Menu
Massive Russian hack has researchers scratching their heads

Massive Russian hack has researchers scratching their heads

Many questions remain after a security company said it had uncovered a huge database of stolen online credentials

Don't worry, you're not the only one with more questions than answers about the 1.2 billion user credentials amassed by Russian hackers.

Some security researchers on Wednesday said it's still unclear just how serious the discovery is, and they faulted the company that uncovered the database, Hold Security, for not providing more details about what it discovered.

"The only way we can know if this is a big deal is if we know what the information is and where it came from," said Chester Wisniewski, a senior security advisor at Sophos. "But I can't answer that because the people who disclosed this decided they want to make money off of this. There's no way for others to verify."

Wisniewski was referring to an offer by Hold Security to notify website operators if they were affected, but only if they sign up for its breach notification service, which starts at US$120 per year. Individual consumers can find out through its identity protection service, which Hold Security says will be free for the first 30 days.

Hold Security didn't respond to email and telephone requests for comment Wednesday, though it may have been inundated with inquiries.

To recap, Hold Security said Tuesday it had obtained a massive database of stolen credentials amassed by a gang of Russian hackers. The database contains 1.2 billion unique "credential pairs" -- made up of a user ID (mostly email addresses) and an associated password. Looking at email addresses alone, there are "over half a billion," the company said, since some email addresses correspond to multiple passwords.

To assess how serious the discovery is, researchers want to know how old the credentials collected by the Russian gang are, where they came from, and how well-protected the passwords are by "hashing," which scrambles the passwords but can be vulnerable to brute force attack.

The age is important because the older they are, the more likely they are to be disused and less valuable, said Gary Davis, chief consumer security evangelist at McAfee.

Hold Security acknowledged in its announcement that "not all" the credentials are "valid or current," with some associated with fake email addresses, closed accounts or even passwords a decade old.

It's also unclear how many of the login and password credentials were culled online recently by the hacker group, and how many were acquired on the black market from previous hacks.

Hold Security said the hackers began by buying credentials from previously attacked accounts, and then did some hacking work of their own. But it's unclear how many of the 1.2 billion credentials came from previous hacking incidents, and which incidents those were.

"If you take Sony, LinkedIn, eBay and Adobe," said Wisniewski, naming four of the biggest recent password breaches, "that's already 500 million accounts."

Experts said the passwords were likely hashed, a process used by most websites these days. But there are several methods of doing that, and the older "MD5" method, for example, is more vulnerable than a more modern method called "salting," said Wisniewski.

For now, researchers are left guessing and reading between the lines because Hold Security has not released more information.

"It will be interesting to see if public opinion pressures them," said Wisniewski.

Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn's e-mail address is martyn_williams@idg.com

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags sophosmcafeesecuritydata breachHold Security

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments