7 ms·
Data breach exposes 184M passwords, likely captured by malware
- ken47 1y agoThat’s weird. Why is the data from the unconnected databases of test companies in a single place?
- entropie 1y agoIts in the article > Based on his analysis, Fowler determined the data was captured by some kind of infostealer malware. A popular tool used by cybercriminals, an infostealer is designed to grab usernames, passwords, and other sensitive data from breached sites and servers.
- Stagnant 1y ago>from breached sites and servers. That part is just incorrect and doesn't make any sense. Infostealers typically grab the credentials that a victim of a malware has saved in browser password managers.
- FridayoLeary 1y agoLink to the orginal report: https://www.websiteplanet.com/news/infostealer-breach-report/#link=%7B%22role%22:%22standard%22,%22href%22:%22https://www.websiteplanet.com/news/infostealer-breach-report/%22,%22target%22:%22%22,%22absolute%22:%22%22,%22linkText%22:%22report%20published%20yesterday%22%7D https://www.websiteplanet.com/news/infostealer-breach-report... It's frustrating that he offers no information about where the data was taken from, or any way of checking if my passwords are compromised.
- janderson215 1y agoIIRC, it’s common to not throw a vendor under the bus if they properly disclose the breach so as to not discourage reporting of breaches. Healthier for the unfortunate ecosystem.
- gabeio 1y agoThis is not a “breach” the article hints at a trojan which scrapes or exfiltrates credentials off of user computers not a singular provider’s database.
- indigodaddy 1y agoWould haveibeenpwned be privy to this breach?
- HelloUsername 1y agoYour link is a bit weird (you can delete everything after '-report') Also, strangely no discussion at the time: https://news.ycombinator.com/item?id=44062726 https://news.ycombinator.com/item?id=44062726
- FridayoLeary 1y agoIt's copied straight from zdnet. Too late for me to change it now. Maybe it wasn't discussed becuase it's so vague.
- deleted 1y ago[deleted]
- jmclnx 1y agoThe only one I kind of care about is Google, I guess I will need to change that PW. And the google email is pretty much ignored by me. Of the list, I only have a Facebook PW, but I tried to delete that ID years ago without luck. I have not be in it in ages. If some here gets that PW, please delete my Facebook Account :)
- entropie 1y agoIf I understand correctly (correct me if iam wrong) there were no data breachs on any servers. Its accumulated data from 3rdparty "infostealer malware".
- deleted 1y ago[deleted]
- SoftTalker 1y agoVery vague report.
- hattar 1y ago> Google, Microsoft, Apple, Facebook, Instagram, and Snapchat, among others, were stored in a file. The database also contained credentials for bank and financial accounts, health platforms, and government portals. I'd love a source that at least gave the full list of compromised services.
- Stagnant 1y agoThe data appears to be from malware victims, not from compromised services.
- tedunangst 1y agoHere: ""
- explain 1y ago> The problem? The file was unencrypted. No password protection. No security. Just a plain text file with millions of sensitive pieces of data. > Based on his analysis, Fowler determined the data was captured by some kind of infostealer malware. Then the mere exposure of the file and whether it was encrypted is irrelevant. The data was already stolen, the damage was already done.
- deleted 1y ago[deleted]
- darth_avocado 1y agoIf unconnected services are being breached, the likelihood of this breach coming from some sort of a password manager is high. If that’s true, the recklessness would be beyond comprehension.
- forgotTheLast 1y ago>Based on his analysis, Fowler determined the data was captured by some kind of infostealer malware. A popular tool used by cybercriminals, an infostealer is designed to grab usernames, passwords, and other sensitive data from breached sites and servers.
- kevin_thibedeau 1y agoThe sites aren't being breached. They're intercepting passwords and PII on the user's side.
- OutOfHere 1y agoThe most likely source is a web browser's password manager.
