The data circulating online included the e-mail addresses and hashed passwords for 7 million Lifeboat accounts. The mass compromise was discovered by Troy Hunt, the security researcher behind the Have I been pwned? breach notification site. Hunt said he had acquired the data from someone actively involved in trading hacked login credentials who has provided similar data in the past.

Hunt reported that some of the plaintext passwords users had chosen were so weak that he was able to discover them simply by posting the corresponding MD5 hash into Google. As if many users’ approach to password selection weren’t lackadaisical enough, Lifeboat’s own Getting started guide recommended “short, but difficult to guess passwords” because “This is not online banking.”

Crude but effective

Short passwords are especially prone to cracking by brute force, a technique that tries all possible combinations of numbers, letters, and special characters until the specific one protecting a compromised account is tried. By counseling users to choose short passwords, Lifeboat operators made this crude cracking approach feasible. After all, a six-character password that uses letters and numbers has just 626 possible combinations. An 11-character password with letters and numbers has 6211 combinations, making it out of reach by brute-force methods.
The advice is compounded by the reliance on unsalted MD5 hashes to obscure the password plaintext. MD5 was designed to be extremely fast and require minimal computation. In years past, those were good attributes that gave a performance boost to inexpensive hardware. But as computers have grown increasingly powerful, the same qualities make MD5 a liability. The fact that the hashes were unsalted—meaning the plaintext passwords weren’t combined with a value that was unique for each account—makes the cracking process go much quicker and require less computation. Because salting ensures that each stored hash is unique even if two users choose the same passcode, each hash in a compromised table must be cracked separately, even if they mask one or more identical plaintext passwords.

Lifeboat officials told Motherboard that MD5 is no longer being used. They also said they implemented a password reset but didn’t disclose the breach because they didn’t want to notify the attackers there would be a limited shelf life to the hashes. Some Lifeboat users have disputed the claim there was a password reset. What’s known for sure is that the practices exposed in the breach are a text-book example of how not to store password data at rest.

Source:  Arstechnica

In this tutorial, I will show you how to set up a Minecraft 1.9 Server on Linux (Ubuntu 14.04). Personally I installed Minecraft on a EC2 server on Amazon with only 1GB of ram and it runs just fine.

Here are some requirements before we get started:

• A machine running Ubuntu Server 14.04
• A machine with 1GB of RAM, but I would recommend 2GB or more

* Note – the rest of the tutorial assumes you have already installed Ubuntu Server 14.04, and you are able to login with a user that has root privileges.

Installing the Minecraft Server Requirements

First run this command to get a list of updates

sudo apt-get update

Then run this command to actually update the server

sudo apt-get upgrade

Once updates are complete, check to see if Java is installed on our server:

java -version

If no Java version gets displayed, you will need to install it before preceding:

sudo apt-get install default-jdk

Next, we will install an application called Screen. Screen allows us to use multiple terminal sessions in a single window. For example, you may have multiple tasks running on your server simultaneously. Screen allows you to switch between sessions, without having to close one, all within the same window.

sudo apt-get install screen

Install the Minecraft Server

Next, we will install the Minecraft Server onto our Ubuntu Server.

First, create a directory anywhere on your server that you want to store the Minecraft files. Be sure to switch into that directory after it is created.

mkdir minecraft 
cd minecraft

Now, within our newly created minecraft directory, download the Minecraft Server:

wget -O minecraft_server.jar https://s3-us-west-2.amazonaws.com/g3kxyz/minecraft_server.1.9.jar

Using Screen, create a new session for our Minecraft server:

screen -S "Minecraft"

Next we will create a short script that will launch our Minecraft server. To create in Nano, do the following:

sudo nano minecraft.sh

Once the editor is open, put this line into the script. Once done, save the file, and close Nano.

sudo java -Xmx1024M -Xms1024M -jar minecraft_server.jar nogui

Launching Minecraft Server

Finally, to run the server you simply execute the script you previously made

sudo ./minecraft.sh

With any luck the server will launch successfully. If it is running you should see the words “Done” at the bottom of your terminal output

If you do a dir of the minecraft directory then you will notice that a ‘server.properties’ file got generated too. Feel free to open it up with nano and adjust settings as needed. You may also want to open up port 25565 through port forwarding on your firewall to the outside world if you want others to connect to your server.

Additional tips

To leave your “minecraft” screen do the following:

ctrl-a d

You can reattach the screen with the following:

screen -R

To get a list of current screen sessions type:

screen -ls

Change your server settings

Make sure you are in the folder “minecraft” by typing:

cd minecraft

and then type

sudo nano server.properties