cyber-crime

YouHack thought protecting members' passwords with mostly unsalted MD5 hashes would do

A 2013 breach of Russian-language cybercrime forum YouHack exposed its members' login details – and millions of credentials they had posted about other victims, according to newly cataloged data.

Have I Been Pwned (HIBP) added the breach on Wednesday, recording 7.2 million unique email addresses. Around 107,000 belonged to forum members, whose exposed data included usernames, IP addresses, and mostly unsalted MD5 password hashes.

Unsalted MD5 is a poor choice for protecting passwords. It's fast to compute, allowing attackers to test guesses at speed, and identical passwords produce identical hashes. Hardly good hygiene for a hacking forum.

You might expect members of a cybercrime forum to know better than to reuse passwords or register with an email address tied to their real identity.…