- YetAnotherNick 1y agoThis is a breach of some illegal infostealer data. I don't know why this information wasn't the first line. The data was already breached. The irony is that this would likely "unbreach" the data breach as the companies would likely lock the account.
- downrightmike 1y agoProbably legal info dealer similar to https://npdbreach.com/ https://npdbreach.com/
- tedunangst 1y agoYou get more clicks for every tech company you name in the headline. Something like clicks = log(sum(market cap(companies))).
- jxjnskkzxxhx 1y ago[flagged]
- kevin_thibedeau 1y agoDon't worry. The criminals will freely use your account as a CSAM relay.
- jxjnskkzxxhx 1y ago[flagged]
- codedokode 1y agoGiven that Facebook requires now a face 3D scan to sign up, it is the correct choice.
- frizlab 1y agoDupe of https://news.ycombinator.com/item?id=44062726 https://news.ycombinator.com/item?id=44062726
- metadat 1y agoNote: Submissions without discussion aren't considered dupes on HN. If another article is more interesting or higher quality than the submission receiving comments, it is helpful and appreciated to provide the link in a comment and/or email the mods a link change proposal. In this case, the alternate link is informative and worth a look: https://www.websiteplanet.com/news/infostealer-breach-report/ https://www.websiteplanet.com/news/infostealer-breach-report... Cheers.
- deleted 1y ago[deleted]
- frizlab 1y agoOh I did not know that. Thanks!
- max_ 1y agoWould passwords ever be leaked? I thought standard practice was now to never store passwords, then use hashes & salts instead?
- forinti 1y agoYou can brute force a hashed password if it's short or you want it badly enough.
- tsimionescu 1y agoIt depends what you mean by "leak". If someone was running keyloggers and collecting passwords and they published them, that can also be a leak, and it doesn't matter how the passwords were stored. And not just keykoggers, but this also applies to phsihing, man-in-the-middle attacks, or other similar ways of getting passwords from end-users.
- to11mtm 1y ago'Standard practice'. And yet there are plenty of shops that will either symmetrically encrypt passwords (at best, the email address or username is used as an IV), Log passwords stupidly [0], have a piss-poor integration where "Oh we have base64 encode the actual XML payload in the soap service and tag it '<Encrypted>`, ship it!" [1], or are just plain too budget strapped to replace the 'forgot password' functionality that told a user their password vs forcing a reset. And I think that last point hits it well. i.e. at least a plurality of those horrors were done before standard practices evolved to the current state, but nobody can get the budget/time to fix it. (And, I will say, having 'fixed' more than one of the above cases, it definitely has a user impact which can lead to the folks approving the work having an uncomfortable conversation with customers. B: "We forced a password reset to update security standards" C: "Wait so your security standards were subpar!!!" [2] [0] - Example; logging invalid attempts, but wait a user only failed because they did TypoEmailAddress@gmailcom instead of TypoEmailAddress@gmail.com. [1] - Yes. This was a thing I got to deal with once. What's even more annoying is that it was a SOAP service so of course the pattern eliminated most of the potential usefulness of a SOAP service. [2] - That said, usually the person making this complaint, is the person who historically was e-mailing their account rep to give them their password, vs using the 'correct flow but bad implementation' password reset we had in place as a stopgap.
- cwoolfe 1y agoThat explains the random 2FA request I got the other day.
- galaxytachyon 1y agoYou too? I got the same. But then again, my account is constantly under attack anyway. At least previously they were smart enough to not trigger 2FA. Now even the incompetents are trying.
- jjbinx007 1y agoArticle mentions infostealers. My guess would be a rogue browser extension but it could have just as easily been malware.
- logic_node 1y agoThese big breaches are alarming, reminds me of the recent AMOS malware incident that hijacked thousands of legit sites to target Mac users: https://www.squaredtech.co/2800-websites-hijacked-amos-malware-to-mac-users https://www.squaredtech.co/2800-websites-hijacked-amos-malwa...
