Amateur developers aren't stepping up password security, and existing leaks continue to resurface. We're seeing more and more passwords leak online. Sure, I got $120 with my Bitcoin address, but when you consider how much time was spent acquiring this stuff (I'm not the hacker, just a collector), and the money (I paid a lot via Bitcoin as well to get certain sets when this stuff was being privately traded on Friday/Saturday) I really didn't get close to what I was hoping for. Similarly, OriginalGuy, the anonymous forum poster behind the first wave of hacked iCloud celebrity photos, expressed dismay at the small trickle of donations that came his way, remarking: The hacker who shared the collection of Dropbox passwords received just 8 cents. It's often less than they expect to receive. We can use the public nature of Bitcoin addresses to see just how much hackers gain for posting passwords online. As we mentioned before, hackers leak partial collection of passwords as "teasers." This is often accompanied by a request for Bitcoin donations.
Or at least, they post some of the information online. Instead, it seems like they just post the information online. So why are hackers re-using old information? There's rarely evidence that they actually use the passwords to log into sites. Sure, many of the email accounts had closed, but the information could still be downloaded and used by hackers to break into other accounts. It wasn't a new leak, but a collection of older password leaks compiled together to seem new. In September, Russian hackers published a list of 5 million passwords to a variety of different email providers, including Gmail.
Chances are that the information works for several sites, so compiling these caches of data together can quickly create a list of millions of passwords.
Instead of spending months finding vulnerabilities in large sites, they re-use login information stolen from amateur third-party apps. We're now seeing hackers use a new approach. Why bother trying to hack into Google, Apple or Facebook's servers when you can simply take advantage of a poorly built website to get the same information? Hackers don't need to try and target the tech giants anymore.
0 kommentar(er)
