Norwegian IT website Dagens IT first reported the breach, noting that a file containing 6.5 million encrypted passwords had been released. The file only contains passwords hashed using the SHA-1 algorithm and does not include user names or any other data. However, the breach is so serious that security professionals advise people to change their LinkedIn passwords immediately.
A Director at LinkedIn, confirmed the hack on the company’s blog Wednesday afternoon and outlined steps that LinkedIn is taking to deal with the situation. He wrote that those with compromised passwords will notice that their LinkedIn account password is no longer valid.
An SHA-1 hash is an algorithm that converts your password into a unique set of numbers and letters. If your password is “LinkedIn1234,” for example, the SHA-1 hex output should always be “abf26a4849e5d97882fcdce5757ae6028281192a.” As you can see that is problematic since if you know the password is hashed with SHA-1, you can quickly uncover some of the more basic passwords that people commonly use.
If you want to see if your password was among those leaked you’d need the SHA1 hash of the password itself. Here is how to check the SHA1 digest of any text string, in this example we’ll use a password. Launch a terminal and enter the following command:
- echo -n “yourpassword” | openssl sha1
The output will look something like this:
- (stdin)= b48cf0140bea12734db05ebcdb012f1d265bed84
That is the sha1 checksum of “yourpassword”, obviously change “yourpassword” to your actual password to see its hash.
You could use that output to compare it against a list of leaked passwords in the recent LinkedIn example, but ultimately this can be used to verify any sha1 checksum:
- grep b48cf0140bea12734db05ebcdb012f1d265bed84 combo_not.txt
You’ll have to download the password file from one of the many mirrors. At 118 MB it’s a big download.
… or …