- Nerd_Nest 1y agoTotally agree, it's getting scary out there. The AMOS attack really shows how attackers are stepping up their game. If even legit websites can be weaponized like that, what’s actually safe anymore?
- kevin_thibedeau 1y agoStop using federated login services and maintain unique accounts per service. Blacklist any service that doesn't provide their own account management.
- geoffpado 1y agoWhat? You’d rather have more, smaller rando services handling your passwords than a few big names that have the resources to put into at least paying lip service to security?
- 6510 1y agoWould you also need a separate email address for each account? I think most mailboxes support a recovery email address and some require one for billing. Is truly separate accounts for everything really doable?
- jay_kyburz 1y agoI don't know why you would need a separate email address. I would think the password is the important part.
- WrongOnInternet 1y ago[dead]
- lisper 1y ago> Fowler said he didn't know if the database was created legitimately and then accidentally exposed or intentionally used for malicious reasons. Seriously? In what possible world can a collection of plain-text login credentials exist for any legitimate purpose?
- arccy 1y agoyour password manager needs them in decryptable form...
- flipbrad 1y agoLaw enforcement / national security. E.g. https://www.gov.uk/government/publications/intelligence-services-retention-and-use-of-bulk-personal-datasets/intelligence-services-retention-and-use-of-bulk-personal-datasets-code-of-practice https://www.gov.uk/government/publications/intelligence-serv... Although I can anticipate what you'll say...
- galaxytachyon 1y agoThose on HN are considered extremely tech-savvy and security aware and yet we are still concerned about our accounts getting compromised like this. What can a random user like our moms or siblings do? They won't even notice these kind of attack. It is such a pathetic state of affair where massive leaks like these are expected. I contend this is a result of lax regulation and lack of consequences. In healthcare, patient data are locked down so hard even people who need to work with them have problems getting to them. It is because of regulations. Everything is traceable, recorded, and maintained to the strictest standards possible. It costs a huge amount of money but as a result, we don't see many serious breaches. Compared it to fintech and regular tech services, these guys make fuckton of profits and yet suffer almost no regulations. What a joke.
- exiguus 1y agoMaybe they can't. But actually, you can install them a password manager and let them generate random password. Setup with them 2fa (FreeOTP or something). And change with them every password when you are at home for chrismas. Also, when they now found themself on have i been powned, they have a bigger problem, because they have likely malware on the phone or computer.
- jsnell 1y agoWhat regulation are you proposing? Forcing all computers to be locked down so hard that users can't install malware?
- 6510 1y agoWe would have to go outside to find dopamine. It wouldn't be safe. People would die. edit: I remember thinking in the 90's that it was weird as hell that the operating system sits in the same folder tree as the users documents, applications live there too! What a concept? Like keeping your socks in the same drawer as your bills and plumbing tools. Spare tire in the kitchen. Lawn mower under the bed.
- galaxytachyon 1y agoMaybe we can start with heavy penalties for whoever responsible for these breaches? The users are irresponsible, but at the higher levels, the company can afford to tighten access and guard their data better. Would these companies leak their own business critical documents? No. So why can't they be forced to treat sensitive customer's data the same way?
- ycombinatrix 1y agoWhere can I download the dump?
- xyst 1y ago> I highly recommend knowing what sensitive information is stored in your email account and regularly deleting old, sensitive emails that contain PII, financial documents or any other important files. or begin to encrypt e-mails with S/MIME or GPG. Keep private keys on lockdown and never distribute to web mail clients. Password breached or brute forced somehow? Great, good luck getting through 2FA that uses OTP. Oh the 2FA used for e-mail account was broken? Now you are in. Great, now that you are in. All my e-mails are encrypted on server's disk with a mix of S/MIME and GPG. Good luck getting my private keys that I only keep on my local machine and secured behind additional methods of authentication (ie, fingerprint and password authN). Defense in depth, folks.
