Forgot your password?
typodupeerror
Cloud Security

Hackers Behind Biggest-Ever Password Theft Begin Attacks 107

Posted by Soulskill
from the 123456-letmein-iloveyou-trustno1 dept.
An anonymous reader writes Back in August, groups of Russian hackers assembled the biggest list of compromised login credentials ever seen: 1.2 billion accounts. Now, domain registrar Namecheap reports the hackers have begun using the list to try and access accounts. "Overnight, our intrusion detection systems alerted us to a much higher than normal load against our login systems. ... The group behind this is using the stored usernames and passwords to simulate a web browser login through fake browser software. This software simulates the actual login process a user would use if they are using Firefox/Safari/Chrome to access their Namecheap account. The hackers are going through their username/password list and trying each and every one to try and get into Namecheap user accounts." They report that most login attempts are failing, but some are succeeding. Now is a good time to check that none of your important accounts share passwords.
This discussion has been archived. No new comments can be posted.

Hackers Behind Biggest-Ever Password Theft Begin Attacks

Comments Filter:
  • by Anonymous Coward

    Time to TFA bitches!

    • Now this seems like a much more plausible source of the fappening pictures that are making their way to the interwebs than repeated, undetected brute force attempts going on for months strait... Just a thought.
  • by muphin (842524) on Monday September 01, 2014 @08:41PM (#47803513) Homepage
    Although annoying i'm glad i have enabled 2-factor on Namecheap, plus my passwords are different from my email...
    • by Technician (215283) on Monday September 01, 2014 @09:04PM (#47803621)

      If you have a Gmail account, look for the Last Account Activity at the bottom right. Use the Details link to see your recent history. Set your preferences to alert you to unusual account activity. More accounts should notify you of unusual logins and login attempts.

      • Google also has two step verification, where a code will be sent to your phone via SMS that you need to enter in order to log in to your Gmail account. A little more hassle, a lot more security.
        • by Mashiki (184564)

          Interestingly enough, Google will also request 2-step verification if you have a mobile number up and you're logging in from another part of the world. A few months back someone tried to log into this gmail account; it was blocked automatically. They then tried to reset the password and I got a sms challenge on my cell. It's also smart enough to know that if you've been one place before, it's likely you as well. I regularly head to the far northern part of Canada, very few ISP's and broadband. The fir

  • Reports at the time were that they stole billions of passwords, so why only target the domain registrar? This could be a sign of worse things to come, how many accounts have they accessed without alerting an IDS, and what are they doing once they gain entry. By starting with the domain registrars, they could gain much more information than even their previous massive trove of user data. This is highly troubling.
    • by s.petry (762400) on Monday September 01, 2014 @10:26PM (#47803903)

      The first report was bullshit by some nobody to make money, nothing more and nothing less. This is more of the same bullshit to make bogeymen, and Russia has been a good target lately. I have worked in IT security for nearly 3 decades, so yes I do have some knowledge.

      The 1.2 billion "credentials" was nothing to worry about (see disclaimer below), and still isn't. Hackers move massive lists of email addresses all the time, and try to run brute force attacks all the time. We block hundreds of thousands of these attacks every day. The majority are [email_addr@domain] with a password of 'password1'. Most of the time these are easy to see, as neither the user or domain exist on the targeted servers. Even the legit addresses are easy to detect, because hackers will use the top 25 worst passwords (just like you can find in articles every year, no I'm not kidding). Rarely do I ever see anything complex, like .00001% of the time rare, where there is actually a worm running on the back end (think John the Ripper).

      If I was a conman and wanted to make fast cash, I could start dumping all of these email addresses to a DB, and say "Oh Noez! This email account is haxxored! When in reality, there is no such compromise. To fluff numbers, I hash 'password1' in SHA, MD5, CRYPT, and maybe even use plain text. 300 million accounts has now given me a claim of 1.2 billion 'credentials', and you can hopefully see that the claim is complete shit! I can gather that 300 million addresses in a week without breaking a sweat.

      Disclaimer. You should be changing passwords for anything you care about frequently. 8 character passwords every 90 days, 14-16 character every 6 months. If you are using a strong password and are up for a change, go do so, no big deal. Since I write this shit for policies regularly, a "strong" password consists of the following.
      1. No dictionary words, proper names or common acronyms in forward or reverse.
      2. No QWERTY keys, including qazwsx, 54321, etc...
      3. Contains at least 1 special character, 1 number, 1 upper and 1 lower case character.
      4. Is not 'p@SSw0rd' or some other l337 speak that would be in a cracklib dictionary, and there is plenty there.

