Massive Russian Hack Has Researchers Scratching Their Heads 102
itwbennett writes Some security researchers on Wednesday said it's still unclear just how serious Hold Security's discovery of a massive database of stolen credentials really is. "The only way we can know if this is a big deal is if we know what the information is and where it came from," said Chester Wisniewski, a senior security advisor at Sophos. "But I can't answer that because the people who disclosed this decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at $120 per year.
Objection! (Score:4, Interesting)
"They decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at US$120 per year.
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.
In addition it seems the above quote neglected this portion of the article:
Individual consumers can find out through its identity protection service, which Hold Security says will be free for the first 30 days.
It's free and they still can't afford it? Sophos can't use a fraction of its 100,000 honeypot email accounts to sign up and see if it's legit?
Much like Hold Security, Sophos has displayed nothing but news-unworthy jabber.
Re:Objection! (Score:5, Insightful)
I'm getting pretty dubious of the entire claim. Some company wants to sell its security monitoring service, declares "we've got a huge database of stolen credentials, but we're not going to let you see it without paying up first, or at least signing up for a service that will bill you after 30 days."
I call BS.
Re: (Score:3, Interesting)
I agree. I spent several years in the IT security arena before leaving for other IT pursuits. I started off as an investigator, then firewall engineer, then pen tester. Generally, most AV and security companies sell FUD to make their billions. I always tell my friends who continue to run Windows and Macs to create and use non-administrator accounts and surf the Web as a mortal user. This alone stops 90% of the crap out there, although some new stuff will install directly in the users' directory. Since Chrom
Re: (Score:1)
I wouldn't go that far. It is too easy to plant evidence. All it takes is a botnet client that sticks a piece of code on a drive or E-mail account, and that's a conviction. Plus, the real perps are likely in countries with no agreements for extradition to their victim nations.
Lets be real here. There will always be bad guys and unlike bank robbers, catching them is next to impossible. Even if we find who it is, they will be sitting in a country that will actually give them the state's blessing for thei
Re: (Score:2)
there should be a bounty on the heads of those people who author malware. If you are caught, you are executed.
It would make more sense to get to the root of the problem, and execute authors of browsers and email clients that don't implement proper sandboxing.
Re: (Score:2)
Since Chrome can be installed w/o admin rights on most boxes, this has been problematic.
Why is the installation of Chrome without admin rights a problem?
Not meaning to contradict, just interested in the reasoning.
Re: Objection! (Score:1)
This is an individual who just proclaimed that if you steal you should be sentenced to death. Why are you even bothering to ask for further opinions from a clear asshat?
Re: (Score:2)
Two reasons it can be a problem:
First, malware can do a lot of harm without any sort of admin rights. All files on the account are vulnerable to whatever it might do. If you've got files in your account you can't afford to lose, and no good backups (yes, this is a disaster waiting to happen, but many people do it), you're vulnerable to ransomware. It'd be more effective if it could jump across accounts, but it doesn't need to. Or, if the machine is in some sort of trusted network, it may be able to i
Re: (Score:2)
Re: (Score:1)
Let's start taking a page from China and Singapore's book, shall we.
Yes! Let's start by you offing yourself. Seriously.
Ignorant, brainwashed asshole.
Re: (Score:3)
I'm with you on this. For individuals, the free version expires after 30 days AND they state that, because of the size of the data, it will take a while.
My guess is a little more than 30 days.
Re: (Score:2)
I certainly can't think of any possibilities that wouldn't be 145,345 counts of CFAA violation if you did them to somebody the feds actually cared about even slightly; but team prosecutor has shown very, very, little interest in pursuing even the most blatant counter-intrusions (and it isn't too surprising, the victims are always unsympathetic and vanishingly unlikely to want to raise the issue or
Unproven, but plausible. Our reputation was plenty (Score:2)
We used to provide a similar service to web sites. We had many millions of compromised accounts. We didn't offer any services to consumers. The companies who were our customers knew we had a very solid reputation for providing excellent security solutions, and on forums other webmasters they know would report that our service worked well for them. That was sufficient that most customers would add that service or not based on what I recommended for their particular site. In general, on a site making over
Cui bono (Score:5, Interesting)
Looking at who benefits is always a worthwhile pursuit. A company benefits, selling what appears to be FUD. US Government benefits because they have recently been blaming everything on Russia.
