Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

'Password Recovery' Services May Be Hackers for Hire

Services that promise to help you find your lost passwords may make their living by cracking the passwords of others, IBM researcher says

You've seen the ads on the Web: A service provider promises to "recover" lost passwords from your Webmail services, even if you've forgotten the log-on information or use multiple services. But if you look closer, you may notice something else: Those same services can also help you crack others' Webmail accounts.

Gunter Ollmann, chief security strategist at IBM's Internet Security Systems unit, published a blog about the password cracking services on Monday, after doing some research on these legitimate-looking services. What he found might make you think twice about using Webmail services -- or at least think more carefully about what data you put into your Webmail messages.

Webmail services such as Gmail and Hotmail are widely used as a quick, low-cost alternative to more sophisticated email services offered by ISPs or corporations, Ollmann observes. Many users have at least one Webmail account -- and sometimes more -- that they use for personal messages when they are on the Web and can't get easy access to their full-function email accounts.

But Webmail accounts are not particularly secure, Ollmann warns. For between $300 to $600, a hacker can find a full suite of Webmail cracking tools on the 'Net, complete with the ability to do brute-force "guessing" of simple passwords and enhanced tools for penetrating the CAPTCHA authentication methods used on Webmail services, he notes.

And now those capabilities are being turned into hack-for-hire services, Ollmann says. Such services have been around for about two years, he notes, but today's CAPTCHA-breaking methods have become so effective that for about $100, the service provider can not only promise to give you the password to a specific Webmail account, but it can also promise to give you subsequent passwords if the legitimate owner should change passwords.

"These services can essentially give you a 'lifetime service contract' that you will always know the password to that account," Ollmann said.

As storage becomes less expensive, many Webmail services are offering larger and larger mailbox archives, allowing users to store messages for years at a time, Ollmann notes. And because they focus on simplicity and low cost, these services generally don't offer an encryption option, so anyone with the right password can read all the messages in the archives.

Some password recovery services come right out and offer a variety of applications for their services, such as the ability to investigate the activities of a spouse who's suspected of cheating. When managers leave a company, they often leave Webmail as a forwarding address, which may open them up to scrutiny by those who would like to know who they're taking with them, Ollmann observes.

Because of the relative simplicity of Webmail services, there isn't much that users can do to protect themselves from these hack-for-hire services, Ollmann says. "The best thing you can do is to use strong passwords, which makes them more difficult to crack," he says. Most law enforcement agencies aren't investigating the hack-for-hire services because they tend to target only individual users for a few hundred dollars, "which is barely a blip on the screen for law enforcement," Ollmann observes.

When Webmail services first came on the scene, some enterprises experimented with blocking or filtering them, Ollmann stated. Today, however, it would be difficult for any company to set a policy against using Webmail services, because such services are so broadly used and because there is no easy way to enforce the policy, he says.

"Your best bet is to educate your users about the vulnerabilities of these services, and discourage them from using their Webmail accounts for transmitting company information or other sensitive data," Ollmann says. Users also should stay away from the services themselves, many of which are based in Russia or southeast Asia and can be recognized by the stilted English grammar in their service descriptions, he notes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • IOActive
  • MessageLabs Ltd.
  • StillSecure

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Data Leak Week: Billions of Sensitive Files Exposed Online
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
    Intel Issues Fix for 'Plundervolt' SGX Flaw
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    The Year in Security: 2019
    This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-5252
    PUBLISHED: 2019-12-14
    There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
    CVE-2019-5235
    PUBLISHED: 2019-12-14
    Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
    CVE-2019-5264
    PUBLISHED: 2019-12-13
    There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
    CVE-2019-5277
    PUBLISHED: 2019-12-13
    Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
    CVE-2019-5254
    PUBLISHED: 2019-12-13
    Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...