Thursday, August 7, 2014

Russia hackers loot more than a billion passwords - and how hackers make money off this activity .....

http://www.aljazeera.com/news/europe/2014/08/russian-hackers-stole-12-billion-passwords-20148752422349560.html

Russian hackers 'stole 1.2 billion passwords'

US security firm says Russian group stole more than a billion internet usernames and passwords over several years.

Last updated: 07 Aug 2014 07:22
Email Article
 
Print Article
 
Share article
 
Send Feedback
The hackers had been collecting databases of personal information for years [Reuters]
A US security firm says Russian hackers have stolen 1.2 billion usernames and passwords in a series of internet heists affecting 420,000 websites.
According to Hold Security, the firm that uncovered the breach, the hackers had been collecting databases of personal information for years.
Alex Holden, Chief Information Security Officer at Hold Security, said on Wednesday that in April the group began deploying a new online attack technique that quickly shot from computer system to computer system as unwitting infected users visited random websites.
"Their data caches seemed to grow from April on at a rather alarming scale, getting them to what it is or what it was at the time," he said.
A native of Kiev who now lives in Milwaukee, Holden has conducted research that contributed to other exposures of major hacks, including a breach at Adobe that exposed tens of millions of customer records.
Tracked 'for months'
He said he had been tracking the Russian criminals for seven months, but only was able to begin reviewing their massive cache of databases during the past few weeks.
Holden timed his announcement to coincide with the annual Black Hat USA cybersecurity conference this week in Las Vegas, where it created quite a buzz.
Brian Krebs, who investigates online cybercrime and blogs about it, said his phone and email were inundated while he was at the conference on Wednesday with people asking about Holden's announcement.
"Alex isn't keen on disclosing his methods, but I have seen his research and data first hand and can say it's definitely for real," said Krebs.
"Without spilling his secrets or methods, it is clear that he has a first-hand view on the day-to-day activities of some very active organised cybercrime networks and actors."
Holden's discovery was revealed in the New York Times on Tuesday.
The identities of the websites that were broken into were not identified by the Times, which cited nondisclosure agreements that required Hold Security to keep some information confidential.
The reported break-ins are the latest incidents to raise doubts about the security measures that both big and small companies use to protect people's information online.
Security experts believe hackers will continue breaking into computer networks unless companies become more vigilant.





http://krebsonsecurity.com/2014/08/qa-on-the-reported-theft-of-1-2b-email-accounts/


Q&A on the Reported Theft of 1.2B Email Accounts

facebooktwittergoogle_plusredditpinterestlinkedinmail
My phone and email have been flooded with questions and interview requests from various media outlets since security consultancy Hold Security dropped the news that a Russian gang has stolen more than a billion email account credentials. Rather than respond to each of these requests in turn, allow me to add a bit of perspective here in the most direct way possible: The Q&A.
Q: Who the heck is Alex Holden?
A: I’ve known Hold Security’s Founder Alex Holden for nearly seven years. Coincidentally, I initially met him in Las Vegas at the Black Hat security convention (where I am now). Alex is a talented and tireless researcher, as well as a forthright and honest guy. He is originally from Ukraine, and speaks/reads Russian and Ukrainian fluently. His research has been central toseveral of my big scoops over the past year, including the breach at Adobe that exposed tens of millions of customer records.
Q: Is this for real?
A: Alex isn’t keen on disclosing his methods, but I have seen his research and data firsthand and can say it’s definitely for real. Without spilling his secrets or methods, it is clear that he has a first-hand view on the day-to-day activities of some very active organized cybercrime networks and actors.
Q: Ok, but more than a billion credentials? That seems like a lot.
A: For those unfamiliar with the operations of large-scale organized crime syndicates, yes, it does. Unfortunately, there are more than a few successful cybercrooks who are quite good at what they do, and do it full-time. These actors — mostly spammers and malware purveyors (usually both) — focus on acquiring as many email addresses and account credentials as they can. Their favorite methods of gathering this information include SQL injection (exploiting weaknesses in Web sites that can be used to force the site to cough up user data) and abusing stolen credentials to steal even more credentials from victim organizations.
One micro example of this: Last year, I wrote about a botnet that enslaved thousands of hacked computers which disguised itself as a legitimate add-on for Mozilla Firefox and forced infected PCs to scour Web sites for SQL vulnerabilities.
Q: What would a crime network even do with a billion credentials?
A: Spam, spam and….oh, spam. Junk email is primarily sent in bulk using large botnets — collections of hacked PCs. A core component of the malware that powers these crime machines is the theft of passwords that users store on their computers and the interception of credentials submitted by victims in the process of browsing the Web. It is quite common for major spammers to rely on lists of billions of email addresses for distributing their malware and whatever junk products they are getting paid to promote.
Another major method of spamming (called “Webspam”) involves the use of stolen email account credentials — such as Gmail, Yahoo and Outlook — to send spam from victim accounts, particularly to all of the addresses in the contacts list of the compromised accounts.
Spam is such a core and fundamental component of any large-scale cybercrime operation that I spent the last four years writing an entire book about it, describing how these networks are created, the crooks that run them, and the cybercrime kingpins who make it worth their while. More information about this book and ways to pre-order it before its release in November is available here.
Q: Should I be concerned about this? 
A: That depends. If you are the type of person who re-uses passwords at multiple sites — including email accounts — then the answer is yes. If you re-use your email password at another site and that other site gets hacked, there is an excellent chance that cyber crooks are plundering your inbox and using it to spam your friends and family to spread malware and to perpetuate the cybercrime food chain.

****


http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/

Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)