Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Security

Massive Russian Hack Has Researchers Scratching Their Heads 102

itwbennett writes Some security researchers on Wednesday said it's still unclear just how serious Hold Security's discovery of a massive database of stolen credentials really is. "The only way we can know if this is a big deal is if we know what the information is and where it came from," said Chester Wisniewski, a senior security advisor at Sophos. "But I can't answer that because the people who disclosed this decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at $120 per year.
This discussion has been archived. No new comments can be posted.

Massive Russian Hack Has Researchers Scratching Their Heads

Comments Filter:
  • Objection! (Score:4, Interesting)

    by alphatel ( 1450715 ) * on Thursday August 07, 2014 @08:28AM (#47622021)

    "They decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at US$120 per year.

    A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.
    In addition it seems the above quote neglected this portion of the article:

    Individual consumers can find out through its identity protection service, which Hold Security says will be free for the first 30 days.

    It's free and they still can't afford it? Sophos can't use a fraction of its 100,000 honeypot email accounts to sign up and see if it's legit?

    Much like Hold Security, Sophos has displayed nothing but news-unworthy jabber.

    • Re:Objection! (Score:5, Insightful)

      by MightyMartian ( 840721 ) on Thursday August 07, 2014 @08:31AM (#47622037) Journal

      I'm getting pretty dubious of the entire claim. Some company wants to sell its security monitoring service, declares "we've got a huge database of stolen credentials, but we're not going to let you see it without paying up first, or at least signing up for a service that will bill you after 30 days."

      I call BS.

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        I agree. I spent several years in the IT security arena before leaving for other IT pursuits. I started off as an investigator, then firewall engineer, then pen tester. Generally, most AV and security companies sell FUD to make their billions. I always tell my friends who continue to run Windows and Macs to create and use non-administrator accounts and surf the Web as a mortal user. This alone stops 90% of the crap out there, although some new stuff will install directly in the users' directory. Since Chrom

        • by Anonymous Coward

          I wouldn't go that far. It is too easy to plant evidence. All it takes is a botnet client that sticks a piece of code on a drive or E-mail account, and that's a conviction. Plus, the real perps are likely in countries with no agreements for extradition to their victim nations.

          Lets be real here. There will always be bad guys and unlike bank robbers, catching them is next to impossible. Even if we find who it is, they will be sitting in a country that will actually give them the state's blessing for thei

        • there should be a bounty on the heads of those people who author malware. If you are caught, you are executed.

          It would make more sense to get to the root of the problem, and execute authors of browsers and email clients that don't implement proper sandboxing.

        • Since Chrome can be installed w/o admin rights on most boxes, this has been problematic.

          Why is the installation of Chrome without admin rights a problem?

          Not meaning to contradict, just interested in the reasoning.

          • by Anonymous Coward

            This is an individual who just proclaimed that if you steal you should be sentenced to death. Why are you even bothering to ask for further opinions from a clear asshat?

          • Two reasons it can be a problem:

            First, malware can do a lot of harm without any sort of admin rights. All files on the account are vulnerable to whatever it might do. If you've got files in your account you can't afford to lose, and no good backups (yes, this is a disaster waiting to happen, but many people do it), you're vulnerable to ransomware. It'd be more effective if it could jump across accounts, but it doesn't need to. Or, if the machine is in some sort of trusted network, it may be able to i

        • Let's start taking a page from China and Singapore's book, shall we.

          Yes! Let's start by you offing yourself. Seriously.

          Ignorant, brainwashed asshole.

      • I'm with you on this. For individuals, the free version expires after 30 days AND they state that, because of the size of the data, it will take a while.

        My guess is a little more than 30 days.

      • We used to provide a similar service to web sites. We had many millions of compromised accounts. We didn't offer any services to consumers. The companies who were our customers knew we had a very solid reputation for providing excellent security solutions, and on forums other webmasters they know would report that our service worked well for them. That was sufficient that most customers would add that service or not based on what I recommended for their particular site. In general, on a site making over

      • Cui bono (Score:5, Interesting)

        by s.petry ( 762400 ) on Thursday August 07, 2014 @09:48AM (#47622539)

        Looking at who benefits is always a worthwhile pursuit. A company benefits, selling what appears to be FUD. US Government benefits because they have recently been blaming everything on Russia.

        What is not happening? Nobody is going to jail over computer espionage act (or any other law allegedly violated). In fact there is no criminal investigation at all mentioned. No facts available to verify the alleged "stolen credentials", and the only way to even glimpse said data is to provide your information to some company that is an unknown in the security community.

        I'll have to dig later, but I'm curious who the owner of this company is and who they are tied to. Surely a coincidence, but this comes out right after former NSA Director claims he's worth a million a month in consulting, working on over a dozen "IT Security" patents, all for his brand new private business. That may not be a rat, but sure has that "rodent" like smell to it.

        At best, this is a company trying to profit off other people's pain. No thanks, I'm not buying anything they are selling.

      • It's not even clear that anyone gets to see the list itself(short of buying out the company or aggregating data from enough individual buyers of 'monitoring services'. 30 days to evaluate the actual data and $120/year for continued access would be quite generous indeed for a collection even markedly less interesting than the hype makes it sound. $120/year for 'we'll bother to tell you if your name pops up on the scary secret list.' is less compelling in absence of a more convincing demonstration of the valu
      • What's more likely is they went to one of the many "hacker" websites where they sell this sort of stuff and baught a large chunk of nearly worthless data from old geocities websites and such.

      • by ark1 ( 873448 )
        When personal information is compromised, I feel most companies DO NOT want to know that they were hacked because then they have to notify the users + take steps, or at least make it look like they do, to be more secure and reputation takes a hit. If only the hackers have this information and abuse it without revealing where they got it, the company could not care less as this does not affect their business.
        Sure the hack may become public down the road but at least there is a chance it may never be.
    • Re:Objection! (Score:5, Informative)

      by Anonymous Coward on Thursday August 07, 2014 @08:35AM (#47622057)

      "They decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at US$120 per year.

      A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.

      Hey dimwit, it's $120 per year per site company not for disclosure of the entire data set. This is a protection racket.

      • by Anonymous Coward

        Hold Security probably orchestrated the website account credentials theft. I am always wary of security researchers and companies making these claims.

      • by Anonymous Coward

        Hey dimwit, it's $120 per year per site company not for disclosure of the entire data set. This is a protection racket.

        Ahhh! So it is government work?

    • Re:Objection! (Score:5, Insightful)

      by Andor666 ( 659649 ) <andor@pierdelaca ... G.com minus poet> on Thursday August 07, 2014 @08:40AM (#47622097) Homepage Journal

      It sounds quite fishy because they ask for a 120$ subscription, not to let you access the data, but for a service that lets you know if you are affected by it or not.

      - Here, my 120$, what's going on with this?
      - You're not affected, goodbye.
      - But, hey!
      - You're not affected, goodbye.

      • It sounds quite fishy because they ask for a 120$ subscription, not to let you access the data, but for a service that lets you know if you are affected by it or not.

        - Here, my 120$, what's going on with this?
        - You're not affected, goodbye.
        - But, hey!
        - You're not affected, goodbye.

        Then again they could just be trying to make money.

        I'm definitely in favour of open disclosure and would like to think they'd do better businesswise releasing the info and getting good PR. But if you're looking to make money off the info that is the way to do it.

        Of course it could also be a scam, if they're planning on this business strategy they should have someone respectable under an NDA to at least vouch that the information is legit.

    • If these people have knowledge of a crime, aren't they legally obligated to report it to law enforcement?

      Normally, one could claim no knowledge of a crime but in this case, they have announced that they have knowledge of crimes.

      • by thieh ( 3654731 )
        Whether the Law enforcement agencies are capable of producing evidence to link it is the wrongdoing of some particular group in the juridiction the group is operating in is entirely different.

        I would guess Russia would start protecting these guys if it pisses of the US enough for the US to charge them with something, just like Edward Snowden.
        • It does not matter where the perps are believed to be. They've claimed some of the companies are US companies, presumably with servers in the US. So it is a federal felony in the US, and yes, they should have reported it to law enforcement if they believe it is ongoing. Generally in the US that is not required. But...

          If they're profiting off of it without reporting it, they're actually accomplices and I hope they get arrested for it. And if they committed any crimes in Russia to acquire the data, it should

      • If these people have knowledge of a crime, aren't they legally obligated to report it to law enforcement?

        Normally, one could claim no knowledge of a crime but in this case, they have announced that they have knowledge of crimes.

        Depends on the laws in their HQ location, but in most civilized nations this is called extortion by Hold Security. They are most likely in the cross hairs of law enforcement as I type this. If this turns out to be a bogus or inflated claim (like it smells) they could face some serious criminal and civil charges, regardless of what country they are in.

    • A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.

      Indeed, we used to operate a similar service, and many companies were excited to sign up at just $49 / year. Often, the bad guys get the entire password database, so being alerted to that right away is valuable. I designed our system many years ago and it was somewhat expensive to operate. Crac

      • by arth1 ( 260657 )

        A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach?

        A billion dollar security firm won't sign up for a $120 per year service per site to not see the data behind the breach, but to be given an unsubstantiated statement of whether they allegedly are affected or not.

        Why would they? That would just be opening up for all kinds of protection rackets.

        • You ask "why would they" sign up for a notification service that costs $120 / year. I suppose it's like just about any other online purchase - it comes down to the reputation of the seller. Why would you buy a computer on Dell.com, when you can't see the product before you buy it? You'd make that decision based on Dell's reputation, and any previous dealings you had with the company.

          The companies who were our customers knew we had a very solid reputation for providing excellent security solutions, and on

          • Thanks ray, but you answered the wrong question, and with a data dump.

          • Right. I've bought Dell computers before, and they've been quite serviceable machines that did what was advertised. That sort of thing gives Dell a good reputation, and is why I continue to buy from their website.

            Hold Security doesn't have a reputation. The website is about a year old, and apparently was blank until quite recently. Looking at Bruce Schneier's blog [schneier.com], it looks like the only thing in its favor is Brian Krebs saying it's legit.

            The question is not "Why would I pay 'raymorris' or Dell?".

    • by mwvdlee ( 775178 )

      What guarentee does anybody have these credentials are real and actually belong to ANY site?

      They could just as well fabricate some large list of random credentials if their "disclosure" method doesn't actually require disclosing whose the data was.

      All you would be paying for is a $120 "Thanks for the money, the credentials aren't from your site" notice.

      • What guarentee does anybody have these credentials are real and actually belong to ANY site?

        They could just as well fabricate some large list of random credentials if their "disclosure" method doesn't actually require disclosing whose the data was.

        All you would be paying for is a $120 "Thanks for the money, the credentials aren't from your site" notice.

        I have a large database of real logins and passwords. They really do belong to a site. Of course, it went out of business and the user accounts were transferred to a competing service with different login system... 10 years ago. But they are real logins, from a real site.

        And YOUR login could be affected! Just send me $extortion_amount1 and I'll tell you if you're in the list. And for $extortion_amount2 I'll even tell you the name of the site.

    • Sophos may well still be blowing smoke; but my understanding of the service is that it's $120/year to know if your site is on 'the list', not $120/year for access to the list itself(which is probably something you can buy, if you write a check large enough; but the price will look distinctly different.)

      With that pricing structure it is markedly less practical for any sort of 'peer review' process to go on, or any accurate survey of "Site X was added to the database after being compromised by Y, how large
      • It strikes me that the entire purpose of their pricing structure IS to avoid peer review. They're not letting anyone in the community see the data, or even some statistically useful amount of the data to actually judge what they have.

        It's a scam, pure and simple.

