Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/17/2019
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum

Data appears to be from multiple breaches over past few years, says researcher who discovered it.

A folder with over 12,000 files containing nearly 773 million email addresses and over 21 million unique passwords from numerous previous data breaches — some potentially dating back to 2008 — has been posted online in another massive leak of credential data.

Security researcher Troy Hunt discovered the 87 GB worth of data on cloud storage service Mega last week and has uploaded it to his Have I Been Pwned (HIBP) service, where individuals can verify if their email addresses are on the list. The leaked passwords, meanwhile, have been published on Pwned Passwords, a site that Hunt maintains to let people check whether their passwords have been exposed in data breaches.  

Some 140 million email addresses and about half of the just-leaked passwords are new, meaning the data has not been previously published on HIBP or the compromised passwords site. With the new data, Pwned Passwords now contains more than half-a-billion leaked passwords.

In a blog Thursday, Hunt described the folder he discovered on Mega as containing data from what appears to be over 2,000 previously breached and dehashed databases. The data appears to be from breaches between 2008 and 2015. But it is possible that at least some of leaked data was not involved in a data breach at all, Hunt said.

It's unclear who might have compiled the list of breached databases and put them in the file that was leaked on Mega. Attackers commonly use such datasets to carry out automated "credential stuffing" attacks where they try breaking into enterprise accounts using combinations of previously compromised email and password data.

The file on Mega has since been removed. But, according to Hunt, the data is currently being advertised for sale in a popular hacker forum. Hunt is calling the breach "Collection #1" after the name given to the root folder containing the files.

The Collection #1 breach is among the biggest involving passwords and email addresses. Other similarly massive compromises include one recently at Marriott International, in which 380 million records were exposed; multiple breaches at Yahoo, which ended up exposing all 3 billion of its user accounts; and one at Adult Friend Finder, which impacted 412 million accounts.

Such breaches keep highlighting the weakness of password-only account protection models and the need for strong authentication mechanisms. A new report from MarketsandMarkets shows concerns over data breaches and regulations are driving demand for multifactor authentication technologies. The market for such tools and services is projected to grow by over 15.5% annually over the next few years to top $12 billion by 2022, according to the analyst firm.

Bimal Gandhi, CEO at Uniken, says credential leaks pose a multifaceted threat for organizations. The fact that people often reuse passwords across personal and office accounts exposes organizations to attack even if their own sites and user credentials haven't been compromised.

"An attacker can replay your customers’ known credentials from other sites against you on the reasonable chance that those credentials will also allow them access to your applications," Gandhi says. Attackers have a broad array of methods to attack organizations via both the mobile and the browser using harvested credentials, he says.

Credential data is also invaluable for phishing, says Tim Erlin, vice president of product management and strategy at Tripwire. There has been a recent increase in the use of compromised credentials in email extortion attempts, he says.

The fact that at least some of the leaked credential data is old makes it relatively less of a threat to organizations that regularly change passwords. But the potential for misuse should not be underestimated, Erlin says. "People often change personal passwords far less frequently than corporate credentials, meaning that there may very well be valid data present," he added.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
reuben_matthews
50%
50%
reuben_matthews,
User Rank: Apprentice
2/6/2019 | 10:24:47 PM
Download the collections
Download HIBP Collections #1 and #2 - 5: https://tinyurl.com/y9o3d2ug
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/18/2019 | 6:44:09 AM
Selected note
One comment - any self-respecting computer user who has kept the same password(s) since 2008 (now 11 years ago) almost deserves to be hacked. 
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20288
PUBLISHED: 2021-04-15
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associa...
CVE-2021-31229
PUBLISHED: 2021-04-15
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte constant.
CVE-2021-28548
PUBLISHED: 2021-04-15
Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploi...
CVE-2021-28549
PUBLISHED: 2021-04-15
Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploi...
CVE-2021-30209
PUBLISHED: 2021-04-15
Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions.