those ways; the field of computer security is too sprawling and my knowledge is too limited, so I've tried to focus on the lowest common denominators.

( continue reading for a lot of (hopefully at least somewhat accessible) mumbo-jumbo )

The heavily armed monkeys guarding the servers currently report no site-wide problems.

Nice to see you're keeping the light on, LJ. :|