{"id":37193,"date":"2014-08-06T14:28:40","date_gmt":"2014-08-06T21:28:40","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=37193"},"modified":"2025-08-19T10:38:48","modified_gmt":"2025-08-19T17:38:48","slug":"russian-hackers-steal-1-2-billion-passwords","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/russian-hackers-steal-1-2-billion-passwords\/","title":{"rendered":"Russian Hackers Steal 1.2 Billion Passwords"},"content":{"rendered":"

On Tuesday afternoon, The New York Times<\/a><\/em> revealed that a group of Russian hackers now holds 1.2 billion username and password combinations and over 500 million email addresses. The hacking group, working under the name CyberVor, apparently holds the largest known database of stolen account credentials in the world and appears to be one of the most complex professional hacking outfits out there.<\/p>\n

There are a number of things to take away from this discovery: first, many people reuse credentials on multiple websites; second, many websites on the Internet\u2014from the smallest blog to Fortune 500 companies\u2014are still vulnerable to basic attacks by hackers; third and finally (and also feeding back to the first), hackers only need to compromise one account to get at nearly all of your information.<\/p>\n

Hold Security, a security firm based out of Milwaukee, Wisconsin, discovered the hacking operation\u2019s database. The New York Times<\/em> had Hold Security\u2019s copy of the database analyzed by an unaffiliated third party and its authenticity was confirmed. So far, Hold Security has refused to name any websites or victims affected by the hacking group due to non-disclosure agreements\u2014but it is willing to check a website\u2019s security for a nominal fee<\/a>.<\/p>\n

SQL Injections<\/h2>\n

So how does one accrue 1.2 billion account credentials? There are a variety of ways, but it boils down to three methods: botnets<\/a>, SQL injections and business deals. Let\u2019s start with SQL injections.<\/p>\n

An SQL injection is a type of attack that takes advantage of website weaknesses in an effort to capture user data. It\u2019s a well-known attack that has been in use for over a decade by both hackers and security professionals. While SQL injections are dated, they are effective mainly because many websites either don\u2019t know they\u2019re vulnerable. It\u2019s also because SQL injections can be automated to operate on their own and on a large scale. In this case, the hacking organization sought websites vulnerable to SQL injection by using botnets\u2014the other key element at play.<\/p>\n

Botnets typically spread by way of links, emails, and popup ads that aim to trick their victims into downloading malicious software (called malware<\/a>). This gives the hacker control of the victim\u2019s computer, and it is joined to a larger network of similarly hacked computers to form a botnet. Depending on the goals of the hacker<\/a>, the botnet can then be used for a variety of malicious purposes, like spreading spam or attacking sites or feeding SQL injections.<\/p>\n

Finally, there\u2019s the critical part: the business deals. Business deals are a far less glamorous, but a far more common and realistic depiction of today\u2019s hackers. After all: why go through the trouble of hacking when you can outright purchase (or partner with owners of) databases of compromised accounts for pennies on the dollar? According to The New York Times<\/em>, this appears to be what CyberVor did.<\/p>\n

Yes, it appears the biggest compilation of stolen credentials in the world wasn\u2019t created through a master hacking operation, but rather the conglomeration of disparate hacking groups. And that\u2019s the thing you need to know about professional hackers: they aren\u2019t the James Bond-esque adventurers depicted in the movies, but rather people who operate through trial and error and spreadsheets.<\/p>\n

So what does CyberVor do with so many credentials? There are a variety of options at the group\u2019s disposal (or there was<\/em>, until The New York Times<\/em> published its report). Options range from culling data off of sensitive websites for identity theft purposes to stealing money from bank accounts, buying gift cards for personal use, or just sending more spam. And it\u2019s that last option that CyberVor is opting to do: spread more spam so their clients (yes, they have clients) can spread more viruses and steal from more people.<\/p>\n

So should you be concerned? Maybe\u2014if you use the same email and password for multiple sites. If you do, then yes, you should be very concerned.<\/p>\n

Steps to Protect Your Accounts<\/h2>\n

So let\u2019s say you do have the same username and password for multiple sites. What do you do then? Well, thankfully there are a few steps you can take to fix your situation.<\/p>\n