360 million newly stolen credentials on black market | Hacker News Reader

360 million newly stolen credentials on black market

reuters.com

70 pointsVarcht39 comments

He said he believes the credentials were stolen in breaches that have yet to be publicly reported.

This really bugs me. It seems like many companies are either completely unaware that a breach has occurred, or know about it and are taking their time notifying customers (for PR or other purposes). Either way, customers are not getting this information in a timely manner, and that needs to change.

I worked for a pretty major webhosting firm in the past that had multiple breaches that resulted in all customer identification data being stolen. It was never announced to the public in any way and even kept from most employees. I imagine many unscrupulous business owners do not report breaches for fear of bad PR.

Almost by definition, if you're dumb enough to leave a hole in your security, you're not dumb enough to realize when it's been broken. There are exceptions, but unless you've been harmed by the action, it's hard to find someone if you don't even know where to look.

> if you're dumb enough to leave a hole in your security

This is grossly underestimating how hard it is to have a bullet-proof system. Some of the best security people in this planet use disconnected systems when they want to be sure it is safe.

Fair enough. Is it more accurate to say, "If you don't know where the hole in your security is, it's hard to know if it's been compromised."?

The "cybersecurity" firm says they are unsure what they can be used to access, but that the usernames are email addresses. If they just look for emails with an appended plus sign they can probably find out what service the account is from. For example, john.doe+cloudservice@gmail.com [1]

Anyone have a copy of the dump?

[1] http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-m...

lots of websites do not consider the '+' character to be invalid for an email (I do not have an example in my mind at the moment). Annoying as hell.

Almost all websites allow it. The ones that don't are generally fairly restrictive and probably just check is_alnum(). I use it all the time to segregate incoming mail. I have 1Password and generate a random long password for each account, so I'm not particularly concerned if one or multiple accounts are breached. This means I have to trust 1Password of course, but I'll risk it.

The problem for me is inconsistent support. For example, when validation allows it, but the server-side strips the +. I recently booked a flight with Monarch (UK super budget), email address:

example+monarch@gmail.com

This got stripped to examplemonarch@gmail.com which I'm sure doesn't exist for my name. I couldn't change the email because.. surprise.. you need a confirmation email to do it. Fortunately you only need the booking reference and the address to check in, but it was a bit annoying.

Then there's always cloudservice@mydomain.com

I think that there are a lot fewer people using that feature than you'd assume. Even lots of developer coworkers don't know about that ability, even fewer use it. So I can't imagine there are a lot of non-techie people out there doing john+adobe@gmail.com.

Not many, but in 360,000,000 there are probably a few.

I thought that too, but did you take a look at the last big dump that went public? I think it was the Target one. There were tons of that type of email used. I'm not sure about the percentage, certainly less than ten percent, but when you're talking such sheer volume that does not really matter very much.

In addition to the 360 million credentials, the criminals are selling some 1.25 billion email addresses, which would be of interest to spammers

I used Google Apps for my personal email, and I'm pretty happy with the spam protection. (Although I don't check my spam folder for false positives, so who knows?)

Anyway, can anyone who has switched from Gapps/Gmail to their own installation of SpamAssassin comment on how that worked out for them, and how much time they spend maintaining their setup?

> Although I don't check my spam folder for false positives, so who knows?

I've started doing this occasionally, and while false positives are rare, they do happen and are sometimes pretty important! It's useful that it tells you why mail is in the folder, though sometimes the explanations are more informative than others. One funny one was that it trashed a mail because it contained Danish text, a language it says I don't correspond in. I do indeed not correspond in Danish, but I do live in Denmark, so getting Danish email isn't so surprising, and usually is actually important (e.g. from the tax authority). That one was interesting in that it seems to indicate they don't tune the spam filter using all the personal profile data they have (Gmail certainly knows I log in from a Danish IP).

Email from Google recruiters went to my gmail spam. I had to whitelist @google.com, which I thought was pretty silly.

I know it's a popular domain to spoof, but you'd think that at least with @google.com they could do a quick validation step!

> That one was interesting in that it seems to indicate they don't tune the spam filter using all the personal profile data they have

Yeah, this is infuriating. I had gmail silently spam-filter an email on the grounds that it came from an @qq.com address (QQ is a large chinese social network). While I had never corresponded with that particular QQ address, I had correspondence from several other QQ addresses in my inbox. Also in my inbox: correspondence with an @foxmail.com address displaying the same sender name as the mail that was supposedly spam. I don't see how it could have been more clear, contextually, that I wanted to receive that mail.

