A record 10 billion passwords were just posted to a popular hacking forum

Status
Not open for further replies.
S

Skye Jacobs

Posts: 44   +2
Staff
Why it matters: Experts say passwords cannot guarantee online security, yet they remain the primary pillar of most people's digital protection. That is why the recent posting of a database containing nearly 10 billion unique plaintext passwords has raised alarms in security circles. Here are some tips to determine if your password is among them and how to shore up your defenses.

Last week, a user going by the handle "ObamaCare" posted what cybersecurity experts believe to be the largest compilation of passwords ever posted to a hacking forum. The file, titled rockyou2024.txt, contains 9,948,575,739 unique plaintext passwords. ObamaCare has a history of leaking data, including an employee database from the law firm Simmons & Simmons, a lead from an online casino AskGamblers, and student applications for Rowan College at Burlington County.

"Xmas came early this year," ObamaCare wrote on the forum. "I present to you a new rockyou2024 password list with over 9.9 billion passwords!"

Cybernews determined that these passwords came from old and new data breaches built on a prior "RockYou2021" compilation with 8.4 billion passwords. A net of 1.5 billion sets of credentials certainly lessens the dump's impact. However, 1.5 billion is still a massive number of passwords at risk, so experts are correct in warning this database can be a potent tool for hackers.

According to Verizon's 2021 Data Breach Investigations Report, 61 percent of breaches stem from leveraged credentials. Google Cloud's 2023 Threat Horizons Report puts that share even higher, finding that 86 percent of breaches involve stolen passwords. Both online and offline services, as well as internet-facing cameras and industrial hardware, are at risk. Worse yet, RockYou2024 could facilitate a wave of data breaches, financial fraud, and identity theft when combined with other leaked databases containing email addresses and credentials.

Cybernews has an online tool to help users check for compromised passwords. The Leaked Password Checker allows anybody to enter their password to see if it appears in any known breaches, including RockYou2024. Alternatively, Have I Been Pwned has a similar lookup tool to check if your email address or password has been part of a data breach.

If your password is compromised, change it immediately and create a separate one for each account. Other security tips that bear repeating include enabling multi-factor authentication, which requires additional verification beyond just a password, and using a password manager. These tools can generate and store complex passwords for you, reducing the risk of password reuse.

Permalink to story:

A record 10 billion passwords were just posted to a popular hacking forum

 
Your password will ALWAYS get compromised eventually. The reason for this is that the company/website you are a part of will eventually get hacked and its DB will be leaked…

Password complexity only protects (slightly) against a brute force hacker - which is rarer and rarer these days. If they’re using one of these leaked pw dumps, the complexity of your password is irrelevant.

Using a password manager only exacerbates the problem - as THEY can be hacked and their database leak will now contain ALL of your accounts/passwords conveniently in one place for the hacker!

Enable 2fa in everything you can - that is the best protection, which, while not perfect, will at least protect you from most hacking attempts.
 
Last edited:
  • Like
Reactions: waclark, Clynt, Underdog and 6 others
Yes 2FA will at least keep you safe, if you don't mind the notifications in the case someone bruteforces your account. I had my BattleNet, RockStar and other accounts secured with 2FA and received a load of notifications that someone from other country tries to login. Changed the password for each right away.
 
  • Like
Reactions: p51d007, Aus spot and godrilla
Jme Kerul said:
Well there was a time when I remembered my passes, now all of them are 32 chars or more long and stored in a manager.
Does your manager checks for compromised passes?
Click to expand...
There are tools that read from password lists like these, continually retrying the next password in the list until all have been attempted. Usernames generally not required (obtained elsewhere but most are public anyways).
This could be a good resource for system administrators to make a tool that checks user passwords against this list, to be sure that no account passwords have been compromised.
 
  • Like
Reactions: Clynt and trieste1s
Squid Surprise said:
Your password will ALWAYS get compromised eventually. The reason for this is that the company/website you are a part of will eventually get hacked and its DB will be leaked…

Password complexity only protects (slightly) against a brute force hacker - which is rarer and rarer these days. If they’re using one of these leaked pw dumps, the complexity of your password is irrelevant.

Using a password manager only exacerbates the problem - as THEY can be hacked and their database leak will now contain ALL of your accounts/passwords conveniently in one place for the hacker!

Enable 2fa in everything you can - that is the best protection, which, while not perfect, will at least protect you from most hacking attempts.
Click to expand...
No, it's not "always", I have 835 logins ATM, and only 3 of them have been compromised after 20 years of online activity, so please stop talking nonsense. Password managers do work. Their task isn't to reduce breaches by 100%, it's to reduce the impact. There's no bulletproof solution to anything that is security.
 
