“Following the revelation that a list of millions of stolen usernames and passwords had appeared online, we share a few different ways to find out if your credentials were stolen in any security breach”, says Carey van Vlaanderen, CEO at ESET South Africa.
In mid-January, researcher Troy Hunt revealed that a list was floating around in the storage space of MEGA cloud as well as in several hacking forums. Going by the name of Collection#1, it contains the largest theft of passwords organised into a list to date, comprising more than 700 million email addresses and more than 20 million passwords.
Once we hear something about this, it is only natural that we might wonder if our own email addresses and/or passwords we use to access our accounts are among them, or if they have been snatched as part of any other infiltration or security breach. Discovering if our credentials have been robbed or not can also give us an idea of whether the passwords we are choosing when we register with a new service, or when we update our password, are sufficiently secure. In this article we will tell you how to find out if your email address or password has been stolen and to check if passwords you are choosing are secure or not.
The first service we are going to look at is Have I Been Pwned. This service allows users to check if their email address has been stolen and included in any of the various lists of email and password information circulating online. Furthermore, their address database is kept up to date and includes the emails and passwords which were stolen recently.
Upon entering the site, the user will be able to view a database of more than 6 billion accounts which have at some point been stolen.
ESET decided to check an email address and saw that unfortunately the address entered had indeed been stolen at some point. Scrolling in the page, they saw more details of the types of services that compromised the email address that was being checked.
The information is sorted by date and by the hacked sites where the information was stolen. For example, there are well-known cases such as the LinkedIn and Taringa data breaches, as well as some of the lists which regularly do the rounds and contain data collated from various websites.
Once we know this, what can they do? It goes without saying that users should change their passwords on the websites mentioned, but it is also very common for people to use the same credentials for more than one website or service, so the user needs to change the stolen passsword on all the websites they use it on, because once their password is in someone else’s hands, we cannot know how many different websites they might try and log into with those credentials.
When it comes to choosing a new password we recommend another very useful tool on the same website. This time, the website tells you how many times the password you enter has been used and subsequently stolen.
Another important thing to keep in mind when choosing a secure password, besides checking if it appears in any database of stolen passwords, is to follow good practices.
• Use a combination of alphanumeric characters
• Use special characters
• It should be at least eight characters long (and more than 10 will give you even more security against a brute force attack)
• In addition, consider using two-factor authentication, which adds a second layer of security on top of your chosen password.
But the most important thing is for it to be easy for us to remember, because if racking our brains to think of it results in writing it down on a piece of paper or, even worse, sticking it to the bottom of the monitor – or indeed any of the other myriad solutions we have come across – then all the security measures we have used will prove to be worthless.
For users who use a password manager such as KeePass, which allows you to generate more secure combinations and store them encrypted with the password manager itself, there is the option to compare all the passwords you have in it against a Have I been Pwned database, thanks to a tool published on GitHub.
The application is called kdbxpasswordpwned and it allows you to automatically compare all the passwords you have stored in KeePass versus the database of stolen passwords. The application is aimed at users with above-average technical knowledge.)
And to give one last tip, we should be wary if we receive emails in which the sender tries to extort money out of us on the grounds that they have our passwords. At ESET, the company has seen fake sextortion campaigns are still taking place, in which the recipient is sent an email containing their password in the message (either in the subject line or in the first few lines of body text) and is asked to pay an amount of money.
Remember to change your passwords regularly, even if the applications and services you use don’t ask you to and use two-factor authentication on the services that allow it. By doing so, you can keep your personal data more secure and reduce chances of someone else gaining access to it.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version