You'll inevitably have a higher failure rate running your own as I do. Gmail has millions of people contributing to its statistical analysis. You'll have yourself and maybe some friends and family, at best, training the bayesian filter, and periodic updates of static rules from the project's volunteers.

A combination of SA and Spamhaus's zen and dbl blocklists catches the vast majority of spam coming into my server, but I still usually end up with at least a few per day on average.

I can go weeks without looking at the server at all. But when something does go wrong it can take some time. Right now I'm trying to figure out why SA has started silently dropping certain messages to certain addresses after it figures out they're not spam, rather than piping them back into Postfix as it should. This is obviously not good.

I went in the other direction.

The average amount of maintenance time is very low, but the distribution is not even - if it breaks, Murphy's Law guarantees it will be at the least convenient time. Like when you're on holiday or expecting an important email.

I just use 33mail.com and my shared-address-spam is at zero.

It's sensible to assume that everything you ever put into the cloud can be leaked at any moment. So act accordingly.

I'd like Hold Sec. to release a way to at least check if any of your details are present in the trove they have, even if they don't know where the source of the leak was.

A web form purporting to do that would be a great way to harvest email addresses.

You could even add the ability to verify that a given email/password combo does not appear in the list :)

They could collect bcrypt hashes to verify instead of raw emails.

it's likely that if the dump becomes available Troy Hunt will add it to his existing tool to test if you've been caught in one of the large hacks to date. Links below.

http://www.troyhunt.com/ https://haveibeenpwned.com/

The post on the Hold Security site has a very different tone than the Reuters piece. It reads more like a sales pitch than anything.

http://www.holdsecurity.com/#!news2013/c13i1

Is it just me who believes if you are online then your privacy is breached already ? For e.g.: How can we trust Gmail or Facebook with our data either , where ads are displayed based on search done and cookie tracking . Even on smart phones , who knows if they have voice samples for individuals based on Google search , sometimes I think they know more about me than myself. And single breach while accessing such services can cost us . I am over such stories of accounts hacked and security breach.

Just because Google has your data (because you created an account with them) does not mean that you should be okay with every spammer and script kiddie having it.

Privacy being breached, is not a binary choice.

Deleted comment

These are usernames and passwords but your sentiment is correct. Something needs to be fixed there too. First thing is for us to develop good password habits and stop using the same one on several sites.

It would also help if sites didn't store unencrypted passwords and didn't send passwords in email. The article says a lot of the records included unencrypted passwords; why do they exist in that form?

This. I have requested to redhat mailing list several times to STOP sending mailman account reminder with my password in plaintext. And they still do and no one listens. I give up on it and unsubscribe immediately. Away from any redhat mailing list from that point.

"redhat.com mailing list memberships reminder"

It's bullshit when people send my password in plaintext to my email account and they ignore my complains when they said "if you have questions send to this owner emaiil." Bullshit. Why do they need to remind me about my password in the first place?

From what I can tell mailman stores thing in plaintext. I personally don't see why anyone can't write 20 lines of code to do a crypt with sha256/sha512 (crypt$5, crypt$6). It's almost idiotic.

https://www.owasp.org/index.php/About_Mailman_at_OWASP

This is getting somewhat off-topic, but Mailman warns you during the sign-up process that this password will be sent in cleartext, so do not use a valuable password. In fact, if you leave the password field blank mailman will kindly generate a random password and send you that. If your subscription status on a mailing list is valuable enough to care about compromise, then I recommend you not use an email list at all.

The number of imbeciles annoying the clueful population with misplaced unsubscribe requests and similar noise would be even higher without the reminder and included password.

It's quite clear at this stage having technological solutions to password authentication simply isn't enough. We need to make it a criminally prosecutable offence for services of a certain size not to use them. The company that produced that 105 million record database, regardless of whether this turns out to be infiltration by an outsider or an inside job, should be sued for gross negligence.

Why can't we do this when the EU can pass useless cookie directives?

How do you enforce this and in which situations? I have a hunch that the actual legal technicalities aren't trivial.

> After recent payment-card data breaches, including one at U.S. retailer Target, credit card companies stressed that consumers bear little risk because they are refunded rapidly for fraud losses.

This is not exactly the case -- the amount needed to pay the fraud detection services will surely be passed on to the credit card users in the form of higher APRs.

These days I'm wondering how to go about changing my Internet to a new, secure one, where there are no financial predators.

Does anyone know how much each credential would worth on average? I also imagine they will filter out "possible celebrity" credentials for higher bids/price.

Not to worry, I am sure they will be purchased with stolen bitcoins :-P

Reply on news.ycombinator.com