  • Like
Reactions: lonetac and hahahanoobs
Squid Surprise said:
Your password will ALWAYS get compromised eventually. The reason for this is that the company/website you are a part of will eventually get hacked and its DB will be leaked…

Password complexity only protects (slightly) against a brute force hacker - which is rarer and rarer these days. If they’re using one of these leaked pw dumps, the complexity of your password is irrelevant.

Using a password manager only exacerbates the problem - as THEY can be hacked and their database leak will now contain ALL of your accounts/passwords conveniently in one place for the hacker!

Enable 2fa in everything you can - that is the best protection, which, while not perfect, will at least protect you from most hacking attempts.
Click to expand...

I have mixed feelings on 2fa. The main flaw is if something happens to your other device, typically it is a smart phone. If it broken or etc you get really screwed. My wife went through hell when she got her new phone since they just swapped and did not even think about waiting to setup the 2fa on the new one before handing over the old one. As you stated it is not perfect.
 
  • Like
Reactions: hahahanoobs and Squid Surprise
Squid Surprise said:
Password complexity only protects (slightly) against a brute force hacker
Click to expand...
Remove that word "slightly" and your statement is correct. A 9-character password is more than 100,000 times harder to crack via brute force than six characters, and a 32-char password roughly 15,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 harder.

Squid Surprise said:
Using a password manager only exacerbates the problem - as THEY can be hacked and their database leak will now contain ALL of your accounts/passwords conveniently in one place for the hacker!
Click to expand...
I have to agree that these managers are more about a false sense of security than anything else ... especially if you use one of the online (gasp!) ones.
 
bviktor said:
No, it's not "always", I have 835 logins ATM, and only 3 of them have been compromised after 20 years of online activity, so please stop talking nonsense. Password managers do work. Their task isn't to reduce breaches by 100%, it's to reduce the impact. There's no bulletproof solution to anything that is security.
Click to expand...
You THINK that only 3 have been compromised… the other 832 are simply a matter of time (if they haven’t already been compromised without your knowledge).

You hear about a data breach on some company/website all the time - and for every one you hear about, there are a few you DON’T hear about, as they don’t want to shake customer confidence…

Companies care more about the APPEARANCE of customer security rather than actual customer security as they’ve realized it’s virtually impossible to do.

Password managers work… until they don’t…
 
Endymio said:
Remove that word "slightly" and your statement is correct. A 9-character password is more than 100,000 times harder to crack via brute force than six characters, and a 32-char password roughly 15,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 harder.
Click to expand...
You are technically correct - I didn’t just mean regular brute force - yes, the longer and more complex the password, the better you are protected from simple brute force but…

Nowadays, few hackers use simple brute force. They “brute force” using a password list (like the one mentioned in this article) which is made of compromised passwords. I understand that this isn’t technically brute force (it’s a dictionary attack), but as the lists contain billions of words, it’s become common practice to call it brute forcing.

Assuming your password is on that list (which it will eventually be if you aren’t changing it all the time - making it so much for annoying to remember), the complexity is irrelevant.
 
Squid Surprise said:
You THINK that only 3 have been compromised… the other 832 are simply a matter of time (if they haven’t already been compromised without your knowledge).

You hear about a data breach on some company/website all the time - and for every one you hear about, there are a few you DON’T hear about, as they don’t want to shake customer confidence…

Companies care more about the APPEARANCE of customer security rather than actual customer security as they’ve realized it’s virtually impossible to do.

Password managers work… until they don’t…
Click to expand...
An exposed password on its own is little concern to the masses without the username and/or where it's used.

Most will be fine suggesting strong passwords with their password managers and changing them when necessary.

I'll adjust my practices when it's warranted. This isn't the time.
 
stewi0001 said:
I have mixed feelings on 2fa. The main flaw is if something happens to your other device, typically it is a smart phone. If it broken or etc you get really screwed. My wife went through hell when she got her new phone since they just swapped and did not even think about waiting to setup the 2fa on the new one before handing over the old one. As you stated it is not perfect.
Click to expand...
Spare a thought for those that don't have a smartphone. One day it may be impossible to survive without being surgically implanted with one.
 
  • Like
Reactions: Clynt, wiyosaya and Squid Surprise
hahahanoobs said:
An exposed password on its own is little concern to the masses without the username and/or where it's used.

Most will be fine suggesting strong passwords with their password managers and changing them when necessary.

I'll adjust my practices when it's warranted. This isn't the time.
Click to expand...
Yeah… keep telling yourself that… having your credentials stolen doesn’t concern you… until it does.

It’s like those people who leave their car unlocked and say “my car has never been stolen, so why bother?” Well, it just has to happen once - and while insurance might cover the cost of a car, it’s much harder to recover the cost/agony of a stolen account.
 
