Hacker News Reader

Comment by gautamsomani | Hacker News Reader

Noob question - What websites are these where such data is published? I never came across any?

Why are all the other replies so mysterious and LARPy?

https://discord.io/ has been replaced with a termination notice, and they directly mention where the credentials are being sold. Google the name, it's the top result.

Leaked credentials are sold on the open internet, on sites indexed by search engines. This isn't some quadruple proxy Anonymous hacker TOR exclusive club.

Edit: One better - any time you hear Microsoft, or Google, or Crebs, talking about some new "advanced" "Russian" "APT", 9 times out of 10 it's a kid posting on one of these forums, reselling stale credentials, or a fork of Mirai, or some other totally non-credible threat.

This stuff is WAY less cool than people make it seem.

Because the LARPing is why most security professionals do the job.

Various darknet fora. Certainly nowhere on clearnet. There are search engines that deal with such things though I'll bet there's a 99:1 ratio of scam to legit. I have no idea how someone world go about validating what they saw.

In this case, they validated it by:

1. confirming the emails were not already listed in other databases / leaks;

2. going to the actual Discord platform and performing a "Forgot Password" request, entering a stolen email, and seeing if it goes through or not, as Discord confirms if an email exists or not during this flow;

3. contacting Discord.io directly, who confirmed & put out a statement.

Other data breaches are harder to verify. Troy Hunt (owner of haveibeenpwned.com) described this in far more interesting ways than I ever could[0], but for each breach, it varies.

[0]: https://www.troyhunt.com/heres-how-i-verify-data-breaches/

Until recently, every time a story was run about a leak being "for sale on the dark web", you could visit raid forums or breach forums, both clearnet sites, and note that's where it's for sale.

Validation is likely tied to reputation - such as by showing a sample to an established moderator / community member and them vouching that the data seems real.

I have a directory of most of them, I would not post it under my real identity obviously, but if you happen to be into the cybersec space, definitely you came across some of these sites, there are even sites with latest APT discovered up to this month too.

Reply on news.ycombinator.com