Russian criminals steal 1.2 billion passwords

Russian criminals have stolen 1.2 billion Internet user names and passwords, amassing what could be the largest collection of stolen digital credentials in history, a respected security firm said Tuesday.

Hold Security founder Alex Holden told CNNMoney that the trove includes credentials gathered from over 420,000 websites -- both smaller sites as well as "household names." The criminals didn't breach any major email providers, he said.

Russian criminals steal 1.2 billion passwords

How does this keep happening? Will we ever be safe from these criminals?

First the Target breach and others, and now this.

Are you guys going to start changing passwords tonight?

a reply to: elevatedone


The link takes me to the "new thread" creation in breaking news

a reply to: TXTriker

OOOps.... lol

It's moments like this that push me against the side for internet privacy.

An international protocol is also desperately needed, and is more practical

Holden won't identify the gang, but he says his investigators know their names and locations. "The perpetrators are in Russia so not much can be done. These people are outside the law," he said.

Watch for the onslaught of ads for i.d. theft "protection" rackets.

Everything is synchronized.

Kredit...
Karma...
..Free

i have been hacked again on outlook.com ebay etc

dam them

originally posted by: elevatedone
How does this keep happening? Will we ever be safe from these criminals?

It keeps happening because, despite protestations here on ATS and elsewhere, Russia is what a criminal state ACTUALLY looks and behaves like - the whole thing is run by a kleptocracy - and they have no particular interest in even the illusion of "civilized norms" if those norms interfere with their theft of wealth.

And they don't particularly care who's wealth - yours, mine, Russian peasants......as long as they get it.

you think the NSA has an extensive spying apparatus?? Russia isn't bothered even trying to keep their secret -

A new law imposing restrictions on users of social media has come into effect in Russia.

It means bloggers with more than 3,000 daily readers must register with the mass media regulator, Roskomnadzor, and conform to the regulations that govern the country's larger media outlets.

Internet companies will also be required to allow Russian authorities access to users' information.

..........

It includes measures to ensure that bloggers cannot remain anonymous, and states that social networks must maintain six months of data on its users.

The information must be stored on servers based in Russian territory, so that government authorities can gain access.

- BBC article



All the people here complaining about the USA would wet their pants if they had to live in Russia!

That's why people should not do anything on the web that they don't want to be accessed or hacked.

Worried about your bank account? Do your banking at the local branch.

Don't want the nude pics of your secret lover to be found? Well, don't be messing around in the first place...but don't send them through email.

They can hack every account I have online and I will not be out anything other than my time to set up a new account.

Ive worked with russians for a few years in the past, the good ones, ironicly to this thread, they were antivirus guys.

They knew what they were doing i can tell you for sure.

The bad ones, the hackers for money and bot net guys, they are highly skilled and know website security inside out. The same goes for the Chinese hackers - very well skilled and knowledgeable.

The guys that are paid to protect people from hacks like this have a VERY tough job, you cant blame them from being a step behind. When a new form of hacking comes out, they can only do somthing about it AFTER its happended, its all about the reaction speed and detection - notice an attack and take it all offline - fix problem.

All the people here complaining about the USA would wet their pants if they had to live in Russia![/

DA! I can confirm this first hand!

a reply to: elevatedone

The firm didn't reveal the identities of the targeted websites, citing nondisclosure agreements and a desire to prevent existing vulnerabilities from being more widely exploited.

Wonder if this will this affect us here at ATS?

Maybe we better all update our passwords asap.

Edit - Opps see the OP has added that suggestion.

a reply to: elevatedone

I've been using teh Interwebs since… oh, 1985 or so? Generally use the same username and password, and never been hacked, so far as I've been able to tell. I do use different logins for my financial stuff, otherwise it's always the same old, same old.

Maybe a lot of that "blah blah blah stole some passwords" is just a lot of hype on the part of companies like Symantec and McAfee?

a reply to: Aloysius the Gaul

And by contrast what does a criminal state actually not look like?

...

a reply to: Aloysius the Gaul

Are you for real? Give me a break man. It's simple really. Some of the best computer hacking and coding minds in the world hail from Ukraine and Russia. Many others simply move there because they know they will be safe from the US arm of the law.

You act like Putin is doing the hacking himself.

Newsflash - it is a bunch of kids aged 16 - 24 years old doing all of this hacking.

a reply to: Aloysius the Gaul

Are you for real? Give me a break man. It's simple really. Some of the best computer hacking and coding minds in the world hail from Ukraine and Russia. Many others simply move there because they know they will be safe from the US arm of the law.

You act like Putin is doing the hacking himself.

Newsflash - it is a bunch of kids aged 16 - 24 years old doing all of this hacking.

and this is news while NSA spy all over the world 24/7 ? i find it mildy amusing people already forget and even forgive what NSA did to the civilians..

The news was first reported by The New York Times, which cited research from Milwaukee-based Hold Security. The firm didn't reveal the identities of the targeted websites, citing nondisclosure agreements and a desire to prevent existing vulnerabilities from being more widely exploited.

Source
Analysis:

Who? The message is coming from a security company who assist companies in 'enhancing' their 'security posture'. Vested interest alarm just went off.

Where? Main stream media who regularly take payments from companies wishing to publicize their expertise using journal articles or sound bytes.

Why? Because they enjoy swimming in large piles of cash.

These botnets used victims’ systems to identify SQL vulnerabilities on the sites they visited. The botnet conducted possibly the largest security audit ever. Over 400,000 sites were identified to be potentially vulnerable to SQL injection flaws alone.

Source
Not saying the claim should be 100% doubted, but is this really surprising than a bot net went around looking for the same group of database exploits over and over and found pay dirt?

Many of these websites will be things like call management systems, blogs, forums, abandoned websites that haven't been updated for years, and a pile of other things that aren't exactly the height of importance. Hold Security says "Hold Security uncovers the largest ever security breach! " but given we now have more website addresses than we had written words 2000 years ago, if we ran this test next year we would come up with an even bigger number. Imagine if we ran it again in 20 years? 40 years? Even more abandoned web sites sitting around with old software just waiting on a bot to come running by to steal their databases.

I'm not saying they're all abandoned or meaningless websites, but the biggest thing to take from this is the usual use a unique password for every website, don't obviously link your accounts if you can avoid it, don't store your passwords online, and if you duplicate passwords make sure you're prepared to lose that resource. I'm sure there are a pile of more patronizing hints most of us have heard before but that's about the size of it.

A more startling headline would be something like, "10, 000 banks hacked, money gone, reports completely independent none invested research group" but unless I'm completely wrong this bombastic article is more along the lines of something like ... "It rained, and people got wet ... on the internet."

There should be a firewall between eastern Europe and the rest of the world. Russia and Romania pretty much own the credit card theft and identity theft rackets.

The blame also lies on western companies that are so lackadaisical about security. We also have an entrenched business culture in America that compiles massive amounts of data on ourselves that is being exploited by these thieves.

a reply to: Aloysius the Gaul

Well said mate.

Everytime my card's been hacked it's been from China. Just saying.