4 ms·
I think "hacks" is a pretty strong word here. They're basically just brute forcing accounts with email and password combos that have been leaked from other sour
by jaywalk 7y ago
I think "hacks" is a pretty strong word here. They're basically just brute forcing accounts with email and password combos that have been leaked from other sources.
- Someone1234 7y agoIt is the same headline as the "Did Disney+ get hacked?" stuff the other day. 10m+ credentials were available almost immediately because people re-use username/password combos across every site. That's why I am pro-password managers. Even if they're imperfect, password re-use remains a major active threat (contrast that with a lot of theoreticals against password managers). Around ten of my accounts' information has been leaked (inc. big ones like Adobe). But I don't re-use credentials so aside from an uptake in spam, it has had no impact. Typically these were services I haven't used in years.
- draw_down 7y agoI don’t know about that. “Hack” is an overloaded term, but one of its meanings is to gain unauthorized access. Seems apt.
- michaeloder 7y agoWhy is Ring allowing brute forcing? Individual cameras should be set to only allow logins at least a few seconds apart increasing up to several minutes and perhaps blocking IP addresses with excessive volume. If they're brute forcing Ring's servers an application firewall would catch and block this.
- pgoggijr 7y agoI don't think that the above comment means brute-forcing in the "try a million different passwords in a short time-period" sense, it's referring to finding a list of known password and email combinations and trying just those. I would expect that a few attempts wouldn't trip any brute-force alarms.
- g4k 7y agoEspecially if you use a few thousand proxies.
- SirYandi 7y agoNot actually brute forcing individual ring accounts. They are just using previously leaked combinations
- goles 7y agoThe term for this type of attack is credential stuffing. https://www.owasp.org/index.php/Credential_stuffing https://www.owasp.org/index.php/Credential_stuffing
- grimmfang 7y agoThis comment shouldn't be downvoted. This is the correct term.
- deleted 7y ago[deleted]