What is not happening? Nobody is going to jail over computer espionage act (or any other law allegedly violated). In fact there is no criminal investigation at all mentioned. No facts available to verify the alleged "stolen credentials", and the only way to even glimpse said data is to provide your information to some company that is an unknown in the security community.
I'll have to dig later, but I'm curious who the owner of this company is and who they are tied to. Surely a coincidence, but this comes out right after former NSA Director claims he's worth a million a month in consulting, working on over a dozen "IT Security" patents, all for his brand new private business. That may not be a rat, but sure has that "rodent" like smell to it.
At best, this is a company trying to profit off other people's pain. No thanks, I'm not buying anything they are selling.
Re: (Score:2)
Re: (Score:2)
What's more likely is they went to one of the many "hacker" websites where they sell this sort of stuff and baught a large chunk of nearly worthless data from old geocities websites and such.
Re: (Score:2)
Sure the hack may become public down the road but at least there is a chance it may never be.
Re:Objection! (Score:5, Informative)
"They decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at US$120 per year.
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.
Hey dimwit, it's $120 per year per site company not for disclosure of the entire data set. This is a protection racket.
Re: (Score:1)
Hold Security probably orchestrated the website account credentials theft. I am always wary of security researchers and companies making these claims.
Re: (Score:1)
Ahhh! So it is government work?
Re:Objection! (Score:5, Insightful)
It sounds quite fishy because they ask for a 120$ subscription, not to let you access the data, but for a service that lets you know if you are affected by it or not.
- Here, my 120$, what's going on with this?
- You're not affected, goodbye.
- But, hey!
- You're not affected, goodbye.
Re: (Score:3, Funny)
- But, hey, I have 649 passwords! Which one, what service?!?
I got 99 passwords, but AC ain't one.
Re: (Score:2)
Could be worse:
- Here, my $120, what's going on with this?
- You're affected. Change your password, goodbye.
- But, hey, my web site doesn't have any passwords, how can it be affected?
- Yes, you're affected, goodbye.
Until they pony up some evidence, this sounds like scam much like the cold callers who tell you you have a virus.
Re: (Score:2)
It sounds quite fishy because they ask for a 120$ subscription, not to let you access the data, but for a service that lets you know if you are affected by it or not.
- Here, my 120$, what's going on with this?
- You're not affected, goodbye.
- But, hey!
- You're not affected, goodbye.
Then again they could just be trying to make money.
I'm definitely in favour of open disclosure and would like to think they'd do better businesswise releasing the info and getting good PR. But if you're looking to make money off the info that is the way to do it.
Of course it could also be a scam, if they're planning on this business strategy they should have someone respectable under an NDA to at least vouch that the information is legit.
Re: (Score:3)
If these people have knowledge of a crime, aren't they legally obligated to report it to law enforcement?
Normally, one could claim no knowledge of a crime but in this case, they have announced that they have knowledge of crimes.
Re: (Score:2)
I would guess Russia would start protecting these guys if it pisses of the US enough for the US to charge them with something, just like Edward Snowden.
Re: (Score:2)
It does not matter where the perps are believed to be. They've claimed some of the companies are US companies, presumably with servers in the US. So it is a federal felony in the US, and yes, they should have reported it to law enforcement if they believe it is ongoing. Generally in the US that is not required. But...
If they're profiting off of it without reporting it, they're actually accomplices and I hope they get arrested for it. And if they committed any crimes in Russia to acquire the data, it should
Re: (Score:3)
If these people have knowledge of a crime, aren't they legally obligated to report it to law enforcement?
Normally, one could claim no knowledge of a crime but in this case, they have announced that they have knowledge of crimes.
Depends on the laws in their HQ location, but in most civilized nations this is called extortion by Hold Security. They are most likely in the cross hairs of law enforcement as I type this. If this turns out to be a bogus or inflated claim (like it smells) they could face some serious criminal and civil charges, regardless of what country they are in.
we offered a similar service, it costs to operate (Score:2, Interesting)
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.
