Slashdot Mirror
Millions of Gmail, Yahoo, Hotmail Email Accounts Being Traded in Russian Underworld (reuters.com)
Eric Auchard, reporting for Reuters (edited and condensed): Hundreds of millions of hacked usernames and passwords for email accounts and other websites are being traded in Russia's criminal underworld, a security expert told Reuters. The discovery of 272.3 million stolen accounts included a majority of users of Mail.ru, Russia's most popular email service, and smaller fractions of Google, Yahoo and Microsoft email users (Editor's note: the numbers are: 57M Mail.ru, 24M Google, 40M Yahoo, and 33M Hotmail), said Alex Holden, founder and chief information security officer of Hold Security. [...] The latest discovery came after Hold Security researchers found a young Russian hacker bragging in an online forum that he had collected and was ready to give away a far larger number of stolen credentials that ended up totaling 1.17 billion records.Amir Efrati, a reporter with The Information, asks: "Industry seems to be failing at convince email users to do 2-step verification. Why not require it?"
Kennedy should have gotten rid of them when he had the chance! They are reading our Hotmail!
The page... she is empty ?
GNAA...
It would be real news were there be no stolen data in the hands of russian hackers.
Don't step on the baby.
Follow Hillary Clinton's example, and just run your own server.
Why not sever the cables that connect Russia to the Internet until they crack down on the rampant crime online coming from their country? Can anyone give me a good reason why this shouldn't be done?
I suspect I'll get downmodded to -1 so people can avoid the question and pretend like it's not here. Can anyone actually answer the question rather than evading it through moderation? I don't think Slashdot is capable of giving a good answer.
Glad I finally turned on 2-factor authentication for gmail, using a usb token.
it was those Russian hackers.
You might as well just go ahead and auction off your own account information. If you know you're likely to be hacked anyway and someone's going to make a profit off it then why shouldn't that person be you?
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Thank God for Reuters.... otherwise we would have never found out. Ever since Reuters started a "security" news section this past winter, they're pointing out the most obvious things lately. Tomorrow's story is "malware infects Windows computer"
It's easy and it works!
Google (Gmail)
Yahoo
Microsoft (Hotmail)
Obviously there is high demand for foreign email accounts because of the sanctions on Russia and the resulting account shortage. Donate your password to the needy.
Drown the commie bastards in exapetabytes of bits.
haxxy haxx0rz errywear!
No guarantee. A lot can be obtained from third-party sites, to which people login using their existing accounts. It is not only Slashdot, which allows you to login with your Yahoo! or Facebook credentials...
When you use this method on a web-site, you get a notice, that you authorize the site to "access your contacts" and some other information. This is easy for the sites to set up and they like it because they want to encourage people to comment — it increases "pageviews". The site itself may not be abusing this access (some operators may not even realize, they have it).
Unfortunately, not all sites are good at guarding it — this is how your entire Yahoo! addressbook, for example, may end up in the criminals' possession without them ever actually accessing your mailbox. Having such addressbooks, spammers can (and do!) generate customized spam in which you appear to be the sender for each of your contacts and which opens with the salutation you used to identify the contact. Such spams, obviously, have a far higher chances of being read by the victims — and the links in them are much more likely to be clicked.
In Soviet Washington the swamp drains you.
A friend that runs a small anti-spam company says that he's "never seen a legit email" from Mail.ru, period.
I'm sure they exists, but when they're only 0.000000000000000000000001 of the volume, it's probably hard to detect.
Just cruising through this digital world at 33 1/3 rpm...
There all from the Ashley Madison database!
"Exclusive: Big data breaches found at major email services - expert"
Wow, no shit?? Bloomberg is really on the cutting edge of newsy stuff, like fer sure. Oooh, and their big discovery is "Exclusive" too.
You could run this headline every day and it would be true. Has Bloomberg just discovered email and hackers and stuff?
Just cruising through this digital world at 33 1/3 rpm...
https://twitter.com/FearDept
There is a Russian underworld? I thought the Russian underworld successfully merged with the Russian government during the Yeltsin era and is now literally blossoming under Putin.
This story has surfaced several times before - each time the password number seems to grow larger and larger. Alex Holden appears to be using it to promote his business.
Here's a couple of skeptical opinions on it.
https://www.schneier.com/blog/archives/2014/08/over_a_billion_.html
https://community.spiceworks.com/topic/557606-scam-of-the-week-for-sale-cybervor-false-sense-of-security
Long story short, Alex Holden is charging people $120 to find out if their account is impacted. The collection of stolen accounts probably doesn't exist.
1. Don't log into websites with a Google, Microsoft, or Facebook account. This is patently stupid and only those who don't understand security will do this and claim "it's easy", or "it's convenient". You get what you have coming if you go this route.
2. Firewall email and other accounts. IOW, have an account for important personal things. Have an account for trivial things. Have a throwaway account for quick signup that are not important. With Facebook and other privacy-nightmare sites, use an email account that is used for nothing else. Don't populate the account with addresses. It's the account used to maintain the service.
3. Use 2FA where possible. Don't use the same passwords across accounts. This is a no-brainer, but people do it for convenience. Don't. It's stupid. Have a separate password for each service. It's really not difficult to remember passwords.
....pays for something that is free?!?
If the database includes both usernames and passwords, it is practically guaranteed that it was stolen from the user's computer by keylogging viruses, etc.. No large email provider would be stupid enough to store actual passwords on their side.
Its probably safe to block all posts containing "goat.cx" at this point since the domain is parked.
Minimum threshold fixed. Thanks!
I heard that dumpster diving is the main source of private information nowadays: https://en.wikipedia.org/wiki/...
People do not shred papers or shred with outdated machines. This is how passwords, account numbers, photos, handwriting samples, etc. gets into the underworld.
All this systematically collected and added to large databases. Modern hard disks allow to keep data on the whole population, especially of the first world. Obviously it is an international underworld.
>"Amir Efrati, a reporter with The Information, asks: "Industry seems to be failing at convince email users to do 2-step verification. Why not require it?" "
Because not all of us want to give stupid corporations our freaking cell phone number or whatnot. Talk about a MAJOR invasion of privacy. There are things that CAN be done, but forcing an invasive "solution" on people will find at least some of their user base leaving their service.
Some of us really are VERY careful about passwords, not using malware-infected systems, etc. And forcing us to hand over even more private info to companies that ABSOLUTELY WILL spam us with it is a deal-ender.