Another day and another data breach have been reported. A hacker has alleged that he has breached the website of famous second-hand book dealer Bookchor.com and downloaded information of 5,33,275 users. As per the post on a hacking forum, the threat actor breached the website in February but made the data available online on March 26.
What is Bookchor?
Bookchor is a platform to buy, sell or share old books and textbooks. The portal, managed under BookChor Literary Solutions Pvt. Ltd was founded by four friends Alok Raj Sharma, Bhavesh Sharma, Prateek Maheshwari, and Vidyut Sharma, in 2015. It allows users to buy old books and textbooks at an affordable price and lets sellers list their old books.
Details about the leaked data
In the post, the hacker wrote that he took the data dump on February 18, 2021. Though he had counted 5,05,373 unique email IDs, the total number of customers in the CSV file was 5,33,275. In the data, he had included IP Addresses, Hashed Passwords, Full names, Phone Numbers, Physical Addresses, Orders, Email addresses, and what type of phone they use (If they were using a phone).
Hacker claimed Bookchor uses unsalted MD5 encryption
In his post, the hacker claimed that Bookchor had used unsalted MD5 hash to encrypt the passwords. MD5 hashing seems reasonable at first look, but it is not recommended to encrypt sensitive information such as passwords as it is quite easy to crack. There are tools available on the internet that can decrypt unsalted MD5 hash within seconds. The passwords are reportedly available for those accounts that did not use social media authentication to create the account on Bookchor.
OpIndia reached out to Bookchor
We got the contact information of one of the founders, Vidyut Sharma. On calling him, Sharma said that he was busy with some work and will get back over the phone soon. We will update the report with his comment when he reverts to us.
What can Bookchor users do?
As a Bookchor user, there is nothing much you can do about the leak other than questioning the company about the data breach. As it seems the data contains contact information and possibly the password of the users, it is better to change your password. If the password you have used on Bookchor was the same as your email ID or any other important account, make sure to change the password there too.
As more details come in, we will update the story.