Indeed, we used to operate a similar service, and many companies were excited to sign up at just $49 / year. Often, the bad guys get the entire password database, so being alerted to that right away is valuable. I designed our system many years ago and it was somewhat expensive to operate. Crac
Re: (Score:2)
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach?
A billion dollar security firm won't sign up for a $120 per year service per site to not see the data behind the breach, but to be given an unsubstantiated statement of whether they allegedly are affected or not.
Why would they? That would just be opening up for all kinds of protection rackets.
the same as any service - reputation, etc. (Score:2)
You ask "why would they" sign up for a notification service that costs $120 / year. I suppose it's like just about any other online purchase - it comes down to the reputation of the seller. Why would you buy a computer on Dell.com, when you can't see the product before you buy it? You'd make that decision based on Dell's reputation, and any previous dealings you had with the company.
The companies who were our customers knew we had a very solid reputation for providing excellent security solutions, and on
Re: (Score:2)
Thanks ray, but you answered the wrong question, and with a data dump.
Re: (Score:2)
Right. I've bought Dell computers before, and they've been quite serviceable machines that did what was advertised. That sort of thing gives Dell a good reputation, and is why I continue to buy from their website.
Hold Security doesn't have a reputation. The website is about a year old, and apparently was blank until quite recently. Looking at Bruce Schneier's blog [schneier.com], it looks like the only thing in its favor is Brian Krebs saying it's legit.
The question is not "Why would I pay 'raymorris' or Dell?".
Re: (Score:2)
What guarentee does anybody have these credentials are real and actually belong to ANY site?
They could just as well fabricate some large list of random credentials if their "disclosure" method doesn't actually require disclosing whose the data was.
All you would be paying for is a $120 "Thanks for the money, the credentials aren't from your site" notice.
Re: (Score:2)
What guarentee does anybody have these credentials are real and actually belong to ANY site?
They could just as well fabricate some large list of random credentials if their "disclosure" method doesn't actually require disclosing whose the data was.
All you would be paying for is a $120 "Thanks for the money, the credentials aren't from your site" notice.
I have a large database of real logins and passwords. They really do belong to a site. Of course, it went out of business and the user accounts were transferred to a competing service with different login system... 10 years ago. But they are real logins, from a real site.
And YOUR login could be affected! Just send me $extortion_amount1 and I'll tell you if you're in the list. And for $extortion_amount2 I'll even tell you the name of the site.
Re: (Score:2)
With that pricing structure it is markedly less practical for any sort of 'peer review' process to go on, or any accurate survey of "Site X was added to the database after being compromised by Y, how large
Re: (Score:2)
It strikes me that the entire purpose of their pricing structure IS to avoid peer review. They're not letting anyone in the community see the data, or even some statistically useful amount of the data to actually judge what they have.
It's a scam, pure and simple.
Re: (Score:2)
Re: (Score:2)
Individual consumers can find out through its identity protection service, which Hold Security says will be free for the first 30 days.
It's free and they still can't afford it? Sophos can't use a fraction of its 100,000 honeypot email accounts to sign up and see if it's legit?.
If I had to guess, "free" service users will have to provide a credit card and then hope that if they try to cancel that the cancellation is actually honored rather than getting into a common situation where they keep getting billed for months for a service that is almost impossible to actually cancel.
Re: (Score:1)
it sounds like the service the firm is selling is notification if your specific company has been breached [as in data from your company is in the 'hacked data']. They won't let anybody else see the hacked data directly/independently.
Assume your credentials are in that database ... (Score:5, Informative)
... and change all of your passwords today. This is the best way to devalue the 'massive database'. Then sanitize your SQL queries!
Alternatively... (Score:3)
Assume they cracked the NSA backdoor default password and can now access everything on every computer not running a hardened operating system. In other words, everything, whether you change your passwords or not. Further, assume they have remote access via UEFI to every motherboard built in the past year.
You might as well, that level of access has been built into modern technology, if this group hasn't figured it out, someone will. Or maybe already has.
We live in an age where technology is insecure by desig
Re:Alternatively... (Score:4, Informative)
Re: (Score:2)
That would be because any (competent) backdoor will be encrypted and cryptographically signed with key(s) known only to the TLA. Consider a router -- it passes all packets normally unless it finds one that is properly signed, then it extracts and executes the payload, fully opening up the device to the whims of the TLA. In lieu of someone leaking or determining the key, it would be extremely hard to identify such a backdoor.
