Shutterstock
The online safety of your information keeps decreasing, as hackers breach into more and more large websites containing huge amounts of user data.
Researchers have now found out that stolen data has been aggregated in the amount of 2.2 billion unique records of usernames and associated passwords and made freely available on the dark web.
We reported earlier this month that highly respected cybersecurity research expert, Troy Hunt, determined that 772,904,991 stolen email addresses and associated passwords were put up for grabs by hackers on the dark web in a bundle called collections #1.
Hunt is a regional director at Microsoft. But even more importantly, he is the operator of “have i been pwnd?” (HIBP), a website that aggregates data related to online breaches, and makes it easy for people to find out if their information has been compromised and/or made available online.
By going to haveibeenpwned.com you can identify each one of the specific websites where your information has been stolen from.
Following in Hunt’s footsteps, other researchers obtained and analyzed information in another vast dark web database titled collections #2-5.
These researchers have determined that this gigantic collection contains 2.2 billion unique usernames and their associated passwords.
The new bundle of 2.2 billion usernames and passwords that are now out there – are being freely distributed on hacker forums. Typically, someone getting the information may try to take over a user’s account, then ransom that account back to them.
They may also try to ransom back sensitive data to its original owner. Additionally, they may try to use personal information for theft.
Most commonly, Hackers will use a technique known as “credential stuffing.” This is where they take the information and try to determine if a person has used the same email address and password at different sites.
In doing credential stuffing, Hackers will employ two different methods.
Most often, the hackers will use an automated method in bursts, employing software that will try these email addresses and passwords for them at multiple online websites around the Internet.
However, this method will use multiple login attempts, that can also trigger alert systems at these websites that take notice of the repeated activity.
The second method is what’s referred to as “low and slow” attacks, which are harder four alert systems to detect. This method reduces the volume of attempts and their repetition.
Not only that, but the hacker will usually make these attempts on weekends when in-house security staff at the sites is typically low or not operating at all.
