Largest data breach ever. Hackers steal over 1 billion username/passwords.

[Outlaw]

Time to change all our damn passwords AGAIN!!

A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.

The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.

Hold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable. At the request of The New York Times, a security expert not affiliated with Hold Security analyzed the database of stolen credentials and confirmed it was authentic. Another computer crime expert who had reviewed the data, but was not allowed to discuss it publicly, said some big companies were aware that their records were among the stolen information.

“Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Alex Holden, the founder and chief information security officer of Hold Security. “And most of these sites are still vulnerable.”

Mr. Holden, who is paid to consult on the security of corporate websites, decided to make details of the attack public this week to coincide with discussions at an industry conference and to let the many small sites he will not be able to contact know that they should look into the problem.

There is worry among some in the security community that keeping personal information out of the hands of thieves is increasingly a losing battle. In December, 40 million credit card numbers and 70 million addresses, phone numbers and additional pieces of personal information were stolen from the retail giant Target by hackers in Eastern Europe.

And in October, federal prosecutors said an identity theft service in Vietnam managed to obtain as many as 200 million personal records, including Social Security numbers, credit card data and bank account information from Court Ventures, a company now owned by the data brokerage firm Experian.

But the discovery by Hold Security dwarfs those incidents, and the size of the latest discovery has prompted security experts to call for improved identity protection on the web.

“Companies that rely on user names and passwords have to develop a sense of urgency about changing this,” said Avivah Litan, a security analyst at the research firm Gartner. “Until they do, criminals will just keep stockpiling people’s credentials.”

Websites inside Russia had been hacked, too, and Mr. Holden said he saw no connection between the hackers and the Russian government. He said he planned to alert law enforcement after making the research public, though the Russian government has not historically pursued accused hackers.

So far, the criminals have not sold many of the records online. Instead, they appear to be using the stolen information to send spam on social networks like Twitter at the behest of other groups, collecting fees for their work.

But selling more of the records on the black market would be lucrative.

While a credit card can be easily canceled, personal credentials like an email address, Social Security number or password can be used for identity theft. Because people tend to use the same passwords for different sites, criminals test stolen credentials on websites where valuable information can be gleaned, like those of banks and brokerage firms.

Like other computer security consulting firms, Hold Security has contacts in the criminal hacking community and has been monitoring and even communicating with this particular group for some time.

http://www.nytimes.com/2014/08/06/te...ials.html?_r=1

[BaneTheBrawler]

dammit russia

[6souls]

This is rich...

The Wall Street Journal later revealed that Hold Security intended to offer website owners the ability to check whether they had been affected, but only if they paid a fee.

The firm has since posted a message on its site saying it will charge $120 (£71) a month for a "breach notification service".

http://www.bbc.co.uk/news/technology-28654613
http://blogs.wsj.com/digits/2014/08/...b-credentials/
http://www.holdsecurity.com/services...onitoring/bns/

[6souls]

More from that BBC article;

Despite the large amount of credentials said to have been compromised, Dr Murdoch added that it would be premature to advise the public to reset all their passwords.

"Although there's a large amount of passwords involved, a lot of them could be irrelevant and many of the websites tiny," he said.

"It's not necessarily the case that a large proportion of internet users have been affected. Until we get more statistics we won't know that.

"So, there's no reason to panic now, but perhaps it's a good reminder to follow best practice of not using the same password on multiple websites, because this will not be the last time such a breach happens."

Hold Security, which has previously reported about hacks on Adobe and Target, said it took more than seven months of research to discover the extent of the latest hack.

The firm claimed the gang initially acquired databases of stolen credentials from fellow hackers on the black market.

"These databases were used to attack e-mail providers, social media, and other websites to distribute spam to victims and install malicious redirections on legitimate systems," Hold Security said.

The hackers also got access to data from botnets - a network of computers infected with malware to trigger online fraud.

Hold Security said the botnets helped the hacking group - which it dubbed CyberVor - identify more than 400,000 websites that were vulnerable to cyber attacks.

"The CyberVors used these vulnerabilities to steal data from these sites' databases," the firm said.

"To the best of our knowledge, they mostly focused on stealing credentials, eventually ending up with the largest cache of stolen personal information, totalling over 1.2 billion unique sets of e-mails and passwords."

The firm is now marketing its breach notification service as a way to "stay ahead of the hackers ".

But one of its rivals expressed surprise at this approach.

"For a long time the security industry has freely shared information on breaches within its own community," said Vanja Svajcer, principal security researcher at Sophos.

"Researchers discovering credentials breaches usually help end users either by making the information about compromised accounts public or by working with the company whose servers were compromised to inform all affected users.

