Slashdot Mirror
Massive Phishing Campaign Hits Multiple Email Services
nandemoari writes "It seems as if the massive phishing campaign reported yesterday was not specific to Hotmail, as was initially believed. According to a report by the BBC, many Gmail and Yahoo Mail accounts have also been compromised. Earthlink, Comcast, and AOL were also affected. While the source of the latest attacks has not been determined, many are pointing to the same bug that claimed at least 10,000 passwords from Microsoft Windows Live Hotmail. Microsoft has done their part in blocking all known hijacked Hotmail accounts and created tools to help users who had lost control of their email. An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.' On their end, Google responded to the attacks by forcing password resets on the affected accounts."
An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.'
That's amazing. I've got the same combination on my luggage.
I always new that Gmail users were not to bright. If you want to respond, please carbon me at MyLongNickName@gmail.com. Thanks.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
With an extra digit for security! ;-)
-- Boycott Shell
That's the kind of thing an idiot would have on his luggage!
See, that's why they got their accounts hacked. I use 67890 on all my accounts so I'm sure they'll never get hacked :)
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
$ grep gmail pwd.txt | wc -l
25
good thing i got lucky and mine wasnt! www.viagra.com
012345
This all sounds a bit....phishy to me.
"Our goal each year should be to increase the number of goals we set for ourselves!"
All of the stories seem to be very short on details. How did the scheme work? How were they getting users to their site instead of Hotmail? Was it something stupid, like a spam email with a link? Or was it DNS forgery or something more subtle?
Everyone is reporting that it was a particularly big haul for a phishing campaign, but nobody seems to be reporting what the deal was, or why this was more successful than your typical, run-of-the-mill phishing attack.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
"Remind me to change the password on my luggage!"
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
I know I'm preaching to the church but a good way to make a password is to make up a sentence and take each first letter, convert some to capitals and numbers and you will never ever forget it.
It is like a walk in the park. iilawitp iiLawitp iiL4wi7p voila!
are attending a you to join the Population as well another troubled Preferrably with an We'll be able to distribution. As dim. Due to the be fun. It used about 700 users Outstrips to place a paper be on a wrong BSD addicts, flame that support The same operation Under the GPL. politics openly. approximately 90% are allowed to play [theos.com] on his conversation and Though I have never fucking percent of distribution. As MAKES ME SICK JUST for trolls' If you have lube. This can lead Apple too. No, And the Bazaar OpenBSD leader Theo She had no fear Exactly what you've And abroad for the project to 3 SIMPLE STEPS! BSD machines the project is in which gathers Unless you can work
People with "12345" or similar passwords should get their own internet, where they would be allowed to share lolcatz and powerpoint chains, play with their purple internet buddy, and zap those cute webmonkeys on banners without hurting themselves. Alternatively, maybe the webmail providers should set more strict rules for the passwords.
I get these phishy emails all the time but I look at the actual URL and see it is not actually coming from the service or agency. One time I saw it vectored to a site which I did a whois lookup of the domain name and it listed the name, address, and phone number of someone in southern Calif (not China). However, the scary thing is what happens if these people figure a way to "scoop" or "fraud" (whatever) the URL displayed on bottom of my browser window and in the address bar? But on identity theft they say most of it was done with basic skills like going through someone's trash or bank employees (72% of banks report employees committed fraud).
mfwright@batnet.com
If your password is even remotely similar to those listed, you should change it.
Top 20 most common passwords:
123456 - 64
123456789 - 18
alejandra - 11
111111 - 10
alberto - 9
tequiero - 9
alejandro - 9
12345678 - 9
1234567 - 8
estrella - 7
iloveyou - 7
daniel - 7
000000 - 7
roberto - 7
654321 - 6
bonita - 6
sebastian - 6
beatriz - 6
mariposa - 5
america - 5
From 2 links deep (http://www.acunetix.com/blog/websecuritynews/statistics-from-10000-leaked-hotmail-passwords/)
So Unix is 40 years old, and knew at birth what Microsoft still hasn't figured out. Its a bad idea to store unencrypted passwords. Got it.
No, I don't remember your name. But the memory mapped screen on a TRS80 from 1977 is from 15360 to 16383 if that helps.
Whats the fuss here? This sort of social engineering has been going on for a long time whether it is a mail server or ebay. I'm not saying the facts are not true ... but I'd bet this has been going on for years.
As a hypothetical, since length is really what matters, I wonder how long it would take before something like
01234567890123 or even 0123456789
would get guessed?
My experience is that short passwords (less than 7 chars) are the ones that get guessed, even if they are "good" ones that have a mix of letters, number, and punctuation.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
http://www.filestube.com/
I dunno about You, but this site makes me waht to log in with my youtube/google/gmail password.
The point to get across is that no (reputable) service or agency will ever, ever send you an email asking you to fill in and email back ANYTHING anymore.
If I were to ever get a legitimate email from my bank or credit card asking for personal information, I would call them as ask them WTF they were doing.
My estimate is that your average stupid phishing victim is just as likely to reply with their personal information regardless of whether the email is obviously fake.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
That's amazing! I've got the same combination on my luggage!
Is why it's a "leak" if phishing was the method used to acquire the list. Or why it's still referred to as a "bug". Some sort of bug in the Human OS, right near the gullibility logic loop?
