More than 3.2 billion unique pairs of cleartext emails and passwords have just been leaked on a popular hacking forum, aggregating past leaks from Netflix, LinkedIn, Exploit.in, Bitcoin and more.
This leak is comparable to the Breach Compilation of 2017, in which 1.4 billion credentials were leaked.
However, the current breach, known as “Compilation of Many Breaches” (COMB), contains more than double the unique email and password pairs. The data is currently archived and put in an encrypted, password-protected container.
The leaked database includes a script named count_total.sh, which was also included in 2017’s Breach Compilation. This breach also includes two other scripts: query.sh, for querying emails, and sorter.sh for sorting the data.
After running the count_total.sh script, which is a simple bash script to count the total lines in each of the files and add them together, we can see there are more than 3.27 billion email and password pairs:
We are currently adding the new COMB emails to our Personal Data Leak Checker. The CyberNews Personal Data Leak Checker has the largest database of known breached accounts, helping users know if their data has possibly fallen into the hands of cybercriminals.
Check out our personal data leak checker now to see if your email address has been exposed in this or previous leaks.
This does not appear to be a new breach, but rather the largest compilation of multiple breaches. Much like 2017’s Breach Compilation, COMB’s data is organized by alphabetical order in a tree-like structure, and it contains the same scripts for querying emails and passwords.
In the screenshots attached with the leak, the organization of the data can be seen, as well as the type of data released. Below, the data has been blurred by CyberNews:
At the moment, it is unclear what previously leaked databases are collected in this breach. Samples seen by CyberNews contained emails and passwords for domains from around the world.
CyberNews Pro tip
Don’t let another data breach scare you. Password managers create not only strong and unique passwords, but they’ll also alert you when your credentials have been leaked.
Learn more about password managers
Similar to Breach Compilation
This current leaked database appears to build on 2017’s Breach Compilation. In that leak, intelligence analysts at 4iQ discovered a single file database with 1.4 billion email and password pairs, all in plaintext.
At the time, this was considered the largest credential breach exposure, almost two times larger than the previous largest credential exposure from Exploit.in which had nearly 800 million records.
2017’s Breach Compilation contained 252 previous breaches, including the aggregated ones from the previous Anti Public and Exploit.in dumps, as well as LinkedIn, Netflix, Minecraft, Badoo, Bitcoin and Pastebin. However, when they analyzed the data, they found that “14% of exposed username/passwords pairs had not previously been decrypted by the community and are now available in clear text.”
When 4iQ discovered the Breach Compilation, they tested a small subset of the passwords for verification, and most of the tested passwords worked. The intelligence analysts state that they found the 41GB dump on December 5, 2017, with the latest data updated on November 29, 2017.
They also remarked that the leak was not just a list, but rather an “interactive database” that allowed for “fast (one second response) searches and new breach imports. Given the fact that people reuse passwords across their email, social media, e-commerce, banking and work accounts, hackers can automate account hijacking or account takeover.”
It is unclear what the repercussions of the Breach Compilation have been.
Possible impact
The impact to consumers and businesses of this new breach may be unprecedented. Because the majority of people reuse their passwords and usernames across multiple accounts, credential stuffing attacks is the biggest threat.
If users use the same passwords for their LinkedIn or Netflix as they do their Gmail accounts, attackers can pivot to other more important accounts.
Beyond that, users whose data has been included in Compilation of Many Breaches may become victims of spear-phishing attacks, or they may receive high levels of spam emails.
In any case, users are normally recommended to change their passwords on a regular basis, and to use unique passwords for every account. Doing so – creating and remembering unique passwords – can be quite challenging, and we recommend users get password managers to help them create strong passwords.
And, of course, users should add multi-factor authentication, like Google Authenticator, on their more sensitive accounts. That way, even if an attacker has their username and password, they won’t be able to get into their accounts.
We will continue to analyze the data as the story unfolds
Fonte: CyberNews
INTERNATIONAL NEWS
Crypto ID publishes international articles about information security, digital transformation, cyber security, encryption and related topics.
Please check here!
STF cobra investigação do governo sobre vazamento de CPFs
- HID & Santander team to secure mobile banking with authentication technology
- Unlocking the Potential of the Brazilian Blockchain and Digital Finance Market
- Why We Must Democratize Cybersecurity
- Mejora CIAM la experiencia del cliente y la seguridad de sus datos
- AI and the Rise of Mediocrity
- Las empresas que usan biometría celebran una ley de IA que ofrece “garantías” y “sienta las bases del juego”
- Next steps in preparing for post-quantum cryptography
- 10 Reasons to Prescribe Facial Recognition in Healthcare for Patient Identification
- Malware Hunting – Dissecting PDF file.
- NAAT TECH protege la identidad digital contra el fraude, deepfake y digital injection