        • It isn't a pricing structure logically incompatible with also telling the truth about what you are selling; but it certainly is a pricing structure that rather neatly matches the one you would use if you were exercising a little creative license in describing the magnitude of your findings. According to TFA they haven't even clarified how fresh the various accounts that make up the 1.2 billion are. That's the sort of thing that is quite valuable in estimating how useful the collection is; but also wouldn't
    • Individual consumers can find out through its identity protection service, which Hold Security says will be free for the first 30 days.

      It's free and they still can't afford it? Sophos can't use a fraction of its 100,000 honeypot email accounts to sign up and see if it's legit?.

      If I had to guess, "free" service users will have to provide a credit card and then hope that if they try to cancel that the cancellation is actually honored rather than getting into a common situation where they keep getting billed for months for a service that is almost impossible to actually cancel.

    • it sounds like the service the firm is selling is notification if your specific company has been breached [as in data from your company is in the 'hacked data']. They won't let anybody else see the hacked data directly/independently.

  • by Kardos ( 1348077 ) on Thursday August 07, 2014 @08:36AM (#47622065)

    ... and change all of your passwords today. This is the best way to devalue the 'massive database'. Then sanitize your SQL queries!

    • Assume they cracked the NSA backdoor default password and can now access everything on every computer not running a hardened operating system. In other words, everything, whether you change your passwords or not. Further, assume they have remote access via UEFI to every motherboard built in the past year.

      You might as well, that level of access has been built into modern technology, if this group hasn't figured it out, someone will. Or maybe already has.

      We live in an age where technology is insecure by desig

      • Re:Alternatively... (Score:4, Informative)

        by jones_supa ( 887896 ) on Thursday August 07, 2014 @09:19AM (#47622317)
        That is possible, but for now, never has an "universal backdoor for the government" been provably found in an OS or a firmware. NSA has probably snuck a lot of trojan hardware and software into individually targeted devices, though.
        • by Kardos ( 1348077 )

          That would be because any (competent) backdoor will be encrypted and cryptographically signed with key(s) known only to the TLA. Consider a router -- it passes all packets normally unless it finds one that is properly signed, then it extracts and executes the payload, fully opening up the device to the whims of the TLA. In lieu of someone leaking or determining the key, it would be extremely hard to identify such a backdoor.

          • by arth1 ( 260657 )

            It's basically looking for a needle in a haystack, but for a router, the haystack is a lot smaller than on a full OS.
            Any code affecting normal operation speeds would also be easier to spot - additional packet inspection can incur a noticable hit on a device that prides itself on passing packets as quickly as possible and allowing as many simultaneous connections as possible.

          • by vux984 ( 928602 )

            Consider a router

            1) It has a firmware that's pretty small, and finding something like an inspection routine that cryptographically evaluates every packet really would kind of stick out to anybody looking.

            2) Many people run all sorts of traffic logging etc, promiscuous mode in front of the router etc. Unless you theorize that all network hardware and software is in on it, the command and control traffic would be visible; and someone would have seen it by now. As in ... why is my router sending traffic to X,

        • never has an "universal backdoor for the government" been provably found in an OS or a firmware

          That's because nobody will admit to the hardware backdoors that have been found, not because none have been found. Take out the words "for the government" and it instantly stops being true.

    • by tlhIngan ( 30335 )

      ... and change all of your passwords today. This is the best way to devalue the 'massive database'. Then sanitize your SQL queries!

      Only if you're an idiot and used the same password on EVERYTHING.

      Really - what likely happened is they breached some major sites, but those sites contained little of value. I mean, if you breach the New York Times database, what do you have? Just a bunch of emails and passwords of people who probably registered to read some article and which are completely worthless to anyone on

    • by mlts ( 1038732 )

      Even better, add IP blocks, client certs, SSH RSA keys, and some type of two factor authentication.

      For example, everyone knows the default root password for iOS is "alpine"... but knowing that does not help much to develop a new jailbreak or to get access to a device from remote.

  • by Anonymous Coward

    For $799, you can get one year's service for protection from the Russian hackers plus a single-user license for Linux IP from The SCO Group.

