classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn

Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2018

How to spot if your password was stolen in a security breach
March 2019, Cyber Security

“Following the revelation that a list of millions of stolen usernames and passwords had appeared online, we share a few different ways to find out if your credentials were stolen in any security breach”, says Carey van Vlaanderen, CEO at ESET South Africa.

In mid-January, researcher Troy Hunt revealed that a list was floating around in the storage space of MEGA cloud as well as in several hacking forums. Going by the name of Collection#1, it contains the largest theft of passwords organised into a list to date, comprising more than 700 million email addresses and more than 20 million passwords.

Once we hear something about this, it is only natural that we might wonder if our own email addresses and/or passwords we use to access our accounts are among them, or if they have been snatched as part of any other infiltration or security breach. Discovering if our credentials have been robbed or not can also give us an idea of whether the passwords we are choosing when we register with a new service, or when we update our password, are sufficiently secure. In this article we will tell you how to find out if your email address or password has been stolen and to check if passwords you are choosing are secure or not.

The first service we are going to look at is Have I Been Pwned. This service allows users to check if their email address has been stolen and included in any of the various lists of email and password information circulating online. Furthermore, their address database is kept up to date and includes the emails and passwords which were stolen recently.

Upon entering the site, the user will be able to view a database of more than 6 billion accounts which have at some point been stolen.

ESET decided to check an email address and saw that unfortunately the address entered had indeed been stolen at some point. Scrolling in the page, they saw more details of the types of services that compromised the email address that was being checked.

The information is sorted by date and by the hacked sites where the information was stolen. For example, there are well-known cases such as the LinkedIn and Taringa data breaches, as well as some of the lists which regularly do the rounds and contain data collated from various websites.

Once we know this, what can they do? It goes without saying that users should change their passwords on the websites mentioned, but it is also very common for people to use the same credentials for more than one website or service, so the user needs to change the stolen passsword on all the websites they use it on, because once their password is in someone else’s hands, we cannot know how many different websites they might try and log into with those credentials.

When it comes to choosing a new password we recommend another very useful tool on the same website. This time, the website tells you how many times the password you enter has been used and subsequently stolen.

Another important thing to keep in mind when choosing a secure password, besides checking if it appears in any database of stolen passwords, is to follow good practices.

Use a combination of alphanumeric characters

• Use special characters

• It should be at least eight characters long (and more than 10 will give you even more security against a brute force attack)

• In addition, consider using two-factor authentication, which adds a second layer of security on top of your chosen password.

But the most important thing is for it to be easy for us to remember, because if racking our brains to think of it results in writing it down on a piece of paper or, even worse, sticking it to the bottom of the monitor – or indeed any of the other myriad solutions we have come across – then all the security measures we have used will prove to be worthless.

For users who use a password manager such as KeePass, which allows you to generate more secure combinations and store them encrypted with the password manager itself, there is the option to compare all the passwords you have in it against a Have I been Pwned database, thanks to a tool published on GitHub.

The application is called kdbxpasswordpwned and it allows you to automatically compare all the passwords you have stored in KeePass versus the database of stolen passwords. The application is aimed at users with above-average technical knowledge.)

And to give one last tip, we should be wary if we receive emails in which the sender tries to extort money out of us on the grounds that they have our passwords. At ESET, the company has seen fake sextortion campaigns are still taking place, in which the recipient is sent an email containing their password in the message (either in the subject line or in the first few lines of body text) and is asked to pay an amount of money.

Remember to change your passwords regularly, even if the applications and services you use don’t ask you to and use two-factor authentication on the services that allow it. By doing so, you can keep your personal data more secure and reduce chances of someone else gaining access to it.

  Share via Twitter   Share via LinkedIn      

Further reading:

  • Halt, who goes there?
    March 2019, Technews Publishing, Wolfpack Information Risk, This Week's Editor's Pick, Cyber Security
    As long as organisations treat their physical and cyber domains as separate, there is little hope of securing either one.
  • IoT is convergence in action
    March 2019, Gijima Electronic and Security Systems (GESS), NEC XON, Technews Publishing, Axiz, G4S South Africa, This Week's Editor's Pick, Cyber Security, Integrated Solutions, IT infrastructure
    The Internet of Things gains more than enough attention these days, but the IoT demonstrates the reality of the convergence between the physical and cyber worlds, and physical security is part of it.
  • Stop hacking of access control ­systems
    March 2019, This Week's Editor's Pick, Access Control & Identity Management, Cyber Security
    Think someone hacking your access control system not a big deal? Scott Lindley suggests that you think again.
  • New cybersecurity pavilion for Securex 2019
    March 2019, Securex South Africa , This Week's Editor's Pick, Cyber Security, News, Conferences & Events, Training & Education
    Securex South Africa 2019 has announced that 4Sight Technologies, a subsidiary of an international holdings company focusing on investing in Industry 4.0 companies, has signed on as the official sponsor ...
  • Security by design
    March 2019, Johnson Controls, Cyber Security, Integrated Solutions
    The security of the platforms on which physical security products are built will increasingly impact purchase decisions and market positions.
  • A logical solution for cyber solutions
    March 2019, Suprema, Cyber Security, Access Control & Identity Management, Products
    BioMini Slim 2 is a thin, FBI PIV and FBI Mobile ID certified FAP20 optical scanner with a large platen for easy capturing of fingerprints.
  • Managed IT security solution
    March 2019, Cyber Security, IT infrastructure, Products
    The LanDynamix fully managed IT security stack ensures that all the main attack vectors typically used by hackers to breach a network are protected and proactively monitored.
  • Top five security trends to look out for in 2019
    March 2019, Genetec, CCTV, Surveillance & Remote Monitoring, Cyber Security
    From the continued focus on cybersecurity to the acquisition of global players, Genetec highlights the top five security trends to look forward to in 2019.
  • Cyber Risk 101
    March 2019, Cyber Security
    What every business needs to know about protecting themselves in case of a cyber-attack.
  • Securing IoT, step by step
    March 2019, IT infrastructure, Cyber Security
    Kaspersky Lab joins forces with industry leaders to deliver actionable technical guidance for multiple IoT stakeholders.
  • ESET launches a new blog aimed at insecure Android apps
    March 2019, Cyber Security
    Insecure apps are much harder to identify and protect, while being no less of a threat.
  • The legalities of the digital signature
    March 2019, This Week's Editor's Pick, Cyber Security, Security Services & Risk Management
    Electronic signatures and digital signatures differ significantly; it is critical that organisations recognise the legal implications of the electronic signature and the risk of fraud.

Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Terms & conditions of use, including privacy policy
PAIA Manual
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.