- XorNot 1y agoEmails sent to you aren't going to be encrypted.
- anonymousDan 1y agoIs there any well known tool that can be used to scan an email account for PII (like the tools we have for scanning for confidential info in GitHub repos)?
- tredre3 1y ago> Great, now that you are in. All my e-mails are encrypted on server's disk with a mix of S/MIME and GPG. So what? Hiding your old email content might be valuable from a privacy point of view but if you cared about that you'd just delete them from the server to begin with. What a hacker cares about is the ability to receive new emails (password recovery). Those emails are still sent to you in clear text. He might also care about getting a list of past senders (to know what accounts you might have) and that info isn't encrypted by GPG, only the content.
- KennyBlanken 1y agoI don't know which is worse - that this "researcher" didn't turn over the dump to an org like haveibeenpwned so that any good whatsoever would come of this, or that he thinks he can "disclaim liability." > I disclaim any and all liability for any and all actions that may be taken as a result of this disclosure.
- ryandrake 1y agoDon’t you know? If you don’t want to be liable for something you’ve done, all you have to do is “disclaim” it! It’s That One Neat Trick That Lawyers Don’t Want You To Know!
- areyourllySorry 1y agohaveibeenpwned has previously denied data without a clear source, or until recently data sourced from malware.
- fuddy 1y agoI'm a but puzzled by their advice.. Given the variety, how do we know this data isn't from a password manager compromise?
- throw10920 1y agoYou're right - thee fact that Google and Apple passwords were both compromised (given how insanely good their internal security is) strongly suggests either malware or password manager compromise.
- loa_in_ 1y agoGiven that it's likely from an infostealer malware it might be from user internet browser profile password databases.
- XorNot 1y agoSo...where's the responsible disclosure here? A file of apparently breached account credentials was found, has been taken out of public access but was likely from malware in the first place and spent some time being publicly exposed....so, is who was in it going to be communicated to someone?
- tredre3 1y ago> To check on the validity of the information, Fowler emailed many of the people listed in the file and told them that he was researching a data breach. Several of the individuals confirmed that the records contained valid account passwords and other data. Do security researchers really contact people willy-nilly and ask them to confirm their passwords? Then they lecture us about the dangers of social engineering?
- Rychard 1y agoIf they already have your password (i.e. it has been compromised) there is no social engineering taking place. In fact, they're doing the honorable thing and not simply trying the credentials to see if they work.
- Defletter 1y agoI think what they're saying is that someone could pretend to be a researcher and ask for passwords to confirm that they match what was found in some fictional breached data.
- OneMorePerson 1y agoIf I'm reading it right the part about them confirming that the records contained the password implies that they were given the relevant record and then they confirmed it was accurate, not that they were just asked "hey what is your password"
- TruffleLabs 1y agoFor clarity this is what was said about emailing and confirming authentication of data: "To confirm the authenticity of the data, I messaged multiple email addresses listed in the database and explained that I was investigating a data exposure that may have involved their information. I was able to validate several records as these individuals confirmed that the records contained their accurate and valid passwords."
- crq-yml 1y agoYesterday, the operators of Artfight, the yearly art trading game, reported a breach that affected perhaps a few hundred people(an XSS attack through a news post comment that scooped up autofill information). Users were panicked, in large part because they never hear about breaches affecting them. I believe the industry should work towards mandating communication on these incidents instead of maintaining the charade that nothing is happening. This needs to come through one of legislation or labor action.
- hyperman1 1y agoArtfight seems to be USA based, but has a GDPR aware privacy policy. If they follow the GDPR, they are already legally required by Art. 33 to do this.
- notepad0x90 1y agoThere should be a suite of laws globally that include basic common-sense things like requiring public disclosure of compromised passwords.
- tmaly 1y agoI am in the US. I keep getting notices in the post mail that my or my families medical data was leaked. How is this not a HIPPA violation?