2014 Russian hacker password theft

The 2014 Russian hacker password theft is an alleged hacking incident resulting in the possible theft of over 1.2 billion internet credentials, including usernames and passwords, with hundreds of millions of corresponding e-mail addresses.[1] The data breach was first reported by the New York Times (and then reported in many other media) after being allegedly discovered and reported by Milwaukee-based information security company, Hold Security.[2][3]

420,000 websites are reported to be affected.[4] According to a New York Times source, some big companies know that their user's credentials are among the stolen.[3] Hold Security did not disclose which sites were compromised, but, instead, offered two separate services, one for website owners and one for consumers to check if they're affected.[4] The service for website owners costs $10 a month.[5] The check for consumers is free.[6]

Hold Security described the group responsible for the hack as a small group of “fewer than a dozen men in their 20s ... based in a small city in south central Russia, the region flanked by Kazakhstan and Mongolia,” and dubbed the group CyberVor (Russian, lit. "cyber thief"). Hold claimed the hack was perpetrated through the use of SQL injection.[7][8] According to a Forbes article, Hold Security says that not all the 1.2 billion credentials were stolen this way, there are also ones that CyberVor simply bought from people that used other means, and Hold Security doesn't know what the split is.[9]

Criticism of Hold Security

Forbes columnist, Kashmir Hill, noted "The Internet predictably panicked as the story of yet another massive password breach went viral." and "[T]his is a pretty direct link between a panic and a pay-out for a security firm."[5] Hold Security's website has a service offering people to check if their username and password pair has been stolen. It requires people to send Hold Security encrypted versions of their passwords.[4]

Skepticism

No named independent sources have come forward to confirm the breach,[5] and Forbes columnist, Joseph Steinberg, even expressed outright skepticism about many of the "facts" claimed about the breach, raising questions about the trustworthiness of the reports of the breach altogether. [4]

References
  1. BBC: Russia gang hacks 1.2 billion usernames and passwords
  2. Sullivan, Gail (August 6, 2014). "Russian hackers steal more than 1 billion passwords. Security firm seizes opportunity". The Washington Post. Retrieved August 6, 2014.
  3. Perlroth, Nicole (August 5, 2014). "Russian Gang Amasses Over a Billion Internet Passwords". The New York Times. Retrieved August 6, 2014.
  4. Joseph Steinberg (August 7, 2014). "Why I Am Skeptical About 1.2-Billion Passwords Being Stolen". Forbes. Retrieved August 7, 2014.
  5. Hill, Kashmir (August 5, 2014). "Firm That Exposed Breach Of 'Billion Passwords' Quickly Offered $120 Service To Find Out If You're Affected". Forbes. Retrieved August 7, 2014.
  6. "CyberVor Breach FAQ". Hold Security. August 12, 2014. Retrieved August 18, 2014.
  7. Marks, Joseph (August 5, 2014). "Russian hacking gang steals more than 1 billion usernames and passwords". Politico. Retrieved August 6, 2014.
  8. Al Jazeera: Russian hackers stole 1.2 billion passwords
  9. Thomas, Brewster (August 12, 2014). "The Man Who Found 1.2 Billion Stolen Passwords: Negative Publicity Harming My Business". Forbes. Retrieved August 18, 2014.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.