  • Not implausible (Score:5, Informative)

    by IamTheRealMike ( 537420 ) on Thursday August 07, 2014 @08:45AM (#47622131)

    More than 1B credentials does not sound implausible to me, though it's on the high end. You may be wondering why my opinion on this is more relevant than anyone else's, so let me explain.

    Although I left the company in January, for about 7.5 years I worked at Google and for ~3 of those years I worked on security and anti-spam related matters. Starting around April 2010 we started to see absolutely enormous numbers of compromised accounts sending spam to their contacts. This was not a problem that grew slowly. It went from zero to one gang compromising on the order of 100,000 accounts per day and that happened in the space of, it seemed, a few weeks. We learned about this problem through user complaints and by watching the flow of spam mails being reported to us via the "Report spam" button. We quickly realised this wasn't a Gmail specific problem but was simultaneously impacting Hotmail and Yahoo. Further investigation revealed that although this gang was capable of compromising ~100,000 accounts per day (more than one per second) this was the result of a 10-15% success rate for more like a million attempts per day: most account/password pairs they tried did not work. The reason was they were reversing password hashes stolen from third party websites using GPUs, and it turns out that people who use the same password everywhere make up (surprisingly) only about 10-15% of the user population. People suck less at security than you might imagine.

    When this problem first started we believed that such an enormous supply of credentials must surely be some kind of freak one off, the result of compromising an unusually large site. I mean; one million credentials every fucking day was an unimaginably vast pool of stolen passwords. But as the user complaints of being hacked failed to dry up we came to accept the horrible truth - this was not some freak one off but the result of some kind of production line of passwords. Most likely a combination of automated web crawls to discover vulnerable sites, semi-automated popping of those sites, farms of GPUs reversing the passwords and the resulting packages being sold on the black market to spammers who then abused them for bypassing spam filters (mail from contacts is whitelisted by any good spam filter). We only got occasional snapshots of this market, for example we were able to find adverts on Russian blackhat forums by people advertising lists of "washed" vs "unwashed" account/password lists for hotmail, gmail etc, but mostly it was opaque.

    Anyway, long story short, we formed a team that built a full blown risk analysis system for every single login (Google has a bajillion logins per second thanks to mail clients that poll Gmail and have to log in each time) and after several years of work managed to block logins with bulk-stolen passwords so successfully that they went away. But the underlying supply of passwords is still out there, and should those defences fall the problem would come back.

    I gave a talk about this and various other webmail abuse related topics at the RIPE 64 conference in Ljubljana (video link) [ripe.net] in case anyone is interested in this. The slides [ripe.net] are also available though lots of info from the talk is missing from them.

    • You know, with such informative writing, you really shouldn't be posting on here. You brought cold, hard facts to this thread, something completely unknown to most users on here.

    • Re: (Score:2, Interesting)

      by s.petry ( 762400 )

      Good write up, but you make a false claim.

      Anyway, long story short, we formed a team that built a full blown risk analysis system for every single login (Google has a bajillion logins per second thanks to mail clients that poll Gmail and have to log in each time) and after several years of work managed to block logins with bulk-stolen passwords so successfully that they went away.

      Um, no you/they didn't. I work at an ISP, smaller than Google, and am constantly blocking various attacks. Every time one method gets blocked, we find new ones. Yes, this is for IMAP/POP over SSL just like Google (and I block numerous other attacks because we provide numerous services).

      You may have stopped many of the attacks, or even most of the attacks, but not _all_ attacks. The most difficult to block are the attacks by Governments, and you can tell they are

      • by geekoid ( 135745 )

        For less then 1000 dollars, I can get 10,000 machines to attack your site, coordinated from several places from around the globe.

        You reasoning for assuming it's a government is flawed.

      • Re:Not implausible (Score:5, Informative)

        by IamTheRealMike ( 537420 ) on Thursday August 07, 2014 @09:45AM (#47622519)

        I didn't make a false claim. You quoted me saying we stopped bulk stolen password based attacks like the ones I described, and then proceeded to argue with a statement I never made (that we stopped all attacks).