      There are obviously restrictions in some places, so if you can't use certain characters make a longer password. If you can't make a longer password change the password more frequently. The majority of 'hackers' are script kiddies, not hackers. If you make things hard, they find a different target. There are numerous people out there that use 'password1' for their password, don't be one of them.

      • correcthorsebatterystaple

      • Assuming an attacker has no knowledge of the password make-up, according to your policy the password nkeL4(b3 sits in a keyspace of around 6.1 * 10^15 combinations.

        Under equal conditions the password refineddisplayparcelsuited sits in a keyspace of around 6.2 * 10^36 combinations. When I get back from my appointment this morning, I will still remember refinddisplayparcelsuited and won't have to write it on a sticky note, or save it on to the Dropbox App on my phone, which has a crappy password I use everywh

        • Four words, strung together, can be a key space as small as 3000^4 (roughly 46 bits of entropy), especially if they are chosen from the top 3000 words in the dictionary. That's nowhere near 6.2 * 10^36.

          Misspellings can help a lot and make it a lot stronger (adding maybe 3-4 bits per word). Adding spaces or punctuation between them adds maybe 1 bit per word. Random capitalization of something other then the first letter adds 2 bits per word.

          Basically, if you're using English language phrases / words w
          • by operagost (62405)

            "refineddisplayparcelsuited" is not a common phrase, and this isn't Master Mind where the attacker gets hints when he correctly selects part of the password.

            I love how we spend so much time picking passwords that are hard for people to guess-- or remember-- when computer programs can only be written in a practical matter to try the most common dictionary words or "hunter2"-type passwords. Past that, it's all brute force whether you used "j$b01[BaP*@" or "refineddisplayparcelsuited" because the program has

            • by jeffmeden (135043)

              "refineddisplayparcelsuited" is not a common phrase, and this isn't Master Mind where the attacker gets hints when he correctly selects part of the password.

              I love how we spend so much time picking passwords that are hard for people to guess-- or remember-- when computer programs can only be written in a practical matter to try the most common dictionary words or "hunter2"-type passwords. Past that, it's all brute force whether you used "j$b01[BaP*@" or "refineddisplayparcelsuited" because the program has no idea how much of the character set your password used until it's been cracked.

              Except guessing at strings of words is trivial if they are in the dictionary.

              refined display parcel suited are 4 common words. I could write a tool to attack that very quickly, starting with the most common words arranged in 2,3,4 sets.

          • by s.petry (762400)

            For posterity, it's not just the off line attack that's become a problem. There are numerous attacks that occur over huge IP ranges. If you locked the account at a few bad attempts most users would be perpetually locked out. Hackers are now hitting an account from thousands of IP addresses to brute force. They rate throttle to reduce detection, most connecting once every 30-60 minutes. The really stealthy attacks may have a single IP connecting once per day for 1 account, the next day the same account

        • I'm not sure you ever tried to write a brute force tool, let alone run one. I'm not saying your method is horrible, but it is nowhere near as secure as you think. The actual strength is (dictionary_words)^4. The statistic you gave is not even accurate as a 26 character randomized password, which would be 26^26 (given that you are only using lower case letters). Your strength statistic is absolutely wrong.

          There are many ways to make strong passwords. If you want to use words like that, mixing in what I

      • by Jawnn (445279)
        I would agree that brute-force attacks are hardly news. The door-rattlers have always been there, but the news that over a billion user accounts, that is working credentials that grant access to something, are in the hands of organized criminals, is something else again. The wave of snowshoe spam we've seen over the last few weeks lines up nicely with that news, and our analysis is that compromised user accounts on a widespread assortment of services/hosts appears to be a fundamental part of the campaign. T
    • by jeffmeden (135043)

      It's simple, get control of a domain and you can redirect all email. Redirect all email and you can reset passwords without needing to ever worry about the actual mailbox password (which is probably stronger than the registrar password but obviously is just as important).

      Exhibit A, in which this exact scenario happened:
      https://medium.com/p/24eb09e02... [medium.com]

  • Does this mean we are approaching a preemptive strike from Russia? We always hear about our infrastructure being comprised via the internet, I guess a war with Russia is a good way to find out!

