1.4B Clear Text Credentials Discovered in a Single Database

[heywire]

https://medium.com/4iqdelvedeep/1-4-billion-clear-text-credentials-discovered-in-a-single-database-3131d0a1ae14

[LeonM]

How comes that 'homelesspa' ranks 13 on the most used passwords? I mean, I understand why '123456' and 'password' are in the list, but a seemingly random combination of words such as 'homelesspa'?

I did found this: https://twitter.com/clinton_ngn/status/736247662866006018 But no real explanation

[michaelmcmillan → LeonM]

Most likely a bot that registered a ton of users with the same password.

[kevin_thibedeau → LeonM]

Could be added to detect who is scanning with this list. Akin to mapmakers adding fake streets.

[dabber → kevin_thibedeau]

Map makers add fake streets to mark their maps?

[bklaasen → dabber]

Yes, they're called "trap streets": https://en.m.wikipedia.org/wiki/Trap_street

[seanalltogether → LeonM]

It looks like 427 million of these entries came from a myspace breach.

https://news.ycombinator.com/item?id=11788694

[sschueller]

Where can I download this dump so I can find out if any of my accounts are in it?

[varren → sschueller]

https://www.reddit.com/r/pwned/comments/7hhqfo/combination_o...

[gregsadetsky → varren]

Thanks a lot for the link! I ended up downloading the database, and going through all of my email contacts to see who was affected to write to them individually.

About 7/10 frequently contacted people were in the database (...!). About half of those let me know that the passwords were not in use anymore. The other half was very, very grateful...!

It was a great time to remind them about password managers, 2fa, etc.

[stanmancan → sschueller]

Not a link to the DB but a great relevant service: https://haveibeenpwned.com/

[ninonino → stanmancan]

Rather often quite incomplete, often only has partials of dumps he claims to have added and when this was pointed out he didn't want to add the rest - didn't even want to change the description of the dumps to say they were incomplete

[jwcrux → ninonino]

Do you have references for this? I've had nothing but good experiences with HIBP in the past.

[marksomnian]

Title is exaggerating; this "single database" is actually an aggregate of many previous breach dumps.

[snarfy → marksomnian]

Which makes the aggregate a single database.

[breakingcups → snarfy]

Yes, but it is not like a single service has been breached to leak that many accounts, significantly reducing the relevance and impact of this particular database.

Anyone can compile a list such as this from other big dumps without much trouble, you just need some disk space.

[coldtea → breakingcups]

>Yes, but it is not like a single service has been breached to leak that many accounts, significantly reducing the relevance and impact of this particular database.

Err, it actually increases its relevance and impact. With the same database now a hacker can reach multiple services...

[minton → breakingcups]

I agree the title is click bait. Here’s a quote from the creator (taken from the reddit link):

> I have compiled it, I just want to show how big is password reuse problem for security community, and how easy was to crack those hashes using open source software.

[lern_too_spel → marksomnian]

And it's not "discovered." Somebody aggregated the breaches and intentionally made it public.

[ryanlol → marksomnian]

Yeah, this is just stupid. 1.4B rows isn't even a decent amount of data as far as the publicly available DBs go.

Silly marketing fluff from yet another "threat intelligence" snake oil outfit.

[rando444]

A couple of the constant examples of password reuse that can be found:

proceeds to list domain names that are aliases of one another

Also the whole describing the thing as a database and saying it's fast because it's alphabetical...

At least describe what kind of database you're talking about so we can understand why an index isn't possible.

[Johnny555]

This seems odd:

This database makes finding passwords faster and easier than ever before. As an example searching for “admin,” “administrator” and “root” returned 226,631 passwords of admin users in a few seconds.

Out of 1.4B credentials there are only 226K for admin, administrator and root?

[pedalpete → Johnny555]

We're talking account passwords for web services mostly, right?

I think that would explain why admin, administrator and root are rarely used as usernames.

[an_account → Johnny555]

If anything that sounds high to me.

[katastic → Johnny555]

What about "sa"?

[jokoon]

I checked, most are outdated passwords.

Odd thing, I checked with other people, and they don't remember those as old passwords.

I even found passwords I don't remember...

[campuscodi]

This article is such garbage... it was tore apart in a /r/netsec discussion just last night.

https://www.reddit.com/r/netsec/comments/7ikbzo/14_billion_c...