sb-eu logo
Story image

There are 320 million breached passwords available online right now

18 Sep 2017

Right now there are more than 320 million compromised passwords, and they’re all available online.

According to Troy Hunt, the mastermind between email breach checking site haveibeenpwned.com, released a service that allows users to check if any of their passwords have been stolen.

Hunt launched the site, haveibeenpwned.com/passwords last month, which compiles passwords lists from legitimate breach sources, all with verified accuracy.

Unsurprisingly, passwords such as 123456 have appeared in previous data breaches, along with Mypassword, P@ssw0rd, letmein and millions of others.

‘Oh no – pwned! This password has previously appeared in a data breach ad should never be used. If you’ve ever used it anywhere before, change it immediately!” a warning on the site says.

In a blog, Hunt says the purpose of the site is to show people that passwords they have used in the past may have been breached, and if they still use that password, to change it immediately.

Hunt warns that users shouldn’t enter any password they currently use into any third party website.

“The point of the web-based service is so that people who have been guilty of using sloppy passwords have a means of independent verification that it's not one they should be using any more. Mind you, someone could actually have an exceptionally good password but if the website stored it in plain text then leaked it, that password has still been burned”, he says in the blog.

Hunt has also made the entire database of emails passwords available for download to the public – a ZIP file that, when compressed, tops 5.3GB of data.

Hunt specifies that while password reuse is common, it is also risky and users are not aware how serious it could be.

Credential stuffing can find reused passwords and then automate login attempts against previously discovered emails and passwords. This means it’s more likely for attackers to gain access to more than one account that used a particular username and password.

Hunt also designed the password checker to reach SHAI hashes of particular passwords.

He warns that just because a password doesn’t come up in search results, it does not necessarily mean that password was not used in a breach.

When people are thinking about registering for a new website, Hunt says that they should run their potential passwords through the password checker. That password may seem strong, but it has been used elsewhere and should be considered as useless.

Hunt suggests that organisations can take not only the website but its data to educate staff.

“When someone gets a 'hit' on a Pwned Password, help them understand the broader risk profile and what this means to their personal security,” Hunt says.

Story image
Report: 151% increase in DDoS attacks compared to 2019
It comes as the security risk profile for organisations around the world increased in large part thanks to the COVID-19 pandemic, forcing greater reliance on cloud technology and thrusting digital laggards into quick and unsecured migrations.More
Story image
Emotet malware is on a rampage after months of silence
CERT agencies around the world are reporting a surge in cyber attacks related to the Emotet malware, which is being distributed by email.More
Story image
The guide to digital security in unstable times
An increase in vulnerability across different sectors has meant that 2020 has seen more than its fair share of cybersecurity incidents. One of the most effective ways to combat the perils of today’s cyber-threats is to gain a better knowledge of the threat vectors looming over the heads of organisations. More
Story image
Strong cybersecurity posture crucial for company success - Fortinet
"They should also conduct due diligence to ensure partners aren’t inadvertently creating vulnerabilities with insufficient cybersecurity measures."More
Story image
BT Security shakes up roster of vendors after 'largest ever' partner review
BT says the decision to review their security partner base was driven by the recognition that many customers find it difficult to navigate today’s complex security landscape, as well as customers’ desire to have a ‘leaner set of partners’.More
Story image
Cryptomining trojan malware discovered by ESET researchers
The malware, primarily targeting victims in Czechia and Slovakia, prioritises subterfuge through deployment of multiple techniques to avoid detection, and leans heavily on the Tor network and BitTorrent protocol to achieve its goals.More