        To clarify, the attacks I'm talking about are ones where the attacker has a large list of passwords (in the order of hundreds of thousands of passwords or more) and try the password to see if it matches. If it does they log in, if it doesn't they give up and try the next one. Government sponsored attacks tend to care an awful lot about a small set of targets which is the exact opposite.

        Google was able to stop these attacks so effectively the people behind them gave up, and there was a large but not infinite number of people who were carrying out such attacks, so eventually they became no longer a real issue for the userbase. Note that our competitors (with the notable exception of Facebook) were NOT able to do this, so if a small ISP struggles to do it too, that would not be very surprising.

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          Trivial to prevent:

          a) delay 401 responses to incorrect logins for 15 seconds
          b) immediate 409 error if another thread tries to login while inside the 15 second window (see 'a' above), whether the password is correct or not.
          c) deactivate accounts after XX unsuccessful logins (pick any value of YY)
          d) make user validate themselves to unlock an account, or auto-unlock after YY minutes (pick any val

        • by s.petry ( 762400 )

          block logins with bulk-stolen passwords so successfully that they went away.

          Maybe English is not your first language, but I doubt that to be true. That statement at least implies that Google no longer suffers from brute force attacks.

          You then reinforce that same false claim in the post I'm commenting to now.

          Google was able to stop these attacks so effectively the people behind them gave up

          No, they didn't. You may have deterred a lot of them, but I'd bet a year salary that Google still experiences a measurable number of attacks every day.

          Look, I freely admit that huge leaps can be made with security. I have worked in IT Security for a quarter century. Neither

          • by Anonymous Coward

            I think you're being pedantic here.

            It is clear to me that he was referring to the specific group of actors who were compromising 100k accounts a day.

            He never said the smaller fish didn't go away.

            • by s.petry ( 762400 )

              Am I being pedantic? Perhaps a bit, but not entirely. That specific group still does not go away, they are there every day trying again from a new set of IPs (if not sooner). Google's ability to notice and react to the attacks is not the same thing as making them "go away" as GP stated.

              I have no problem with people talking about their accomplishments, hell even a bit of embellishment every now and then is fine. False claims are in a different category in my opinion.

          • by slyborg ( 524607 )

            >Maybe English is not your first language
            >I'm not trying to knock you

            Yes you are.

            >is making a false claim

            No. He made a statement that they stopped a particular class of attacks. You then incorrectly stated that the claim was that Google no longer suffered attacks (which is of course absurd) and proceeded to debunk THAT. So you are really arguing with yourself, which is kind of amusing but not very informative.

            • by s.petry ( 762400 )
              Claiming someone is incorrect is knocking them? Good job dude, glad to see that political correctness class in school did some work.
              • by Rich0 ( 548339 )

                This whole thread is basically somebody from Google saying that they did foo and attackers stopped doing bar. Then somebody else who has no affiliation with Google says that attackers didn't stop doing bar. There is no way for anybody outside of Google to know whether the original claim is correct or not.

                By all means be skeptical, but it is a bit much to just say he's wrong.

                • by s.petry ( 762400 )

                  So now you claim that the only way to have any knowledge is by working for a specific company, almost as good as your previous point. A person that understands math can look at a person claiming "I made 1+3=5" and say they are wrong. It does not take specific corporate knowledge to know that someone made an impossible claim, it takes knowledge of the subject matter.

                  Bravo, again!

                  • No, he's saying that to claim a data set you don't have access to says one thing or another is clearly false. You clearly don't know in what way the attacks changed over time. That data exists, and the other person had access to it and was explaining it from his understanding. You, however, haven't had access and so can't make authoritative statements. However, regardless of the fact you haven't seen the data, you make wild, absolutist claims about what it contains.

                    Normally I'd think somebody like yourself

                  • by Rich0 ( 548339 )

                    So now you claim that the only way to have any knowledge is by working for a specific company, almost as good as your previous point.

