If you’re reading this, you are certainly aware of the story of Hold Security’s recent announcement of 1,200,000,000 unique user ID and passwords being uncovered.
I’m not going to pile on to the stories that assert this is a PR stunt by Hold. In fact, I think Hold has done some great things in the past, in conjunction with Brian Krebs in uncovering some significant breaches.
However, there are a few aspects of Hold’s announcement that just don’t make sense… At least to me:
The announcement is that 1.2B usernames and passwords were obtained through a combination of pilfering other data dumps – presumably from the myriad of breaches we know of, like eBay, Adobe, and so on, but also from a botnet that ran SQL injection attacks on web sites visited by the users of infected computers which apparently resulted in database dumps from many of those web sites. 420,000 of them, in fact.
That seems like a plausible story. The SQL injection attack most likely leveraged some very common vulnerabilities – probably in WordPress plugins or in Joomla or something similar. However, nearly all of the passwords obtained, certainly the ones from the SQL injection attacks, would be hashed in some manner. Even the Adobe and eBay password dumps were at least “encrypted” – whatever that means.
The assertion is that there were 4.5B “records” found, which netted out to 1.2B unique credentials, belonging to 500M unique email addresses.
I contend that this Russian gang having brute forced 1.2B hashed and/or encrypted passwords is quite unlikely. The much more likely case is that the dump contains 1.2B email addresses and hashed or encrypted passwords… Still not a great situation, but not as dire as portrayed, at least for the end users.
If the dump does indeed have actual plain text passwords, which again is not clear from the announcement, I suspect the much more likely source would be phishing campaigns and/or keyloggers, potentially run by that botnet. However, I believe that Hold would probably have seen evidence if that were the case and would most likely have said as much in the announcement, since it would be an even more interesting story.
Hold is clearly in communication with some of the organizations where records were stolen from ,as indicated in the announcement. What isn’t clear is whether all of the recognizable organizations were attempted to be contacted, or only the largest, or only those that had a previous agreement in place with Hold. Certainly Hold has found an interesting niche and is attempting to capitalize on it – and that makes sense to me. However, it’s going to be a controversial business model that requires organizations to pay Hold in order to be notified if or when Hold finds evidence that the organization’s records have been found. I’m not going to pass judgement yet.