Report: Russian Hackers Steal 1.2 Billion Passwords

View Comments
Latest News

NEW YORK — Russian hackers have stolen 1.2 billion user names and passwords in a series of Internet heists affecting 420,000 websites, according to a report published Tuesday.

The thievery was described in a New York Times story based on the findings of Hold Security, a Milwaukee firm that has a history of uncovering online security breaches.

Hold Security didn’t immediately respond to inquiries from The Associated Press.

The identities of the websites that were broken into weren’t identified by the Times, which cited nondisclosure agreements that required Hold Security to keep some information confidential.

The reported break-ins are the latest incidents to raise doubts about the security measures that both big and small companies use to protect people’s information online.

Security experts believe hackers will continue breaking into computer networks unless companies become more vigilant.

“Companies that rely on usernames and passwords have to develop a sense of urgency about changing this,” Avivah Litan, a security analyst at the research firm Gartner told the Times.

Retailer Target Corp. is still struggling to win back its shoppers’ trust after hackers believed to be attacking from Eastern Europe stole 40 million credit card numbers and 70 million addresses, phone numbers and other personal information last winter.

Alex Holden, the founder and chief information security officer of Hold Security, told the Times that most of the sites hit by the Russian hackers are still vulnerable to further break-ins. Besides filching 1.2 billion online passwords, the hackers also have amassed 500 million email addresses that could help them engineer other crimes, according to Hold Security.

So, far little of the information stolen in the wave of attacks appears to have been sold to other online crooks, according to the Times. Instead, the information is being used to send marketing pitches, schemes and other junk messages on social networks on Twitter, the newspaper said.

The breadth of these break-ins should serve as a chilling reminder of the skullduggery that has been going undetected on the Internet for years, said John Prisco, CEO of another security firm, Triumfant.

“This issue reminds me of an iceberg, where 90 percent of it is actually underwater,” Prisco said in an emailed statement. “That’s what is going on here… So many cyber breaches today are not actually reported, often times because companies are losing information and they are not even aware of it.”

Some tips for creating better, stronger passwords:

• Make your password long. The recommended minimum is eight characters, but 14 is better and 25 is even better than that. Some services have character limits on passwords, though.

• Use combinations of letters and numbers, upper and lower case and symbols such as the exclamation mark. Some services won’t let you do all of that, but try to vary it as much as you can. “PaSsWoRd!43″ is far better than “password43.”

• Avoid words that are in dictionaries, even if you add numbers and symbols. There are programs that can crack passwords by going through databases of known words. One trick is to add numbers in the middle of a word — as in “pas123swor456d” instead of “password123456.” Another is to think of a sentence and use just the first letter of each word — as in “tqbfjotld” for “the quick brown fox jumps over the lazy dog.”

• Substitute characters. For instance, use the number zero instead of the letter O, or replace the S with a dollar sign.

• Avoid easy-to-guess words, even if they aren’t in the dictionary. You shouldn’t use your name, company name or hometown, for instance. Avoid pets and relatives’ names, too. Likewise, avoid things that can be looked up, such as your birthday or ZIP code. But you might use that as part of a complex password. Try reversing your ZIP code or phone number and insert that into a string of letters. As a reminder, you should also avoid “password” as the password, or consecutive keys on the keyboard, such as “1234” or “qwerty.”

• Never reuse passwords on other accounts — with two exceptions. Over the years, I’ve managed to create hundreds of accounts. Many are for one-time use, such as when a newspaper website requires me to register to read the full story. It’s OK to use simple passwords and repeat them in those types of situations, as long as the password isn’t unlocking features that involve credit cards or posting on a message board. That will let you focus on keeping passwords to the more essential accounts strong.

More Tech News

(© Copyright 2014 The Associated Press. All Rights Reserved. This material may not be published, broadcast, rewritten or redistributed.)

View Comments
blog comments powered by Disqus
Follow

Get every new post delivered to your Inbox.

Join 1,838 other followers