Slashdot Mirror
Massive Russian Hack Has Researchers Scratching Their Heads
itwbennett writes Some security researchers on Wednesday said it's still unclear just how serious Hold Security's discovery of a massive database of stolen credentials really is. "The only way we can know if this is a big deal is if we know what the information is and where it came from," said Chester Wisniewski, a senior security advisor at Sophos. "But I can't answer that because the people who disclosed this decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at $120 per year.
"They decided they want to make money off of this. There's no way for others to verify." Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at US$120 per year.
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.
In addition it seems the above quote neglected this portion of the article:
Individual consumers can find out through its identity protection service, which Hold Security says will be free for the first 30 days.
It's free and they still can't afford it? Sophos can't use a fraction of its 100,000 honeypot email accounts to sign up and see if it's legit?
Much like Hold Security, Sophos has displayed nothing but news-unworthy jabber.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
... and change all of your passwords today. This is the best way to devalue the 'massive database'. Then sanitize your SQL queries!
For $799, you can get one year's service for protection from the Russian hackers plus a single-user license for Linux IP from The SCO Group.
More than 1B credentials does not sound implausible to me, though it's on the high end. You may be wondering why my opinion on this is more relevant than anyone else's, so let me explain.
Although I left the company in January, for about 7.5 years I worked at Google and for ~3 of those years I worked on security and anti-spam related matters. Starting around April 2010 we started to see absolutely enormous numbers of compromised accounts sending spam to their contacts. This was not a problem that grew slowly. It went from zero to one gang compromising on the order of 100,000 accounts per day and that happened in the space of, it seemed, a few weeks. We learned about this problem through user complaints and by watching the flow of spam mails being reported to us via the "Report spam" button. We quickly realised this wasn't a Gmail specific problem but was simultaneously impacting Hotmail and Yahoo. Further investigation revealed that although this gang was capable of compromising ~100,000 accounts per day (more than one per second) this was the result of a 10-15% success rate for more like a million attempts per day: most account/password pairs they tried did not work. The reason was they were reversing password hashes stolen from third party websites using GPUs, and it turns out that people who use the same password everywhere make up (surprisingly) only about 10-15% of the user population. People suck less at security than you might imagine.
When this problem first started we believed that such an enormous supply of credentials must surely be some kind of freak one off, the result of compromising an unusually large site. I mean; one million credentials every fucking day was an unimaginably vast pool of stolen passwords. But as the user complaints of being hacked failed to dry up we came to accept the horrible truth - this was not some freak one off but the result of some kind of production line of passwords. Most likely a combination of automated web crawls to discover vulnerable sites, semi-automated popping of those sites, farms of GPUs reversing the passwords and the resulting packages being sold on the black market to spammers who then abused them for bypassing spam filters (mail from contacts is whitelisted by any good spam filter). We only got occasional snapshots of this market, for example we were able to find adverts on Russian blackhat forums by people advertising lists of "washed" vs "unwashed" account/password lists for hotmail, gmail etc, but mostly it was opaque.
Anyway, long story short, we formed a team that built a full blown risk analysis system for every single login (Google has a bajillion logins per second thanks to mail clients that poll Gmail and have to log in each time) and after several years of work managed to block logins with bulk-stolen passwords so successfully that they went away. But the underlying supply of passwords is still out there, and should those defences fall the problem would come back.
I gave a talk about this and various other webmail abuse related topics at the RIPE 64 conference in Ljubljana (video link) in case anyone is interested in this. The slides are also available though lots of info from the talk is missing from them.
Assume they cracked the NSA backdoor default password and can now access everything on every computer not running a hardened operating system. In other words, everything, whether you change your passwords or not. Further, assume they have remote access via UEFI to every motherboard built in the past year.
You might as well, that level of access has been built into modern technology, if this group hasn't figured it out, someone will. Or maybe already has.
We live in an age where technology is insecure by design. You can either abandon all hope (my preferred option) or you can adjust your approach to not depend on external security.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
One interesting question is if the company really has found a data set of 1.2 billion account names and their plain text passwords.
I cannot believe this. It would require enormous stupidity to not store the passwords as salted hashes.
If all the concerned web sites had been using normal security measures, changing passwords right now would not be such an urgent need.
It's the only way to be sure...
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach? It must be highway robbery unlike most AV products which charge the same $$$ per year for little in return.
Indeed, we used to operate a similar service, and many companies were excited to sign up at just $49 / year. Often, the bad guys get the entire password database, so being alerted to that right away is valuable. I designed our system many years ago and it was somewhat expensive to operate. Crackers compromise new sites every day, so you have to be constantly finding and processing newly compromised accounts. Over time, it became more costly to cover a smaller percentage of compromised accounts, so we advised more and more sites not to buy it, until at some point we just stopped offering the service pending a redesign.
Using different types of resources that are available now, it's possible to run such a system more efficiently. I have a design in mind, but I haven't implemented it yet. If I do, it will likely be priced pretty close to $120 / year. We won't make crazy profits at that price point because it'll cost us $2,800 / year to operate. We'll need about 25 sites to sign up just to break even, and that doesn't include the time spent developing the new system. For a site with $300,000 / year in revenue, $120 will be a great value. For a site with $3,000 / year in revenue, it wouldn't make sense for them to get it.
We used to provide a similar service to web sites. We had many millions of compromised accounts. We didn't offer any services to consumers. The companies who were our customers knew we had a very solid reputation for providing excellent security solutions, and on forums other webmasters they know would report that our service worked well for them. That was sufficient that most customers would add that service or not based on what I recommended for their particular site. In general, on a site making over $5,000 / month it might make sense to spend $5 / month on the extra security. For sites making less than $1,000 / month, I'd suggest they put their limited resources elsewhere and check back in a year. In between, it depends on the type of site. Some are attacked more than others, and a compromise is likely to be more costly on some than on others.
I agree there is not enough competition. What causes conservative-thinking people like myself to tear our hair out is when we read "The government should step in". What you seem to fail to realize is things are the way they are because government HAS stepped in. How else do you think these unimaginably large banking organizations got so big in the first place? How do you think they squash their competition? There is absolutely nothing wrong with capitalism at all... what we have here is something called crony-capitalism. Asking government to do something about it only invites more of it! We need less government involvement - not more (not none either). Don't mean to turn the thread into a political battle... as it's off-topic. Sometimes I just can't let these "the government should do something" comments stand.
Looking at who benefits is always a worthwhile pursuit. A company benefits, selling what appears to be FUD. US Government benefits because they have recently been blaming everything on Russia.
What is not happening? Nobody is going to jail over computer espionage act (or any other law allegedly violated). In fact there is no criminal investigation at all mentioned. No facts available to verify the alleged "stolen credentials", and the only way to even glimpse said data is to provide your information to some company that is an unknown in the security community.
I'll have to dig later, but I'm curious who the owner of this company is and who they are tied to. Surely a coincidence, but this comes out right after former NSA Director claims he's worth a million a month in consulting, working on over a dozen "IT Security" patents, all for his brand new private business. That may not be a rat, but sure has that "rodent" like smell to it.
At best, this is a company trying to profit off other people's pain. No thanks, I'm not buying anything they are selling.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Let me start off with I agree its off topic. But I need to vent sometimes ;)
I also agree with what you are saying about how gov intervention is what got us to the mess we have now. However, you are making a bad assumption with capitalism. That someone will not game the system. This is typically called collusion. They can even do it at arms length and not really talk to each other. Like many monetary theories it assumes there are no douchebags. Like communism assumes that everyone will work hard. Most capitalism theories assume that someone will not try to screw someone else.
A Billion dollar security firm won't sign up for a $120 per year service to see the data behind the breach?
A billion dollar security firm won't sign up for a $120 per year service per site to not see the data behind the breach, but to be given an unsubstantiated statement of whether they allegedly are affected or not.
Why would they? That would just be opening up for all kinds of protection rackets.
DO we even know at what business(es) or bureau(s) the breach occurred? Every database of logons should contain some intentionally faked entries that can be used to fingerprint the database, just like those imaginary towns that are put on maps to expose copyright dodgers.
Lets make an even bigger database of stolen information. What's the worst that could happen?
Only if you're an idiot and used the same password on EVERYTHING.
Really - what likely happened is they breached some major sites, but those sites contained little of value. I mean, if you breach the New York Times database, what do you have? Just a bunch of emails and passwords of people who probably registered to read some article and which are completely worthless to anyone on the market. Oh yay, they can use my NYT password to compromise my some-blog.com account where I registered to post a comment.
Now, it does mean to change your important passwords though - eBay, Paypal, Amazon, your bank, Google, iTunes, etc., where there IS valuable information in it.
It's why all password guidelines are bullshit - I've had to deal with sites that force me to use "strong" passwords and change it monthly. Just to download some program because they offered it to me for free. Enforcing that really didn't benefit me (the account wasn't that valuable to me anyhow), and it was just a major annoyance.
Hell, break into my Facebook account so you can what... spam my 8 friends? Or my twitter where you can spam my 0 followers (I signed up for those things that required a twitter account, so all my tweets are of the form "blah blah blah you could buy X and win").
Why don't we know what web sites these credentials are from? This story makes no sense. If 1b users were compromised on Gmail or something, there would be no way to keep that a secret. So what web site(s) are these credentials from? This doesn't pass the smell test.
Either they're in on the theft somehow, or they're a totally unethical company trying to extort people. No trustworthy security vendor would withhold information about sites that are compromised from the site operators.
I think it's just a marketing ploy personally. "You may have already won! Contact us for details ($1.99 a minute)".
Regardless, they're on my list of companies to never do business with in any way. I
This is a pure and simple scam to extract $$ from people who are nervous about this stuff. I consider it an advanced form of phishing attack.
The United States Government needs to immediately AS IN NOW Commandeer that company's data base. I watch this Russian speaking through tv cameras and I can't believe he is serious to be charging for the knowledge if you have a website that has been compromised.. That is fucking good. What will they do next?
how do we know Kaspersky Labs is legit?
they've got to have the means to do this...
same with McAfee
Thank you Dave Raggett
You ask "why would they" sign up for a notification service that costs $120 / year. I suppose it's like just about any other online purchase - it comes down to the reputation of the seller. Why would you buy a computer on Dell.com, when you can't see the product before you buy it? You'd make that decision based on Dell's reputation, and any previous dealings you had with the company.
The companies who were our customers knew we had a very solid reputation for providing excellent security solutions, and on forums other professionals they know would report that our service worked well for them. When we identify a compromised account, we tell the owner of the sites which account(s) are known to be compromised and where we found the compromised account information if it's being publicly traded on a cracker board. Also we provide tools they can use to analyze activity on the account and see for themselves that people in Russia and China are trying to use the account or whatever.
A customer uses this service and tools and it works well for them. Six months later, someone in a Slashdot posts asks "how can I can tell if my site's password database has been compromised?" Other Slashdot users reply "the tools 'raymorris' supplies worked well for me". So pretty much like any other online purchase.
Looks like a scam to me!
and the timeframe and success rate for it...
That totally sounds like it could have been the heartbleed exploit.
If you consider the length of time, the success rate, and consider how much time would have to be spent polling servers, that would coincide nicely with the prerequisites for making heartbleed give up passwords.
I can't think of any but what a reputation this country has: Hackers, Russian dash cam car crashes, a leader with Tsar ambitions. And yet they have best competition ballroom dancers (and many moved here to US).
mfwright@batnet.com
Well, if the government is not sending people to jail for things like this, someone else has to. Someone should start kidnapping people in power and put them in very small boxes for life.
Even better, add IP blocks, client certs, SSH RSA keys, and some type of two factor authentication.
For example, everyone knows the default root password for iOS is "alpine"... but knowing that does not help much to develop a new jailbreak or to get access to a device from remote.