Slashdot Mirror
Massive Phishing Campaign Hits Multiple Email Services
nandemoari writes "It seems as if the massive phishing campaign reported yesterday was not specific to Hotmail, as was initially believed. According to a report by the BBC, many Gmail and Yahoo Mail accounts have also been compromised. Earthlink, Comcast, and AOL were also affected. While the source of the latest attacks has not been determined, many are pointing to the same bug that claimed at least 10,000 passwords from Microsoft Windows Live Hotmail. Microsoft has done their part in blocking all known hijacked Hotmail accounts and created tools to help users who had lost control of their email. An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.' On their end, Google responded to the attacks by forcing password resets on the affected accounts."
An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.'
That's amazing. I've got the same combination on my luggage.
With an extra digit for security! ;-)
-- Boycott Shell
That's the kind of thing an idiot would have on his luggage!
See, that's why they got their accounts hacked. I use 67890 on all my accounts so I'm sure they'll never get hacked :)
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
$ grep gmail pwd.txt | wc -l
25
012345
This all sounds a bit....phishy to me.
"Our goal each year should be to increase the number of goals we set for ourselves!"
It's actually spelled "knew."
All of the stories seem to be very short on details. How did the scheme work? How were they getting users to their site instead of Hotmail? Was it something stupid, like a spam email with a link? Or was it DNS forgery or something more subtle?
Everyone is reporting that it was a particularly big haul for a phishing campaign, but nobody seems to be reporting what the deal was, or why this was more successful than your typical, run-of-the-mill phishing attack.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
"Remind me to change the password on my luggage!"
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
*too
I know I'm preaching to the church but a good way to make a password is to make up a sentence and take each first letter, convert some to capitals and numbers and you will never ever forget it.
It is like a walk in the park. iilawitp iiLawitp iiL4wi7p voila!
People with "12345" or similar passwords should get their own internet, where they would be allowed to share lolcatz and powerpoint chains, play with their purple internet buddy, and zap those cute webmonkeys on banners without hurting themselves. Alternatively, maybe the webmail providers should set more strict rules for the passwords.
I get these phishy emails all the time but I look at the actual URL and see it is not actually coming from the service or agency. One time I saw it vectored to a site which I did a whois lookup of the domain name and it listed the name, address, and phone number of someone in southern Calif (not China). However, the scary thing is what happens if these people figure a way to "scoop" or "fraud" (whatever) the URL displayed on bottom of my browser window and in the address bar? But on identity theft they say most of it was done with basic skills like going through someone's trash or bank employees (72% of banks report employees committed fraud).
mfwright@batnet.com
You caught "knew" but missed "too" and "it's really fucking stupid to post your e-mail address in the clear".
In other words, whoosh.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
If your password is even remotely similar to those listed, you should change it.
Top 20 most common passwords:
123456 - 64
123456789 - 18
alejandra - 11
111111 - 10
alberto - 9
tequiero - 9
alejandro - 9
12345678 - 9
1234567 - 8
estrella - 7
iloveyou - 7
daniel - 7
000000 - 7
roberto - 7
654321 - 6
bonita - 6
sebastian - 6
beatriz - 6
mariposa - 5
america - 5
From 2 links deep (http://www.acunetix.com/blog/websecuritynews/statistics-from-10000-leaked-hotmail-passwords/)
So Unix is 40 years old, and knew at birth what Microsoft still hasn't figured out. Its a bad idea to store unencrypted passwords. Got it.
No, I don't remember your name. But the memory mapped screen on a TRS80 from 1977 is from 15360 to 16383 if that helps.
Whats the fuss here? This sort of social engineering has been going on for a long time whether it is a mail server or ebay. I'm not saying the facts are not true ... but I'd bet this has been going on for years.
As a hypothetical, since length is really what matters, I wonder how long it would take before something like
01234567890123 or even 0123456789
would get guessed?
My experience is that short passwords (less than 7 chars) are the ones that get guessed, even if they are "good" ones that have a mix of letters, number, and punctuation.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
The point to get across is that no (reputable) service or agency will ever, ever send you an email asking you to fill in and email back ANYTHING anymore.
