3 ms·

Noob question - What websites are these where such data is published? I never came across any?

chefandy 3y ago
Various darknet fora. Certainly nowhere on clearnet. There are search engines that deal with such things though I'll bet there's a 99:1 ratio of scam to legit. I have no idea how someone world go about validating what they saw.
- judge2020 3y ago
  Validation is likely tied to reputation - such as by showing a sample to an established moderator / community member and them vouching that the data seems real.
- cowsup 3y ago
  In this case, they validated it by: 1. confirming the emails were not already listed in other databases / leaks; 2. going to the actual Discord platform and performing a "Forgot Password" request, entering a stolen email, and seeing if it goes through or not, as Discord confirms if an email exists or not during this flow; 3. contacting Discord.io directly, who confirmed & put out a statement. Other data breaches are harder to verify. Troy Hunt (owner of haveibeenpwned.com) described this in far more interesting ways than I ever could[0], but for each breach, it varies. [0]: https://www.troyhunt.com/heres-how-i-verify-data-breaches/ https://www.troyhunt.com/heres-how-i-verify-data-breaches/
- technion 3y ago
  Until recently, every time a story was run about a leak being "for sale on the dark web", you could visit raid forums or breach forums, both clearnet sites, and note that's where it's for sale.
tamimio 3y ago
I have a directory of most of them, I would not post it under my real identity obviously, but if you happen to be into the cybersec space, definitely you came across some of these sites, there are even sites with latest APT discovered up to this month too.
xcdzvyn 3y ago
Why are all the other replies so mysterious and LARPy? https://discord.io/ https://discord.io/ has been replaced with a termination notice, and they directly mention where the credentials are being sold. Google the name, it's the top result. Leaked credentials are sold on the open internet, on sites indexed by search engines. This isn't some quadruple proxy Anonymous hacker TOR exclusive club. Edit: One better - any time you hear Microsoft, or Google, or Crebs, talking about some new "advanced" "Russian" "APT", 9 times out of 10 it's a kid posting on one of these forums, reselling stale credentials, or a fork of Mirai, or some other totally non-credible threat. This stuff is WAY less cool than people make it seem.
- Sebguer 3y ago
  Because the LARPing is why most security professionals do the job.
  - juanani 3y ago
    [dead]

Various darknet fora. Certainly nowhere on clearnet. There are search engines that deal with such things though I'll bet there's a 99:1 ratio of scam to legit. I have no idea how someone world go about validating what they saw.

judge2020 3y ago
Validation is likely tied to reputation - such as by showing a sample to an established moderator / community member and them vouching that the data seems real.
cowsup 3y ago
In this case, they validated it by: 1. confirming the emails were not already listed in other databases / leaks; 2. going to the actual Discord platform and performing a "Forgot Password" request, entering a stolen email, and seeing if it goes through or not, as Discord confirms if an email exists or not during this flow; 3. contacting Discord.io directly, who confirmed & put out a statement. Other data breaches are harder to verify. Troy Hunt (owner of haveibeenpwned.com) described this in far more interesting ways than I ever could[0], but for each breach, it varies. [0]: https://www.troyhunt.com/heres-how-i-verify-data-breaches/ https://www.troyhunt.com/heres-how-i-verify-data-breaches/
technion 3y ago
Until recently, every time a story was run about a leak being "for sale on the dark web", you could visit raid forums or breach forums, both clearnet sites, and note that's where it's for sale.

tamimio 3y ago

I have a directory of most of them, I would not post it under my real identity obviously, but if you happen to be into the cybersec space, definitely you came across some of these sites, there are even sites with latest APT discovered up to this month too.

xcdzvyn 3y ago

Why are all the other replies so mysterious and LARPy? https://discord.io/ https://discord.io/ has been replaced with a termination notice, and they directly mention where the credentials are being sold. Google the name, it's the top result. Leaked credentials are sold on the open internet, on sites indexed by search engines. This isn't some quadruple proxy Anonymous hacker TOR exclusive club. Edit: One better - any time you hear Microsoft, or Google, or Crebs, talking about some new "advanced" "Russian" "APT", 9 times out of 10 it's a kid posting on one of these forums, reselling stale credentials, or a fork of Mirai, or some other totally non-credible threat. This stuff is WAY less cool than people make it seem.

Sebguer 3y ago
Because the LARPing is why most security professionals do the job.
- juanani 3y ago
  [dead]