Breach Disclosure: Knuddels

On September 07, 2018, Knuddels administrators made a post on their forums of an unauthorized disclosure of private user account information. Knuddels is a German chat app that has been in existence since 1999. The initial announcement said that when users log in they will be prompted for a password change. The breach was published on mega.nz and affected users all the way up to July 20, 2018. The breach contained approximately 808,000 records, including email addresses, plaintext passwords, usernames and real names.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Administrators and IT security staff continuously updated the thread as they found out more information. Users questioned Knuddels repeatedly on why their passwords were stored in plain text, and the explanation was that it was to prevent users from sharing their passwords on the platform itself. Although passwords were hashed, this “feature” was created to prevent account misuse and was an “old” feature that they never turned off. Knuddels also claimed that the mega.nz link was posted on cybercriminal forum nulled[.]to, but members of the forum were questioning the reports asking for the leak as it was not present on the website.