Cannabis growing community site exposes 3.4 million user records and passwords

guest · Nov 3, 2020

Cannabis growing community site exposes 3.4 million user records and passwords
Passwords, posts, and other data about 1.4 million users exposed without any protection
November 3, 2020
https://www.linkedin.com/pulse/cannabis-growing-community-site-exposes-34-million-user-diachenko/

GrowDiaries, a community website where cannabis growers can journal and share updates about their plants, has exposed more than 3.4 million user records on the web without a password.

I discovered the unprotected database on October 10, 2020. It consisted of about 1.4 million records with email addresses and IP addresses, plus 2 million records containing user posts and hashed account passwords. The passwords were hashed using MD5, a deprecated algorithm that an attacker could easily crack to access passwords in plain-text.

GrowDiaries acknowledged the incident but did not respond to my request for comment as of time of writing.
Click to expand...

US-based GrowDiaries lets users track their cannabis growing progress and share updates with fellow users. Users can compare their grow to other users and previous cycles, get advice from fellow cultivators, and win prizes. A diary can include photos, text, and a variety of factors that go into cannabis cultivation. Typically, users post updates about their plants about once per week.

Although we aren’t certain how many users GrowDiaries has, it seems likely that all users were affected by this data incident. The GrowDiaries website claims that starting a diary is “100% anonymous and secure,” but this incident certainly suggests otherwise.
Click to expand...

Log in or Sign up

Cannabis growing community site exposes 3.4 million user records and passwords

guest Guest

Log in or Sign up

Cannabis growing community site exposes 3.4 million user records and passwords

guest Guest

Useful Searches