Re: (Score:2)
It's basically looking for a needle in a haystack, but for a router, the haystack is a lot smaller than on a full OS.
Any code affecting normal operation speeds would also be easier to spot - additional packet inspection can incur a noticable hit on a device that prides itself on passing packets as quickly as possible and allowing as many simultaneous connections as possible.
Re: (Score:2)
Consider a router
1) It has a firmware that's pretty small, and finding something like an inspection routine that cryptographically evaluates every packet really would kind of stick out to anybody looking.
2) Many people run all sorts of traffic logging etc, promiscuous mode in front of the router etc. Unless you theorize that all network hardware and software is in on it, the command and control traffic would be visible; and someone would have seen it by now. As in ... why is my router sending traffic to X,
Re: (Score:3)
never has an "universal backdoor for the government" been provably found in an OS or a firmware
That's because nobody will admit to the hardware backdoors that have been found, not because none have been found. Take out the words "for the government" and it instantly stops being true.
Re: (Score:2)
Only if you're an idiot and used the same password on EVERYTHING.
Really - what likely happened is they breached some major sites, but those sites contained little of value. I mean, if you breach the New York Times database, what do you have? Just a bunch of emails and passwords of people who probably registered to read some article and which are completely worthless to anyone on
Re: (Score:2)
Even better, add IP blocks, client certs, SSH RSA keys, and some type of two factor authentication.
For example, everyone knows the default root password for iOS is "alpine"... but knowing that does not help much to develop a new jailbreak or to get access to a device from remote.
special offer for /. readers (Score:1)
For $799, you can get one year's service for protection from the Russian hackers plus a single-user license for Linux IP from The SCO Group.
Not implausible (Score:5, Informative)
More than 1B credentials does not sound implausible to me, though it's on the high end. You may be wondering why my opinion on this is more relevant than anyone else's, so let me explain.
Although I left the company in January, for about 7.5 years I worked at Google and for ~3 of those years I worked on security and anti-spam related matters. Starting around April 2010 we started to see absolutely enormous numbers of compromised accounts sending spam to their contacts. This was not a problem that grew slowly. It went from zero to one gang compromising on the order of 100,000 accounts per day and that happened in the space of, it seemed, a few weeks. We learned about this problem through user complaints and by watching the flow of spam mails being reported to us via the "Report spam" button. We quickly realised this wasn't a Gmail specific problem but was simultaneously impacting Hotmail and Yahoo. Further investigation revealed that although this gang was capable of compromising ~100,000 accounts per day (more than one per second) this was the result of a 10-15% success rate for more like a million attempts per day: most account/password pairs they tried did not work. The reason was they were reversing password hashes stolen from third party websites using GPUs, and it turns out that people who use the same password everywhere make up (surprisingly) only about 10-15% of the user population. People suck less at security than you might imagine.
When this problem first started we believed that such an enormous supply of credentials must surely be some kind of freak one off, the result of compromising an unusually large site. I mean; one million credentials every fucking day was an unimaginably vast pool of stolen passwords. But as the user complaints of being hacked failed to dry up we came to accept the horrible truth - this was not some freak one off but the result of some kind of production line of passwords. Most likely a combination of automated web crawls to discover vulnerable sites, semi-automated popping of those sites, farms of GPUs reversing the passwords and the resulting packages being sold on the black market to spammers who then abused them for bypassing spam filters (mail from contacts is whitelisted by any good spam filter). We only got occasional snapshots of this market, for example we were able to find adverts on Russian blackhat forums by people advertising lists of "washed" vs "unwashed" account/password lists for hotmail, gmail etc, but mostly it was opaque.
Anyway, long story short, we formed a team that built a full blown risk analysis system for every single login (Google has a bajillion logins per second thanks to mail clients that poll Gmail and have to log in each time) and after several years of work managed to block logins with bulk-stolen passwords so successfully that they went away. But the underlying supply of passwords is still out there, and should those defences fall the problem would come back.
I gave a talk about this and various other webmail abuse related topics at the RIPE 64 conference in Ljubljana (video link) [ripe.net] in case anyone is interested in this. The slides [ripe.net] are also available though lots of info from the talk is missing from them.