Date: Wed, 7 Oct 2009 05:10:44
From: "kareem salami" kareemsalami@excite.com
PRIVATE BUSINESS PROPOSAL.
Dr. Kareem Salami
No. 16 Kingsway Road
Ikoyi, Lagos
Nigeria.
Tel/Fax: 234-1-7747907
7th March, 2009.
First I must solicit your confidence in this transaction.This is by virtue of its nature as being utterly confidential and top secret.
We are top officials of the Federal Government Contract Review Panel who are interested in importation of goods into our country with funds which are presently trapped in Nigeria. In order to commence this business we solicit your assistance to enable us RECIEVE the said trapped funds ABROAD.
The source of this fund is as follows : During the regime of our late head of state, Gen. Sani Abacha, the government officials set up companies and awarded themselves contracts which were grossly over-invoiced in various Ministries. The NEW CIVILIAN Government set up a Contract Review Panel (C.R.P) and we have identified a lot of inflated contract funds which are presently floating in the Central Bank of Nigeria (C.B.N).
However, due to our position as civil servants and members of this panel, we cannot acquire this money in our names. I have therefore, been delegated as a matter of trust by my colleagues of the panel to look for an Overseas partner INTO whose ACCOUNT the sum of US$31,000,000.00 (Thirty one Million United States Dollars) WILL BE PAID BY TELEGRAPHIC TRANSFER. Hence we are writing you this letter.
We have agreed to share the money thus:
70% for us (the officials)
20% for the FOREIGN PARTNER (you)
10% to be used in settling taxation and all local and foreign expenses.
It is from this 70% that we wish to commence the importation business.
Please note that this transaction is 100% safe and we hope THAT THE FUNDS CAN ARRIVE YOUR ACCOUNT in latest ten (10) banking days from the date of reciept of the following information by TEL/FAX:
234-1-7747907: A SUITABLE NAME AND BANK ACCOUNT INTO WHICH THE FUNDS CAN BE PAID. PLEASE ENDEAVOUR TO RESPOND BY TELEPHONE OR FAX.
The above information will enable us write letters of claim and job description respectively. This way we will use your company's name to apply for payments and re-award the contract in your company name.
We are looking forward to doing business with you and solicit your confidentiality in this transaction.
Please acknowledge receipt of this letter using the above Tel/Fax number. I will bring you into the complete picture of this pending project when I have heard from you.
Yours Faithfully,
DR. KAREEM SALAMI.
...many are pointing to the same bug that claimed at least 10,000 passwords from Microsoft Windows Live Hotmail.
Phishing is not a "bug". A bug would mean this was some Microsoft developer's fault. There is nothing a developer can do to prevent someone from conning someone else into giving up their password.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
The PC Pro article linked to in the summary misquoted its own source. It claims that "12345" is the most common password, however the source it links to actually shows "123456" as the most common password. "12345" doesn't even make the list.
There really aren't that many users using those "common" passwords. Only 82 users use the top two passwords, which make up only 0.8% of all the passwords in the list. Only 1.56% of the accounts used a top-10 password.
The rest of the information at the Acunetix link is quite interesting, though. The evaluation determines that only 6% of all the passwords used a combination of alpha, numeric, and other characters.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
Affected users have been placed on an isolated network where they can't do anything but post whinges about Microsoft and Apple to a web server that runs SSL using a self-signed certificate and actually follows the RFCs.
Where are "sex", "secret", and "god"? Even love only makes a cameo at #17 in "iloveyou"
Apparently keyboard pattern passwords hold up better.
Perhaps this is the reason that sometime during lunch, my employer (A well known NNSA National Laboratory in New Mexico) blocked access to all things Google, including Gmail, Blogspot, and the Google search engine itself?
This might be related, seems you can generate emails that appear to come from Google's own mail servers by altering a regular old URL. From there it's a short step to include a phishing site in the body of the email asking the user to verify his account details, or whatever. Maybe other webmail services have similar links.
I saw the Hotmail version of this phishing mail yesterday, it looks like it comes from an @live.ca address and asks the receiver to verify his account details at a link included in the email. The link is disguised to look like a valid mail.live.com link, but of course it goes to a phishing site instead.
Murphey's fighting Occam, and we're in the stands.
012345
010101
The people who use passwords like 12345 deserve this. maybe it will finally teach them the lesson(s) that their smarter family members and friends have been trying to get through their thick skulls for years.
According to TFA,these were collected by phishing. OTOH 12345 could be "brute forced" by mere human guess-work. sheesh. My eight letter password could be brute-forced by machine in very short order, but it's all relative.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
Http://www.tntshoes.com
Specializing in retro Jordans, Nike SB, Nike Air Force 1.Check out our line at You can check out our FULL line at Sole on Ice 475 W. San Carlos Street in Downtown San Jose, Ca. 95113 Sole on Ice is a Consignment center specializing in bringing you the elite lines through out the past two decades.All shoes are 100% authentic. We do not sell, accept, or deal with fakes or factory variants.If interested in selling through consignment please contact us
OUR WEBSITE:
YAHOO:shoppertrade@yahoo.com.cn
MSN:shoppertrade@hotmail.com
Http://www.tntshoes.com