Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/17/2019
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum

Data appears to be from multiple breaches over past few years, says researcher who discovered it.

A folder with over 12,000 files containing nearly 773 million email addresses and over 21 million unique passwords from numerous previous data breaches — some potentially dating back to 2008 — has been posted online in another massive leak of credential data.

Security researcher Troy Hunt discovered the 87 GB worth of data on cloud storage service Mega last week and has uploaded it to his Have I Been Pwned (HIBP) service, where individuals can verify if their email addresses are on the list. The leaked passwords, meanwhile, have been published on Pwned Passwords, a site that Hunt maintains to let people check whether their passwords have been exposed in data breaches.  

Some 140 million email addresses and about half of the just-leaked passwords are new, meaning the data has not been previously published on HIBP or the compromised passwords site. With the new data, Pwned Passwords now contains more than half-a-billion leaked passwords.

In a blog Thursday, Hunt described the folder he discovered on Mega as containing data from what appears to be over 2,000 previously breached and dehashed databases. The data appears to be from breaches between 2008 and 2015. But it is possible that at least some of leaked data was not involved in a data breach at all, Hunt said.

It's unclear who might have compiled the list of breached databases and put them in the file that was leaked on Mega. Attackers commonly use such datasets to carry out automated "credential stuffing" attacks where they try breaking into enterprise accounts using combinations of previously compromised email and password data.

The file on Mega has since been removed. But, according to Hunt, the data is currently being advertised for sale in a popular hacker forum. Hunt is calling the breach "Collection #1" after the name given to the root folder containing the files.

The Collection #1 breach is among the biggest involving passwords and email addresses. Other similarly massive compromises include one recently at Marriott International, in which 380 million records were exposed; multiple breaches at Yahoo, which ended up exposing all 3 billion of its user accounts; and one at Adult Friend Finder, which impacted 412 million accounts.

Such breaches keep highlighting the weakness of password-only account protection models and the need for strong authentication mechanisms. A new report from MarketsandMarkets shows concerns over data breaches and regulations are driving demand for multifactor authentication technologies. The market for such tools and services is projected to grow by over 15.5% annually over the next few years to top $12 billion by 2022, according to the analyst firm.

Bimal Gandhi, CEO at Uniken, says credential leaks pose a multifaceted threat for organizations. The fact that people often reuse passwords across personal and office accounts exposes organizations to attack even if their own sites and user credentials haven't been compromised.

"An attacker can replay your customers’ known credentials from other sites against you on the reasonable chance that those credentials will also allow them access to your applications," Gandhi says. Attackers have a broad array of methods to attack organizations via both the mobile and the browser using harvested credentials, he says.

Credential data is also invaluable for phishing, says Tim Erlin, vice president of product management and strategy at Tripwire. There has been a recent increase in the use of compromised credentials in email extortion attempts, he says.

The fact that at least some of the leaked credential data is old makes it relatively less of a threat to organizations that regularly change passwords. But the potential for misuse should not be underestimated, Erlin says. "People often change personal passwords far less frequently than corporate credentials, meaning that there may very well be valid data present," he added.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
reuben_matthews
50%
50%
reuben_matthews,
User Rank: Apprentice
2/6/2019 | 10:24:47 PM
Download the collections
Download HIBP Collections #1 and #2 - 5: https://tinyurl.com/y9o3d2ug
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/18/2019 | 6:44:09 AM
Selected note
One comment - any self-respecting computer user who has kept the same password(s) since 2008 (now 11 years ago) almost deserves to be hacked. 
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2020-10817
PUBLISHED: 2020-03-27
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
CVE-2020-10952
PUBLISHED: 2020-03-27
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.