Re: (Score:2)
You know, with such informative writing, you really shouldn't be posting on here. You brought cold, hard facts to this thread, something completely unknown to most users on here.
Re: (Score:2, Interesting)
Good write up, but you make a false claim.
Anyway, long story short, we formed a team that built a full blown risk analysis system for every single login (Google has a bajillion logins per second thanks to mail clients that poll Gmail and have to log in each time) and after several years of work managed to block logins with bulk-stolen passwords so successfully that they went away.
Um, no you/they didn't. I work at an ISP, smaller than Google, and am constantly blocking various attacks. Every time one method gets blocked, we find new ones. Yes, this is for IMAP/POP over SSL just like Google (and I block numerous other attacks because we provide numerous services).
You may have stopped many of the attacks, or even most of the attacks, but not _all_ attacks. The most difficult to block are the attacks by Governments, and you can tell they are
Re: (Score:2)
For less then 1000 dollars, I can get 10,000 machines to attack your site, coordinated from several places from around the globe.
You reasoning for assuming it's a government is flawed.
Re:Not implausible (Score:5, Informative)
I didn't make a false claim. You quoted me saying we stopped bulk stolen password based attacks like the ones I described, and then proceeded to argue with a statement I never made (that we stopped all attacks).
To clarify, the attacks I'm talking about are ones where the attacker has a large list of passwords (in the order of hundreds of thousands of passwords or more) and try the password to see if it matches. If it does they log in, if it doesn't they give up and try the next one. Government sponsored attacks tend to care an awful lot about a small set of targets which is the exact opposite.
Google was able to stop these attacks so effectively the people behind them gave up, and there was a large but not infinite number of people who were carrying out such attacks, so eventually they became no longer a real issue for the userbase. Note that our competitors (with the notable exception of Facebook) were NOT able to do this, so if a small ISP struggles to do it too, that would not be very surprising.
Re: (Score:2, Insightful)
Trivial to prevent:
a) delay 401 responses to incorrect logins for 15 seconds
b) immediate 409 error if another thread tries to login while inside the 15 second window (see 'a' above), whether the password is correct or not.
c) deactivate accounts after XX unsuccessful logins (pick any value of YY)
d) make user validate themselves to unlock an account, or auto-unlock after YY minutes (pick any val
Re: (Score:3)
block logins with bulk-stolen passwords so successfully that they went away.
Maybe English is not your first language, but I doubt that to be true. That statement at least implies that Google no longer suffers from brute force attacks.
You then reinforce that same false claim in the post I'm commenting to now.
Google was able to stop these attacks so effectively the people behind them gave up
No, they didn't. You may have deterred a lot of them, but I'd bet a year salary that Google still experiences a measurable number of attacks every day.
Look, I freely admit that huge leaps can be made with security. I have worked in IT Security for a quarter century. Neither
Re: (Score:1)
I think you're being pedantic here.
It is clear to me that he was referring to the specific group of actors who were compromising 100k accounts a day.
He never said the smaller fish didn't go away.
Re: (Score:2)
Am I being pedantic? Perhaps a bit, but not entirely. That specific group still does not go away, they are there every day trying again from a new set of IPs (if not sooner). Google's ability to notice and react to the attacks is not the same thing as making them "go away" as GP stated.
I have no problem with people talking about their accomplishments, hell even a bit of embellishment every now and then is fine. False claims are in a different category in my opinion.
Re: (Score:2)
>Maybe English is not your first language
>I'm not trying to knock you
Yes you are.
>is making a false claim
No. He made a statement that they stopped a particular class of attacks. You then incorrectly stated that the claim was that Google no longer suffered attacks (which is of course absurd) and proceeded to debunk THAT. So you are really arguing with yourself, which is kind of amusing but not very informative.
Re: (Score:2)
Re: (Score:2)
This whole thread is basically somebody from Google saying that they did foo and attackers stopped doing bar. Then somebody else who has no affiliation with Google says that attackers didn't stop doing bar. There is no way for anybody outside of Google to know whether the original claim is correct or not.
By all means be skeptical, but it is a bit much to just say he's wrong.
