Slashdot Mirror
Millions of Gmail, Yahoo, Hotmail Email Accounts Being Traded in Russian Underworld (reuters.com)
Eric Auchard, reporting for Reuters (edited and condensed): Hundreds of millions of hacked usernames and passwords for email accounts and other websites are being traded in Russia's criminal underworld, a security expert told Reuters. The discovery of 272.3 million stolen accounts included a majority of users of Mail.ru, Russia's most popular email service, and smaller fractions of Google, Yahoo and Microsoft email users (Editor's note: the numbers are: 57M Mail.ru, 24M Google, 40M Yahoo, and 33M Hotmail), said Alex Holden, founder and chief information security officer of Hold Security. [...] The latest discovery came after Hold Security researchers found a young Russian hacker bragging in an online forum that he had collected and was ready to give away a far larger number of stolen credentials that ended up totaling 1.17 billion records.Amir Efrati, a reporter with The Information, asks: "Industry seems to be failing at convince email users to do 2-step verification. Why not require it?"
Kennedy should have gotten rid of them when he had the chance! They are reading our Hotmail!
It would be real news were there be no stolen data in the hands of russian hackers.
Don't step on the baby.
Follow Hillary Clinton's example, and just run your own server.
Glad I finally turned on 2-factor authentication for gmail, using a usb token.
Why stop with Russia? China, Nigeria, Ukraine, South Korea, and others, including the USA and UK, harbor hacker gangs. Disconnect them all!
it was those Russian hackers.
"The Net interprets censorship as damage and routes around it." -- John Gilmore
The good reason why it isn't done is that there is no such cable that you can sever to disconnect Russia.
You might as well just go ahead and auction off your own account information. If you know you're likely to be hacked anyway and someone's going to make a profit off it then why shouldn't that person be you?
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Thank God for Reuters.... otherwise we would have never found out. Ever since Reuters started a "security" news section this past winter, they're pointing out the most obvious things lately. Tomorrow's story is "malware infects Windows computer"
It's easy and it works!
Google (Gmail)
Yahoo
Microsoft (Hotmail)
No guarantee. A lot can be obtained from third-party sites, to which people login using their existing accounts. It is not only Slashdot, which allows you to login with your Yahoo! or Facebook credentials...
When you use this method on a web-site, you get a notice, that you authorize the site to "access your contacts" and some other information. This is easy for the sites to set up and they like it because they want to encourage people to comment — it increases "pageviews". The site itself may not be abusing this access (some operators may not even realize, they have it).
Unfortunately, not all sites are good at guarding it — this is how your entire Yahoo! addressbook, for example, may end up in the criminals' possession without them ever actually accessing your mailbox. Having such addressbooks, spammers can (and do!) generate customized spam in which you appear to be the sender for each of your contacts and which opens with the salutation you used to identify the contact. Such spams, obviously, have a far higher chances of being read by the victims — and the links in them are much more likely to be clicked.
In Soviet Washington the swamp drains you.
Because in Soviet Russia, cable disconnects you!
A friend that runs a small anti-spam company says that he's "never seen a legit email" from Mail.ru, period.
I'm sure they exists, but when they're only 0.000000000000000000000001 of the volume, it's probably hard to detect.
Just cruising through this digital world at 33 1/3 rpm...
"Exclusive: Big data breaches found at major email services - expert"
Wow, no shit?? Bloomberg is really on the cutting edge of newsy stuff, like fer sure. Oooh, and their big discovery is "Exclusive" too.
You could run this headline every day and it would be true. Has Bloomberg just discovered email and hackers and stuff?
Just cruising through this digital world at 33 1/3 rpm...
https://twitter.com/FearDept
This story has surfaced several times before - each time the password number seems to grow larger and larger. Alex Holden appears to be using it to promote his business.
Here's a couple of skeptical opinions on it.
https://www.schneier.com/blog/archives/2014/08/over_a_billion_.html
https://community.spiceworks.com/topic/557606-scam-of-the-week-for-sale-cybervor-false-sense-of-security
Long story short, Alex Holden is charging people $120 to find out if their account is impacted. The collection of stolen accounts probably doesn't exist.
1. Don't log into websites with a Google, Microsoft, or Facebook account. This is patently stupid and only those who don't understand security will do this and claim "it's easy", or "it's convenient". You get what you have coming if you go this route.
2. Firewall email and other accounts. IOW, have an account for important personal things. Have an account for trivial things. Have a throwaway account for quick signup that are not important. With Facebook and other privacy-nightmare sites, use an email account that is used for nothing else. Don't populate the account with addresses. It's the account used to maintain the service.
3. Use 2FA where possible. Don't use the same passwords across accounts. This is a no-brainer, but people do it for convenience. Don't. It's stupid. Have a separate password for each service. It's really not difficult to remember passwords.
If the database includes both usernames and passwords, it is practically guaranteed that it was stolen from the user's computer by keylogging viruses, etc.. No large email provider would be stupid enough to store actual passwords on their side.
Its probably safe to block all posts containing "goat.cx" at this point since the domain is parked.
Minimum threshold fixed. Thanks!
I heard that dumpster diving is the main source of private information nowadays: https://en.wikipedia.org/wiki/...
People do not shred papers or shred with outdated machines. This is how passwords, account numbers, photos, handwriting samples, etc. gets into the underworld.
All this systematically collected and added to large databases. Modern hard disks allow to keep data on the whole population, especially of the first world. Obviously it is an international underworld.
There is a Russian underworld? I thought the Russian underworld successfully merged with the Russian government during the Yeltsin era and is now literally blossoming under Putin.
You are correct. Check out the "Russian Business Network", or RBN. They're definitely part of the day-to-day operations of the Russian economy and are meshed intimately with the government at nearly every level. They make the Mafia look like rank amateurs.
Just cruising through this digital world at 33 1/3 rpm...
>"Amir Efrati, a reporter with The Information, asks: "Industry seems to be failing at convince email users to do 2-step verification. Why not require it?" "
Because not all of us want to give stupid corporations our freaking cell phone number or whatnot. Talk about a MAJOR invasion of privacy. There are things that CAN be done, but forcing an invasive "solution" on people will find at least some of their user base leaving their service.
Some of us really are VERY careful about passwords, not using malware-infected systems, etc. And forcing us to hand over even more private info to companies that ABSOLUTELY WILL spam us with it is a deal-ender.