As I see it, the key word in this article is "plaintext." If any dumb-*** web site is going to store their passwords in clear text, and apparently there are STILL a large amount of dumb-*** web sites, passwords are going to get stolen. Such dumb-*** web sites will never learn, apparently.

I don't think this is such a great feat by this "hacker". Clear text, after all. Almost anyone could have done this having harvested enough dumb-*** clear text web sites.
 
Last edited:
wiyosaya said:
As I see it, the key word in this article is "plaintext." If any dumb-*** web site is going to store their passwords in clear text, and apparently there are STILL a large amount of dumb-*** web sites, passwords are going to get stolen. Such dumb-*** web sites will never learn, apparently.

I don't think this is such a great feat by this "hacker". Clear text, after all. Almost anyone could have done this having harvested enough dumb-*** clear text web sites.
Click to expand...
Yep - but there are also companies that get completely hacked by some group (see Microsoft), and have their encrypted password lists decrypted and spread to malicious actors.

Companies never mention if that happens to them - it almost certainly happened to MS but they will never admit it. And I’m wagering that most people here have an account with MS… not to mention Amazon, Google, etc…
 
Squid Surprise said:
Yep - but there are also companies that get completely hacked by some group (see Microsoft), and have their encrypted password lists decrypted and spread to malicious actors.

Companies never mention if that happens to them - it almost certainly happened to MS but they will never admit it. And I’m wagering that most people here have an account with MS… not to mention Amazon, Google, etc…
Click to expand...
As I see it, what you've said is that some companies have taken dumb-*** to another level. Encryption that weak that it can be broken is about as good as storing everything plaintext, whether it's Google, Amazon, or MS or whatever company.

In the US, anyway, it is law that public companies disclose hacking attempts within four days with exceptions only for national security. https://apnews.com/article/sec-cybe...risk-hacking-bb6252463637793bfdc8ace5bfcbe7df If they are not disclosing such attacks in the US, they can expect that they are afoul of the law and very well may get prosecuted for it.
 
wiyosaya said:
As I see it, what you've said is that some companies have taken dumb-*** to another level. Encryption that weak that it can be broken is about as good as storing everything plaintext, whether it's Google, Amazon, or MS or whatever company.

In the US, anyway, it is law that public companies disclose hacking attempts within four days with exceptions only for national security. https://apnews.com/article/sec-cybe...risk-hacking-bb6252463637793bfdc8ace5bfcbe7df If they are not disclosing such attacks in the US, they can expect that they are afoul of the law and very well may get prosecuted for it.
Click to expand...
There is the law… and then there’s reality… and while hacking attempts may be disclosed, they rarely disclose WHAT was hacked…

How often have you heard a company say they were hacked, but “don’t worry, no customer data was compromised.”? Yet, shortly after, a data dump with a bunch of passwords - or credit card/SSN/addresses/phone numbers/etc gets put in the dark web…

If MS can get hacked, ANY company can - and probably will.
 
hahahanoobs said:
An exposed password on its own is little concern to the masses without the username and/or where it's used.
Click to expand...
Eh? You think these lists are just that? Random unassociated passwords? In nearly all cases, it's a username/password pair, sometimes including where it was actually used. And even a raw password in itself compromises the person who uses it to dictionary-style attacks.
 
  • Like
Reactions: Squid Surprise
Squid Surprise said:
Yeah… keep telling yourself that… having your credentials stolen doesn’t concern you… until it does.

It’s like those people who leave their car unlocked and say “my car has never been stolen, so why bother?” Well, it just has to happen once - and while insurance might cover the cost of a car, it’s much harder to recover the cost/agony of a stolen account.
Click to expand...
This breach is like someone getting the last four digits of a phone number without even knowing the city it's from.

All my passwords are strong and unique.
Wake me when they get more than a few digits.
 
hahahanoobs said:
This breach is like someone getting the last four digits of a phone number without even knowing the city it's from.

All my passwords are strong and unique.
Wake me when they get more than a few digits.
Click to expand...
Well, if your password is on a list, they have that AND your username… so if you don’t have 2FA, they got your account…

The length/complexity of your password only protects against brute force - and almost no one is doing that nowadays… they are using dictionary attacks with these lists…

This isn’t that hard to understand, is it?
 
Status
Not open for further replies.

Similar threads

midian182
Apple set to launch Passwords app, taking on LastPass and 1Password
Replies
9
Views
249
GhostLegion
G
midian182
Indonesia just realized it has no backups after data centers are hit with ransomware
Replies
3
Views
72
nismo91
N
Shawn Knight
Steve Ballmer's net worth just passed Bill Gates for the first time ever
Replies
10
Views
119
Gezzer
G

Latest posts

Back