Re: (Score:2)
So now you claim that the only way to have any knowledge is by working for a specific company, almost as good as your previous point. A person that understands math can look at a person claiming "I made 1+3=5" and say they are wrong. It does not take specific corporate knowledge to know that someone made an impossible claim, it takes knowledge of the subject matter.
Bravo, again!
Re: (Score:2)
No, he's saying that to claim a data set you don't have access to says one thing or another is clearly false. You clearly don't know in what way the attacks changed over time. That data exists, and the other person had access to it and was explaining it from his understanding. You, however, haven't had access and so can't make authoritative statements. However, regardless of the fact you haven't seen the data, you make wild, absolutist claims about what it contains.
Normally I'd think somebody like yourself
Re: (Score:2)
So now you claim that the only way to have any knowledge is by working for a specific company, almost as good as your previous point.
Uh, what previous point would that be? This is my first post in this thread.
And yes, the only way to have any knowledge about the results of a measure taken by Google is to work about Google, unless they publish the data. You can certainly say that we tried the same thing and it didn't work elsewhere, but you can't purport to know whether it worked for Google. Maybe the folks at your company were just incompetent? Or maybe the guy is just lying about Google. I have no idea, and neither do you.
Re: (Score:2)
Re: (Score:2)
And I say "your" because you at least appear to be shilling for someone and not actually individuals. I fully admit that is a speculation, but a fair one given that not a single person who defended the GP has been willing to debate my points.
Or they just can't be bothered to. :)
I have exactly one Slashdot account, and I've been using it for 10 years. Heck, I use the same username on half of the Internet so you could probably figure out who I am if you tried hard enough...
Re: (Score:2)
That's not quite true actually. VirusBulletin is a third party spam filtering company that made a blog post stating that based on their own measurements, Gmail was indeed dramatically better at stopping hijackings than other providers [virusbtn.com].
Re: (Score:2)
Maybe English is not your first language, but I doubt that to be true.
Don't be a tool, his English is fine. Yours isn't very good, you make all sorts of contradictory statements, like the absurdity that you're "not trying to knock [him]." Perhaps you simply misunderstood his point, because of your low English comprehension level, and then presumed that he must have said it wrong.
And... you'd bet "a year of salary" that... [something different than he claimed.] I'm guessing that you don't make a salary. Maybe you're self employed and only make profit, or work hourly. I'm presu
Re: (Score:1)
Um, no you/they didn't. I work at an ISP, smaller than Google, and am constantly blocking various attacks.
It was pretty heavily implied that he was speaking about blocking these attacks on GMail. Thankfully, Google hasn't quite achieved the ubiquity needed to interfere with other ISPs' traffic.
Re: (Score:2)
Re: (Score:2)
They could easily have stopped 100% of the attacks. But you're the only one who thinks that means they would have stopped all attacks. Your tag line is scary, I'd hate to think you have to read manuals and operate servers based on what you thought you read. I'm not trying to knock you, I'm just sharing my feelings.
All blargs are blorgs. No blargs have been observed in Fooville since the policy of Bazification was implemented. There are no longer blorgs in Fooville. T/F
Re: (Score:1)
I have an idea (Score:2)
DO we even know at what business(es) or bureau(s) the breach occurred? Every database of logons should contain some intentionally faked entries that can be used to fingerprint the database, just like those imaginary towns that are put on maps to expose copyright dodgers.
Wouldn't give them a dime (Score:5, Insightful)
Either they're in on the theft somehow, or they're a totally unethical company trying to extort people. No trustworthy security vendor would withhold information about sites that are compromised from the site operators.
I think it's just a marketing ploy personally. "You may have already won! Contact us for details ($1.99 a minute)".
Regardless, they're on my list of companies to never do business with in any way. I
Re: (Score:2)
Either they're in on the theft somehow, or they're a totally unethical company trying to extort people.
I would say that if they're extorting people with stolen data, regardless of how they acquired it, they're "in on the theft." They're materially benefiting from it, knowingly, intentionally, and are full accomplices even if they never met the original thief. It is the rare case where they're an accomplice, but not (known to be) a conspirator.
Kaspersky Labs & McAfee (Score:2)
how do we know Kaspersky Labs is legit?
they've got to have the means to do this...
same with McAfee
any in Soviet Russia jokes? (Score:2)