"In this case, the credentials were harvested from thousands of servers and it would be difficult to work with every server owner to inform the compromised users. Nevertheless, it is reasonable to expect the company to make the information freely available so everybody can check that none of their email addresses have been compromised."

http://www.bbc.co.uk/news/technology-28654613
http://www.holdsecurity.com/news/cybervor-breach/

[Shenrien]

Damn it Wisconsin.

[myreality]

God....Damnit...Nappa...

[Meresgi]

The Wall Street Journal later revealed that Hold Security intended to offer website owners the ability to check whether they had been affected, but only if they paid a fee.

The firm has since posted a message on its site saying it will charge $120 (£71) a month for a "breach notification service".

Lol why pay $120 for this large of a breach if it's legit. If it's legit, you got pwned! If it's not, you're ok!

[Krazy]

Getting so sick of changing my passwords all the time. I've got a notebook that's almost half filled with all my password changes because I can't remember them all any more.

[Obiron]

http://www.youarenotpayingattention....len-passwords/

I don't know anything about the author, so take this with some skepticism, but it's an interesting read either way.

[ronin sparthos]

Getting so sick of changing my passwords all the time. I've got a notebook that's almost half filled with all my password changes because I can't remember them all any more.

i dunno how many more variations of the word password123 i can conjure up ~.~

[Jaffar]

I got an email from a domain @latinmarkets.org telling me that my AMEX card had been compromised & that I needed to log in to my account to reject the suspicious purchases. Too bad for them my corporate CC is no longer an amex; that & the link was a little fishy without the https.

Later in the day, someone from Latin Markets emailed us that their server had been compromised:

"Dear Colleagues,

Earlier this morning we experienced a breach to our third party email service provider account that resulted in many of you receiving a phishing email claiming to be from American Express with our email handle. American Express has confirmed that this is part of a large-scale Russian hacking, which you may have heard about earlier this week. American Express has advised our clients to forward any phishing emails to [email protected] to aide in their further investigations.

Our IT department recommends that you also delete these emails from your inbox and trash folders.

Please rest assured that under no circumstances will we ever share or sell your contact information with third parties.

I apologize for any inconvenience and encourage you to contact me directly with any questions or concerns.

Sincerely,

Name & contact redacted
Head of Marketing & Public Relations
Markets Group, US Markets/Latin Markets"

I work in the asset management side of a large insurance company & had never heard of LatinMarkets.org before, and never had my corporate email linked to any Amex card.

[Meresgi]

http://www.youarenotpayingattention....len-passwords/

I don't know anything about the author, so take this with some skepticism, but it's an interesting read either way.

I would say the author is correct in his assumption. Like he said, I would assume 1.2billion usernames/passwords would have law enforcement clamoring to figure out where they came from, unless its just a collection of known usernames/passwords from years and years of hacks (not worthless for sure, but not earth shattering) or someone just wrote a script to randomize username/passwords and let it run to fill up a database then pretended they hax'd it. Without info on WHERE/HOW they were obtained i'm skeptical as fuck.


@Jaffar

Probably your typical phishing scams as a result of news like this. Anytime there's any accident/celeb death/whatever they all get sent out.

[Bregor]

i dunno how many more variations of the word password123 i can conjure up ~.~

letmein! was such a good one. Damn you, Russia!

[Plow]

it kind of sounds like it was a bunch of keylogger results and the reporters don't understand the difference between that and a botnet brute force attack which would have to be insanely widespread to be effective

[Dimmauk]

I heard like 8 billion passwords got stolen, but we can't tell you which one. Please go to this risky site and then change your password so it can really get stolen.

Seems legit.

[Meresgi]

it kind of sounds like it was a bunch of keylogger results and the reporters don't understand the difference between that and a botnet brute force attack which would have to be insanely widespread to be effective

Most password dumps are not from brute force attacks or keyloggers.

It's SQLi and then rainbow tables.

[Buffy]

The InterWebz, how does it work?

[Plow]

Most password dumps are not from brute force attacks or keyloggers.

It's SQLi and then rainbow tables.

A widespread SQL injection attack would be pretty unlikely to be ending up with the same people's information over and over.

[Sho]

Hackers gonna hack.

[Meresgi]

A widespread SQL injection attack would be pretty unlikely to be ending up with the same people's information over and over.

You have no idea then. People don't brute force attack most things online nowadays unless you're a skid messing around, it's very easy to check for. And extremely easy to prevent. Not even talking about the fact that a 9+ character password is going to take fuck forever to crack through brute force (though obviously less and less time as we jump in tech)

Phishing and SQLi are how most of these huge dumps are found. There are a scary amount of sites still vulnerable to SQLi to dump the tables containing hashes of passwords and then run them through a rainbow table. Phishing is a great method too.

Brute forcing a server is like driving your car slowly back and forth in front of a single home on a street, waiting for the people to leave so you can rob it. They are going to notice unless they are horribly unaware and never look at logs.