Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Are credential dumps worth reviewing? SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Are credential dumps worth reviewing?

It‚??s been reported that around five million Gmail email addresses were released on to a forum early on in the week. In the file, next to each email address, was a password. These email addresses and passwords appear to have been collected over a few years from multiple web site sources, not from a compromise of Gmail/Google.¬† The Google security team have done their analysis on the credential dump and alerted the two percent of those in that list they determine were at risk [1].¬†

A fair number of researchers, academics and the curious will analyze, collate and build a number of models showing the most common and most amusing passwords and it‚??s probably something most of us have seen before. So what else can we gain from these types of credential dumps and can we make it worth out time reviewing them?

 

Here are a few suggestions to make use of these types of dumps in a more positive manner.

1) Showing non-security staff (i.e. the rest of the world) the top fifty most common passwords, with the number of people that use that same password, to provide a bit of user education on why not to use common passwords on their accounts, personal or work, or how reusing the same passwords across multiple sites can cause problems [2].

2) Providing you can get access to the full list, checking your email address isn‚??t there, and it would be nice to also check that people you know aren‚??t in the dump either.

3) A more business-focused approach, as long as you have permission, would be to compare all those email addresses against any Gmail registered user accounts, as an example any customers registered for your newsletters, logins to web sites or applications using Gmail accounts. If you do find any accounts that are linked to a listed Gmail email address from the dump, some possible options are:

  • Notify said users that their email address and a passwords has appeared on a credential dump
  • Force a password reset on that account
  • Audit and Monitor the accounts to see if unusual has occurred¬†

4) Another step after that would be to check your logs to see if there is any automated login attempts using the Gmail accounts against any of your systems, as this is well documented behaviour by various adversaries that fellow Handlers have reported upon previously [3]. 

 

If the information is out there, our adversaries are going to be using, so we should strive to ensure we have our incident response plans have how to deal with these external events quickly and with the minimum effort. 

 

[1] http://googleonlinesecurity.blogspot.com.au/2014/09/cleaning-up-after-password-dumps.html

[2] http://www.securingthehuman.org/blog/2012/07/30/guest-post-limits-of-password-security-awarneness

[3] https://isc.sans.edu/diary/Tales+of+Password+Reuse/17087 

 

Chris Mohan --- Internet Storm Center Handler on Duty

Chris

105 Posts
ISC Handler
WordPress' post on this is interesting. Of ~700k accounts associated with Gmail addresses from the dump, ~100k were using the same password on Wordpress.com. So they forced password reset only on those particular accounts. They say they didn't sent emails so the other 600k, but did put a notification in their WordPress dashboards. It makes a good lesson on password re-use for users (i.e. learn from others' mistakes).

Note that WordPress apparently went one step beyond your #3 suggestion and actually hashed the password from the dump to compare with the users' stored password on their site ("PRESUMABLY hashed in order to compare," I should say, but the other possibilities are too frightening).

http://en.blog.wordpress.com/2014/09/12/gmail-password-leak-update/
Anonymous

Sign Up for Free or Log In to start participating in the conversation!