                    Uh, what previous point would that be? This is my first post in this thread.

                    And yes, the only way to have any knowledge about the results of a measure taken by Google is to work about Google, unless they publish the data. You can certainly say that we tried the same thing and it didn't work elsewhere, but you can't purport to know whether it worked for Google. Maybe the folks at your company were just incompetent? Or maybe the guy is just lying about Google. I have no idea, and neither do you.

                • by s.petry ( 762400 )
                  And I say "your" because you at least appear to be shilling for someone and not actually individuals. I fully admit that is a speculation, but a fair one given that not a single person who defended the GP has been willing to debate my points.
                  • by Rich0 ( 548339 )

                    And I say "your" because you at least appear to be shilling for someone and not actually individuals. I fully admit that is a speculation, but a fair one given that not a single person who defended the GP has been willing to debate my points.

                    Or they just can't be bothered to. :)

                    I have exactly one Slashdot account, and I've been using it for 10 years. Heck, I use the same username on half of the Internet so you could probably figure out who I am if you tried hard enough...

                • There is no way for anybody outside of Google to know whether the original claim is correct or not.

                  That's not quite true actually. VirusBulletin is a third party spam filtering company that made a blog post stating that based on their own measurements, Gmail was indeed dramatically better at stopping hijackings than other providers [virusbtn.com].

          • Maybe English is not your first language, but I doubt that to be true.

            Don't be a tool, his English is fine. Yours isn't very good, you make all sorts of contradictory statements, like the absurdity that you're "not trying to knock [him]." Perhaps you simply misunderstood his point, because of your low English comprehension level, and then presumed that he must have said it wrong.

            And... you'd bet "a year of salary" that... [something different than he claimed.] I'm guessing that you don't make a salary. Maybe you're self employed and only make profit, or work hourly. I'm presu

      • by ShaunC ( 203807 )

        Um, no you/they didn't. I work at an ISP, smaller than Google, and am constantly blocking various attacks.

        It was pretty heavily implied that he was speaking about blocking these attacks on GMail. Thankfully, Google hasn't quite achieved the ubiquity needed to interfere with other ISPs' traffic.

        • by s.petry ( 762400 )
          My point was that even with Gmail they could not have reduced 100% of the attacks.
          • They could easily have stopped 100% of the attacks. But you're the only one who thinks that means they would have stopped all attacks. Your tag line is scary, I'd hate to think you have to read manuals and operate servers based on what you thought you read. I'm not trying to knock you, I'm just sharing my feelings.

            All blargs are blorgs. No blargs have been observed in Fooville since the policy of Bazification was implemented. There are no longer blorgs in Fooville. T/F

  • DO we even know at what business(es) or bureau(s) the breach occurred? Every database of logons should contain some intentionally faked entries that can be used to fingerprint the database, just like those imaginary towns that are put on maps to expose copyright dodgers.

  • by forgottenusername ( 1495209 ) on Thursday August 07, 2014 @11:17AM (#47623345)

    Either they're in on the theft somehow, or they're a totally unethical company trying to extort people. No trustworthy security vendor would withhold information about sites that are compromised from the site operators.

    I think it's just a marketing ploy personally. "You may have already won! Contact us for details ($1.99 a minute)".

    Regardless, they're on my list of companies to never do business with in any way. I

    • Either they're in on the theft somehow, or they're a totally unethical company trying to extort people.

      I would say that if they're extorting people with stolen data, regardless of how they acquired it, they're "in on the theft." They're materially benefiting from it, knowingly, intentionally, and are full accomplices even if they never met the original thief. It is the rare case where they're an accomplice, but not (known to be) a conspirator.

  • how do we know Kaspersky Labs is legit?

    they've got to have the means to do this...

    same with McAfee

  • I can't think of any but what a reputation this country has: Hackers, Russian dash cam car crashes, a leader with Tsar ambitions. And yet they have best competition ballroom dancers (and many moved here to US).

There are two ways to write error-free programs; only the third one works.

Working...