  • I'm watching Spaceballs right now so I'm really getting a kick out of this story.

  • by jmccue (834797) on Monday September 01, 2014 @09:42PM (#47803753) Homepage
    I decided why not change the passwords, been a while anyway, 2 of the 3 sites I care about still do not allow what they call 'special characters' (!@# - etc). In this day an age I would think those restrictions would lifted. One day I will try UTF-8 or UNICODE characters and watch the fireworks at the sites. I do not do on-line banking and I have no incentive to start after seeing some finance sites will only accept US English letters and numbers for PWs.
    • by heezer7 (708308)
      Hell, financial sites like ETrade and Charles Schwab still have limitations like this as well.
    • That's not a real problem, though. For every special character, just type out it's name in English at the point where you would use it. You'll get a longer password, therefore stronger, without special characters. The real problem is when a site limits the total length of a password.
      • But it's special characters! It MUST mean the password is more secure! Wait, you're also saying that using "seventysix" is more secure than "76"? Goodness gracious, man, what is wrong with you? Did you use that "mathematics" thing again?

    • by dargaud (518470)
      Ha, for years my bank website used 4-digit pins as passwords... Fortunately that changed. After a major break-in I assume.
      • by weszz (710261)

        my bank went from unlimited characters to 10 with no special characters...

        Took me so long to figure out why I couldn't change my password... Thought there is no way this isn't complex enough... turns out I had to trim 6 characters off it and remove the symbols and such... made for a sad day.

        Their response was that it didn't matter because a brute force attack would be locked out long before it could try the other characters.

  • A domain registrar with roughly 3 million domains [wikipedia.org] having a lot of traffic is not a sign that the not so credible 1,2 billion accounts stolen are being used (about the credibility of the claim: The Russian 'hack of the century' doesn't add up [theverge.com] and Hold Security Backlash [theregister.co.uk]).

    Maybe someone stole 15 million accounts and are trying them out (way less than 1200 million and way more than normal on their website).

  • by X.25 (255792)

    Of course, it could not been any of thousand brute force attacks that is happening every day.

    No.

    It was a brute force attack by bad baby eating state sponsored Russian hackers, specifically using the imaginary end-of-the-world password list.

    Of course, neither the "1.2 billion passwords" list, nor the "they're using it against Namecheap" events were/are cheap advertising.

    Nope.

  • by dutchwhizzman (817898) on Tuesday September 02, 2014 @02:27AM (#47804683)

    Why would these "Russian criminals" be the ones behind this attack? Sure, some company that used the argument that there seems to be a list of over 1 billion accounts floating around on the internet to sell their services some time ago. It may even be that this list was found for sale on a Russian market place. It may even been that there are actual Russians selling this list. The accounts could even be mostly real, although probably most of it will be relatively dated.

    But why would that same group of people that are actively selling this list be the same group that is using it? It makes much more sense that some group that bought part of this list, or bought some other list, or has their own trojan to steal passwords is now attacking namecheap. Unless there is substantial evidence that the same group is behind it, this is just FUD and sensationalism.

    Namecheap is under attack with what's most likely a brute force list with accounts that were compromised in some yet unknown way. I think those are the facts and the rest is purely speculation.

  • for sure the first site I'd attack is obscure registrar namecheap...

  • [shameless plug, but apropros] - my company's Kaje Picture Passwords for the Web [ka.je] would have prevented these attacks almost completely. (I say "almost" because, well, "never say never".) We published a press release about this two weeks ago: Bright Plaza offers “Kaje” Website Security Solution to Russian Hacker Password Breach [prweb.com]. Using Kaje, the password is no longer stored on the website so these breaches could not have exposed the passwords. Kaje never knows anything about the user other than

  • by drinkypoo (153816) <martin.espinoza@gmail.com> on Tuesday September 02, 2014 @08:24AM (#47805725) Homepage Journal

    Now is a good time to check that none of your important accounts share passwords.

    No, now is a terrible time to check for that. You should not have to check.

  • ...I don't understand why this is so difficult. If I go to youtube, from my PC at home, I am handed a suggestion-list based on past videos browsed (if I use my work PC then I get handed different suggestions). If I change some stuff in my browser (firefox add-ons or the like) then I notice that youtube's suggestions change, but soon learn that it's my PC and eventually suggest the same videos as before (even if I have not looked at those videos since the change). So it seems to me that it's very possible

God made machine language; all the rest is the work of man.

Working...