In the latest online hack attack, over two million passwords from social networking sites including Facebook, LinkedIn and Twitter were accessed and posted online by hackers. The news has left a mass-surge of changed passwords in an attempt to keep private and personal information safe from the prying eyes of strangers.
According to the Independent, the attack was “fairly global”, though some 96% were stolen from IP addresses based in the Netherlands. The attack has caused a mass panic in the Netherlands as many rush to save face and keep their information safe.
How it happened
It wasn’t until security researchers were looking into online safety that the list was found, posted online along with passwords for Google and Yahoo accounts included. The data was found when investigating the botnet “Pony”, which is a network of hacked computers accessed by gangs to perform illegal online activity.
The passwords are believed to have been stolen by the use of keylogger software. Previous attacks by the group were considered reasonably fast and somewhat insignificant on a global scale, though this is thought to have been performed over a number of weeks resulting in a steady and continuous flow of password release.
How to stay safe
The passwords that have been affected have all be notified and changed, but the data has revealed something even more surprising. The public’s passwords of choice have been seen to be woefully lacking in security, with some truly surprising combinations used.
Within the top ten passwords used amongst those stolen included “123456”, “123456789”, “1234”, “password” and even “1”. The researchers responsible for recovering the passwords said in a blog post:
“It all goes downhill from there. There were more terrible passwords than excellent ones, more bad passwords than good, and the majority, as usual, is somewhere in between in the Medium category”, the article went on to say.
Andrew Mason, Security Expert from RandomStorm commented on the findings, saying:
“This just goes to show about the important of endpoint security combined with a strong password. Even the strongest password is worthless if the endpoint it is being used on is either untrusted or trusted but insecure allowing a bonnet such as Pony to run on it and the subsequent password keylogger.
“Once the keylogger is installed it is very easy to harvest usernames and passwords for whatever the user types in during the course of their normal day. By ensuring proper endpoint security and at a minimum patching and up to date AV deployment these types of attacks can be totally eliminated.
“The second area of concern from the article is the use of weak passwords. Again, without a strong password it makes the job of a hacker so much easier being able to use an automated tool to crack many passwords per second.”
All in the past
In 2006, a list of passwords from MySpace was stolen in a similar manner and posted online, which weighs up pretty interesting results compared to today’s findings. The most common passwords from this current list made up 0.9% of passwords on the network and they have experienced a rise to 2.4% today.
