KrebsOnSecurity examines a security flaw discovered on pwnedlist.com exposing the credentials of all 866 million accounts gathered by the website. Pwnedlist.com is a website designed to help companies detect security problems for their users by tracking password breaches. Bob Hodges, a security researcher, found the vulnerability when he tried adding certain domains to his watchlist. Even though he was the administrator, pwnedlist.com did not ask him to verify he had control of the domains. Hodges found he could monitor any email address he wanted. KrebsOnSecurity’s Brian Krebs replicated Hodges’ findings, adding Apple.com to his watchlist. He was given more than 100,000 results ending in Apple.com. “I could now effectively request a report including all 866 million account credentials recorded by the Pwnedlist,” Krebs wrote. Pwnedlist has since fixed the issue.
Full Story