Slashdot Mirror
Russian Hacker Selling 1.5M Facebook Accounts
Sir Codelot writes "A hacker who calls himself Kirllos has obtained and is now offering to sell 1.5 million Facebook IDs at astonishingly low prices — $25 per 1,000 IDs for users with fewer than 10 friends and $45 per 1,000 IDs for users with more than 10 friends. Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users. Quoting: 'VeriSign director of cyber intelligence Rick Howard told the New York Times that it appeared close to 700,000 had already been sold. Kirllos would have earned at least $25,000 from the scam. Howard told the newspaper that it was not apparent whether the accounts and passwords were legitimate, but a Russian underground hacking magazine reported it had tested some of Kirllos' previous samples and managed to get into people's accounts.'"
Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users.
Translation: it might not be a bad time to change your password if you use Facebook.
My work here is dung.
I can increase the size of my friend network and be the biggest star on the net!
... to become a new man.
What is going to happen to my beautiful farm :(
I'm suprised they are not worth more since they represent a great point of entry for social attacks. Think Personalized spam (i.e. "Hey John, I think Laura wanted you to buy this for the concert you are attending next week"), targeted dictionaries, localized phising (i.e. location data deploys phising to compromised machines near you). Once you break a single friend in the "network" you gain additional information to everyone in that scope, so the return on entry is very promosing. An attacker can begin profiling ideal targets in the guise of friends. Ah, so many possibilties. Such a gold mine.
Trying to install linux on my microwave, but keep getting a kernel panic...
Hmm, maybe 1 out of every 300 Facebook users' computers is infected with Koobface......
http://news.cnet.com/8301-1009_3-20002112-83.html
According to the Facebook statistics page the average account has 130 friends. If 1 in 300 accounts are compromised and you have circa 130 friends then the odds are quite high that the personal data you have "only available to friends" is going to become available to some fairly unfriendly people shortly.
Reminds me of the evertrue saying 'play with fire and you'll get burnt'. I have always been mindful of the threat FB poses to my privacy and have completely closed down my account several times, but keep giving in and going back due to peer pressure from family & friends. This time I'm killing it off for sure. No organization, be it governmental or corporate should have control over so much of an individuals personal data.
...and yet, time after time, FB users ignored the abuse and kept on using the service. I really have little sympathy for such blatant and above all, stubborn disrespect for one's own security. And for what? To have "virtual friends"? To "keep in touch"? Both friends, conversing and socializing are more fulfilling when done in some of the more traditional ways.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
1. collect facebook ids
2. ???
3. profit!
Do you even lift?
These aren't the 'roids you're looking for.
Probably because unlike in the US, Russia seems to turn a completely blind eye to cyber criminals. Granted we don't do such a good job ourselves, but we do look for them and prosecute them when found. It's rich that a country with a very serious problem with organized crime would even pretend like there's no justification for pointing a finger back at the lack of enforcement.
...Don't hate the players hate the game dawg!
Facebook users aren't security experts, they're family members, friends and loved ones. You remember those, right?
Living in my IT bubble in San Diego it was easier for me to bag on Facebook and 'look down' on it's users but now that I'm unemployed and living temporarily with family I seen how useful it is for them to keep in touch with friends and relatives in a way that letters or email simply can't emulate.
Besides, if we really thought Facebook was that bad instead of bitching about it we'd be the talent pool responsible for creating a better alternative (unless you believe that only venture-funded MBAs can take on such a technological challenge). For instance, I've never liked any of the popular/available dating sites, so what do you think I'm doing while I learn Mongodb in my free time?
Quack, quack.
Ah, cyber crime, the offence of sending ones and zeros down a wire to produce forbidden tones.
To specify, money in a bank is just an entry in a database. Someone fraudulently reduce some entry by $1000 and increase another by $1000? Roll back.
Banks have a problem with the administrative burden? Luckily, mine is owned substantially by the state now, so shouldn't be much of a problem enforcing this.
...the use of owning 1000 Facebook IDs ? What is the idea ? Who would want it ? I may be dense but appart from spam senders I don't see the use of this.
You can make them all your friend to give you more power in Mafia Wars...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
facebook today told me: "your account was accessed from an unusual place and has been blocked." then i had to do all sorts of things to prove i'm human and it told me to create a new password. i created such a strong password that i have forgotten it. now will have to change it again.
Wealth is the gift that keeps on giving.
Facebook shouldn't be storing your Facebook passsword, just an hash of it. That's how login systems have worked for thirty years. Doesn't anybody there have a clue about security?
Here in Finland, banks usually provide you with a list of ~50-100 one-time use codes, so it's basically impossible to figure out the next code unless you manage to find some pattern in the random digit generator that the banks use to generate those one-time codes. To me this seems even more secure than using those keypads that most other european countries seem to be using. The only way I can concieve this to be hacked is to figure out what someone's userid is (random generated string, i.e. basically a traditional password), and then intercept their snail mail when they get their fresh set of one-time codes.
...probably some people "deserve" the trouble they attract when using computers. Using an easy login/password combination is something it's not my problem. Maybe illiterate people have this problem, but then "what did they expect" of computers and internet usage? They pretend it to be like turning on a bulb. It works, it doesn't work. I would sincerely propose something like "computer usage credentials certificate". Someone is ALWAYS pretending "using computers is something anyone can do" (ha!)
No matter how easily I explain these risks to my acquaintances, they don't really understand the BIG trouble behind it, and they don't change passwords. When they tell me something like "my hotmail has a virus, please help me". I just ignore them, and/or tell them not to enter onto those silly webpages mean't to steal your login password. It's some kind of natural selection. (And Mr. Russian is, "righteously", just rubbing his hands).
I'm starting to be fed of losing my time and my friends'. And the best part is they still are friends with me. (I wouldn't expect less)
Besides, even people like me (for example), who do use "safe" passwords, are in this kind of risk, (lousy webpage programming, plain http login/password negotiation, etc...) but then, having a periodical password change schedule is something NOT SO painful. Besides if your web browser is nice enough (Opera for example), can deal with your passwords wonderfully. .rar archive (to say something), IN CASE YOU DON'T REMEMBER THEM... Again "not a big pain" (at least for me).
Only you have to keep ALL your passwods inside a encrypted
Paranoia with passwords, is something one can learn by conditioning (much like Pavlov's dog), and then you don't realize you're doing these (not so) "boring" routine tasks (like updating your local passwords file, etc...) On the long run, it's really worth its effort.
Greetings
--
Get 250 extra MB Dropbox space using this invitation http://bit.ly/agkF3r
the only way I can conceive this to be hacked ...
Always a dangerous statement - just because you can't think of an attack doesn't mean there isn't one.
You are correct that no one is going to guess the next one-time password. Instead, they are going to attack your machine, and piggyback on your session after you have logged in. This is happening in the wild today, although it's mostly aimed at larger commercial accounts.
Those keypads are more secure because they can be used to enter unique data for each transaction, like the amount of a transfer. Plus, they aren't connected to a network, so remote hacks are blocked. The keypad's generated code will definitively prove that the holder of the device entered the transaction data(*).
Obligatory Schneier reading: http://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html
(*) The most likely attack against devices like this: the key stored on the bank's server. But it's just a single target, so it is easier to harden.