If I were to ever get a legitimate email from my bank or credit card asking for personal information, I would call them as ask them WTF they were doing.
My estimate is that your average stupid phishing victim is just as likely to reply with their personal information regardless of whether the email is obviously fake.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Is why it's a "leak" if phishing was the method used to acquire the list. Or why it's still referred to as a "bug". Some sort of bug in the Human OS, right near the gullibility logic loop?
...many are pointing to the same bug that claimed at least 10,000 passwords from Microsoft Windows Live Hotmail.
Phishing is not a "bug". A bug would mean this was some Microsoft developer's fault. There is nothing a developer can do to prevent someone from conning someone else into giving up their password.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
"it's really fucking stupid to post your e-mail address in the clear".
janusofzeal@gmail.com
The PC Pro article linked to in the summary misquoted its own source. It claims that "12345" is the most common password, however the source it links to actually shows "123456" as the most common password. "12345" doesn't even make the list.
There really aren't that many users using those "common" passwords. Only 82 users use the top two passwords, which make up only 0.8% of all the passwords in the list. Only 1.56% of the accounts used a top-10 password.
The rest of the information at the Acunetix link is quite interesting, though. The evaluation determines that only 6% of all the passwords used a combination of alpha, numeric, and other characters.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
Affected users have been placed on an isolated network where they can't do anything but post whinges about Microsoft and Apple to a web server that runs SSL using a self-signed certificate and actually follows the RFCs.
Where are "sex", "secret", and "god"? Even love only makes a cameo at #17 in "iloveyou"
Apparently keyboard pattern passwords hold up better.
Perhaps this is the reason that sometime during lunch, my employer (A well known NNSA National Laboratory in New Mexico) blocked access to all things Google, including Gmail, Blogspot, and the Google search engine itself?
I know gmail has amazing spam filters, but even I wouldn't tempt fate like that.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
This might be related, seems you can generate emails that appear to come from Google's own mail servers by altering a regular old URL. From there it's a short step to include a phishing site in the body of the email asking the user to verify his account details, or whatever. Maybe other webmail services have similar links.
I saw the Hotmail version of this phishing mail yesterday, it looks like it comes from an @live.ca address and asks the receiver to verify his account details at a link included in the email. The link is disguised to look like a valid mail.live.com link, but of course it goes to a phishing site instead.
Murphey's fighting Occam, and we're in the stands.
I know gmail has amazing spam filters, but even I wouldn't tempt fate like that.
I've had slashdot display my email address in clear text in every comment i've made here for years now. I've never received any mail to tanguyr+slashdot@gmail.com (gmail lets you add a "+whatever" to your email), and i very rarely get a spam message in my inbox. These days, with so much email being spam, i don't think that being coy about your email address is really a valid strategy anymore. You've got to give it out to use it, and who knows what the heck the people you give it out to are doing with it?
#!/usr/bin/english
Correct spelling? From GNU-tards who could communicate better with a real life klingon than they could with a fellow human? No wonder gmail got hacked, if you want software that works you have to actually PAY someone for it! Just goes to show that access to the source code gives hackers the ability to find holes and exploit them.
012345
010101
The people who use passwords like 12345 deserve this. maybe it will finally teach them the lesson(s) that their smarter family members and friends have been trying to get through their thick skulls for years.
According to TFA,these were collected by phishing. OTOH 12345 could be "brute forced" by mere human guess-work. sheesh. My eight letter password could be brute-forced by machine in very short order, but it's all relative.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
Http://www.tntshoes.com
Specializing in retro Jordans, Nike SB, Nike Air Force 1.Check out our line at You can check out our FULL line at Sole on Ice 475 W. San Carlos Street in Downtown San Jose, Ca. 95113 Sole on Ice is a Consignment center specializing in bringing you the elite lines through out the past two decades.All shoes are 100% authentic. We do not sell, accept, or deal with fakes or factory variants.If interested in selling through consignment please contact us
OUR WEBSITE:
YAHOO:shoppertrade@yahoo.com.cn
MSN:shoppertrade@hotmail.com
Http://www.tntshoes.com
Indeed.