2 ms·

It wasn’t from the same system. It was from a botnet. The account credentials were leaked on Tor. Is haveibeenpwned omniscient? Do they know about every breach

It wasn’t from the same system. It was from a botnet. The account credentials were leaked on Tor. Is haveibeenpwned omniscient? Do they know about every breach out there without fail?

mvdtnz 3y ago
A botnet is a system. > Do they know about every breach out there without fail? They know about a lot of them. I'd hazard a guess that at least three quarters of the affected accounts would have been in HIBP, probably far more.
- brvsft 3y ago
  > A botnet is a system. How would you detect that these requests are coming from the same "system?"
- dpkonofa 3y ago
  A botnet is not a single system. It is a network of multiple compromised computers or devices, in all kinds of locations. Each piece of a botnet could be in a different country or even city. HIBP only knows about breaches that are made public. Based on the current evidence, this was not a breach that was made public. It was a breach being sold.
  - mvdtnz 3y ago
    [flagged]
    - ziddoap 3y ago
      Unnecessarily condescending comment. You said: >Other than allowing at least 14,000 login attempts from the same system But from 23andMe's end, they didn't see these login attempts originating from a single system because it was from several locations, with different user-agents, fingerprints, etc. How do you propose they were to identify these various computers to be part of the same botnet? If you have a reliable way to do so, many people would pay you large amounts of dollars for that service.
- velavar 3y ago
  Working in fraud prevention and I would love to know how to detect a botnet system, beyond the usual velocity checks. A decade of working in this space and I haven't found a reliable, fail-safe way to do this. Genuinely interested to know if there's a suggestion.
peddling-brink 3y ago
Watching failed password attempts across the board is a simple metric. Correlate that with the ips responsible for the sudden increase and you have a starting point for your investigation and remediation.

It wasn’t from the same system. It was from a botnet. The account credentials were leaked on Tor. Is haveibeenpwned omniscient? Do they know about every breach out there without fail?

mvdtnz 3y ago

A botnet is a system. > Do they know about every breach out there without fail? They know about a lot of them. I'd hazard a guess that at least three quarters of the affected accounts would have been in HIBP, probably far more.

brvsft 3y ago
> A botnet is a system. How would you detect that these requests are coming from the same "system?"
dpkonofa 3y ago
A botnet is not a single system. It is a network of multiple compromised computers or devices, in all kinds of locations. Each piece of a botnet could be in a different country or even city. HIBP only knows about breaches that are made public. Based on the current evidence, this was not a breach that was made public. It was a breach being sold.
- mvdtnz 3y ago
  [flagged]
  - ziddoap 3y ago
    Unnecessarily condescending comment. You said: >Other than allowing at least 14,000 login attempts from the same system But from 23andMe's end, they didn't see these login attempts originating from a single system because it was from several locations, with different user-agents, fingerprints, etc. How do you propose they were to identify these various computers to be part of the same botnet? If you have a reliable way to do so, many people would pay you large amounts of dollars for that service.
velavar 3y ago
Working in fraud prevention and I would love to know how to detect a botnet system, beyond the usual velocity checks. A decade of working in this space and I haven't found a reliable, fail-safe way to do this. Genuinely interested to know if there's a suggestion.

peddling-brink 3y ago

Watching failed password attempts across the board is a simple metric. Correlate that with the ips responsible for the sudden increase and you have a starting point for your investigation and remediation.