Slashdot Mirror
Massive Phishing Campaign Hits Multiple Email Services
nandemoari writes "It seems as if the massive phishing campaign reported yesterday was not specific to Hotmail, as was initially believed. According to a report by the BBC, many Gmail and Yahoo Mail accounts have also been compromised. Earthlink, Comcast, and AOL were also affected. While the source of the latest attacks has not been determined, many are pointing to the same bug that claimed at least 10,000 passwords from Microsoft Windows Live Hotmail. Microsoft has done their part in blocking all known hijacked Hotmail accounts and created tools to help users who had lost control of their email. An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.' On their end, Google responded to the attacks by forcing password resets on the affected accounts."
An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.'
That's amazing. I've got the same combination on my luggage.
With an extra digit for security! ;-)
-- Boycott Shell
That's the kind of thing an idiot would have on his luggage!
See, that's why they got their accounts hacked. I use 67890 on all my accounts so I'm sure they'll never get hacked :)
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
012345
This all sounds a bit....phishy to me.
"Our goal each year should be to increase the number of goals we set for ourselves!"
All of the stories seem to be very short on details. How did the scheme work? How were they getting users to their site instead of Hotmail? Was it something stupid, like a spam email with a link? Or was it DNS forgery or something more subtle?
Everyone is reporting that it was a particularly big haul for a phishing campaign, but nobody seems to be reporting what the deal was, or why this was more successful than your typical, run-of-the-mill phishing attack.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
"Remind me to change the password on my luggage!"
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
People with "12345" or similar passwords should get their own internet, where they would be allowed to share lolcatz and powerpoint chains, play with their purple internet buddy, and zap those cute webmonkeys on banners without hurting themselves. Alternatively, maybe the webmail providers should set more strict rules for the passwords.
'Ten minutes to Central Park, and eat pretzels' becomes 10mtCP,&ep, which is trivial to remember for you (well, it is if you live ten minutes from Central Park and like pretzels). Keeping the punctuation in doesn't make it any harder to remember but adds another non-alphnumeric character. And, yes, for punctuation nazis there, I realise the comma in that example is superfluous. This short sentence, which anyone can remember, turns in to a ten symbol password, containing letters (upper and lowercase) and punctuation, which is incredibly difficult to brute force.
I am TheRaven on Soylent News
Which tells me there is an unusual number of Latino users among the 10K.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
And, yes, for punctuation nazis there, I realise the comma in that example is superfluous. This short sentence, which anyone can remember,
Real grammar nazis also know that it wasn't a sentence.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Huh??? I thought that was collected by phishing? Yeah, sorry for getting in the way of your ritual MS bashing, but it's something that can affect any service since it's essentially social engineering. Kind of.
You just got troll'd!
Real grammar nazis also know that it wasn't a sentence.
I love you. Will you marry an anonymous coward?
Doesn't look like it. Sorry.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
With the Psion Series 3, you could enter characters by their ASCII code (no unicode, this was 1993) by holding down a modifier. I thought this would be great for a password; no one would ever guess that they had to hold down a modifier while entering some digits in the middle of the password. It turned out that the password entry box in the settings pane did, indeed, allow this kind of thing. Unfortunately, the first time I locked the device afterwards, I discovered that the password entry box for unlocking did not. That said, I haven't come across anything for a long time that didn't allow upper and lower case and numeric fields (although some discarded the case information). A few don't allow non-alphanumerics, but it's easy to just omit them from the passwords for those sites.
I am TheRaven on Soylent News
Affected users have been placed on an isolated network where they can't do anything but post whinges about Microsoft and Apple to a web server that runs SSL using a self-signed certificate and actually follows the RFCs.
> The fact that it's a free email account shouldn't mean you're allowed to set
> your password to *anything* you want.
And one of the things you should not be able to set it to is anything anyone else has already used. In other words, on these systems passwords should be unique.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.