Hacker News Reader

Comment by qq66 | Hacker News Reader

What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.

View on HN

Simple, for every user that the hackers have, try their password for the associated email account, guaranteed they will gain access to many email accounts. Now they have access to their banking accounts.

This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam. Have their been any large scale attacks to gain access to bank accounts to then clean them out somehow?

On top of that, how does getting access to someone's bank account even help you? You have to transfer the money to another account, which leaves a trail...

Robbing a convenience store at gunpoint or illegally downloading torrents usually also "leave a trail." That doesn't mean nobody is willing to do it, and I definitely wouldn't feel safe if random people had access to my bank account just because if they did anything law enforcement might be able to catch them.

I'm sorry please be clear: is your response to "this is a well-known security problem with easy-to-implement best practices to lower chances of incident" really "I've never heard of an attack using this"?

Yes. One of our clients had their ETrade account compromised after a Yahoo password leak. (We had helped them change passwords on all their other services and recover the data deleted from their Yahoo account, but they forgot they had an ETrade account.)

In that case, E*Trade detected the activity as fraudulent, so the damage was minimal.

> This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam.

The more password databases are hacked, the better password cracking becomes, and the more sites black hats get access to. It's a vicious cycle. Yes, people sometimes do get large amounts withdrawn from bank accounts.

This. For more information on why this is the case, here's a pretty good article on it.

http://arstechnica.com/security/2012/08/passwords-under-assa...

The simplified version: Every time a password is cracked it is added to a database of hashes used to hack other databases. Essentially crowdsourced cracking.

That only works on broken sites that don't salt.

If I was to try to break salted passwords, my first inclination would be to find the largest set of known passwords and try those before resolving to a pure brute-force approach. Thus if you password "ILikePuppies" is ever exposed as a password, then I would consider it insecure.

Not as rare as you might believe.

http://www.theregister.co.uk/2012/06/07/linkedin_admits_data...

People typically use variants of the same password across the web. It's a huge starting place for breaking into an email account.

Also, since it's vanilla http, you could sniff these passwords at a coffee shop's wifi all day and just wait for someone to log in to Pandora.

Many users reuse passwords across their web presence.

So there's the chance of gaining access to other accounts as a result of the data leak... such as their bank accounts, etc.

Reply on news.ycombinator.com