1.4 Billion Clear Text Credentials Discovered in a Single Database by Julio Casal.
From the post:
Now even unsophisticated and newbie hackers can access the largest trove ever of sensitive credentials in an underground community forum. Is the cyber crime epidemic about become an exponentially worse?
While scanning the deep and dark web for stolen, leaked or lost data, 4iQ discovered a single file with a database of 1.4 billion clear text credentials — the largest aggregate database found in the dark web to date.
None of the passwords are encrypted, and what’s scary is the we’ve tested a subset of these passwords and most of the have been verified to be true.
The breach is almost two times larger than the previous largest credential exposure, the Exploit.in combo list that exposed 797 million records. This dump aggregates 252 previous breaches, including known credential lists such as Anti Public and Exploit.in, decrypted passwords of known breaches like LinkedIn as well as smaller breaches like Bitcoin and Pastebin sites.
This is not just a list. It is an aggregated, interactive database that allows for fast (one second response) searches and new breach imports. Given the fact that people reuse passwords across their email, social media, e-commerce, banking and work accounts, hackers can automate account hijacking or account takeover.
This database makes finding passwords faster and easier than ever before. As an example searching for “admin,” “administrator” and “root” returned 226,631 passwords of admin users in a few seconds.
The data is organized alphabetically, offering examples of trends in how people set passwords, reuse them and create repetitive patterns over time. The breach offers concrete insights into password trends, cementing the need for recommendations, such as the NIST Cybersecurity Framework.
… (emphasis in original)
The full post goes onto discuss sources of the data, details of the dump file, freshness and password reuse. See Casal’s post for those details.
But no links were provided to the:
“…largest trove ever of sensitive credentials in an underground community forum.”
How would you go about verifying such a discovery?
The post offers the following hints:
- “…single file … 1.4 billion clear text credentials”
- dump contains file “imported.log”
- list shown from “imported.log” has 55 unique file names
With #1, clear text credentials, I should be able to search for #2 “imported.log” and one of fifty-five (55) unique file names to come up with a fairly narrow set of search results. Not perfect but not a lot of manual browsing.
All onion search engines have .onion addresses.
Ahmia Never got to try one of the file names, “imported.log” returns 0 results.
Caronte I entered “imported.log,” but Caronte searches for “imported log.” Sigh, I really tire of corrective search interfaces. You? No useful results.
Haystack 0 results for “imported.log.”
Not Evil 3973 “hits” for “imported.log.” With search refinement, still no joy.
Bottom line: No verification of the reported credentials discovery.
Possible explanations:
- Files have been moved or renamed
- Forum is password protected
- Used the wrong Dark Web search engines
- …
Verification is all the rage in mainstream media.
How do you verify reports of content on the Dark Web? Or do you?