Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The 111M Record Pemiblanc Credential Stuffing List

troyhunt.com

Post reply on HN
Print view View original

41–50 of 73 posts

Re: The 111M Record Pemiblanc Credential Stuffing List

#41

Post by namibj »

graystevens wrote: post #35

If the term Credential Stuffing is new to anyone, we’ve done a deep dive into what it is and the tools that are used here: https://breachinsider.com/blog/2017/credential-stuffing-how-... We saw this pretty regularly at my old job, with attacks almost daily. They range from ‘script kiddie’ who just use the default tool settings and do it all from one IP making it easy to spot, to persistent attackers who would play ca…

Did you try to find attackers in the set of unconspicious UAs? If you did not try hard to look for more skilled adversaries, expect some to be hiding from your analysis. Once you don't see anything in a large range of skill/sophistication, you can assume there to be no adversaries that don't have the ability to pull a Stuxnet off. And if you need to guard against those, and have the ressources to do so, you already know this.

Re: The 111M Record Pemiblanc Credential Stuffing List

#42

Post by graystevens »

namibj wrote: post #41
graystevens wrote: post #35

If the term Credential Stuffing is new to anyone, we’ve done a deep dive into what it is and the tools that are used here: https://breachinsider.com/blog/2017/credential-stuffing-how-... We saw this pretty regularly at my old job, with attacks almost daily. They range from ‘script kiddie’ who just use the default tool settings and do it all from one IP making it easy to spot, to persistent attackers who would play ca…

Did you try to find attackers in the set of unconspicious UAs? If you did not try hard to look for more skilled adversaries, expect some to be hiding from your analysis. Once you don't see anything in a large range of skill/sophistication, you can assume there to be no adversaries that don't have the ability to pull a Stuxnet off. And if you need to guard against those, and have the ressources to do so, you already k…

Agreed, based on other thresholds and alerts, we certainly saw some more advanced actors - using in-country home broadband lines to conduct the attacks. This made tracking and blocking them much harder, as there was a risk of blocking genuine customers who simply didn’t conform to our idea of ‘normal’. We ended up finding another way to fingerprint them, but thank you for calling that out, as you are entirely right that there is almost always someone trying to be truly covert.

If anyone is suffering with these types of attacks (or isn’t and you think you’re missing something) feel free to reach out, more than happy to help - email is in my profile

Re: The 111M Record Pemiblanc Credential Stuffing List

#43

Post by DEADBEEFC0FFEE »

snailmailman wrote: post #16
notananthem wrote: post #9

Earlier quoted context omitted.

I've never tried to follow up with which accounts/passwords have been used from haveibeenpwned, can you describe this further as I'll try this. The "huge pw torrent" is something I can just search on torrent trackers? Once I have the list, its just a list of passwords, or includes the emails? Then they're sha-256 hashed and I need to ..unhash them?

I think he is referring to Troy Hunts pwned password list.(which is about 9gb, afaik) Presumably it will be updated with these new plaintext passwords. Once it’s updated, you can check all your passwords against the list. It’s a list of sha256-hashed passwords.(so he isn’t sharing tons of plaintext passwords, as sha256 can’t be reversed) You would sha256 your own passwords and check them all against the list. Edit: t…

I think Firefox is going to use Trent's list to check passwords use when browsing. That would actually make Firefox more functionally useful that other browsers.

Re: The 111M Record Pemiblanc Credential Stuffing List

#44

Post by DEADBEEFC0FFEE »

DEADBEEFC0FFEE wrote: post #43
snailmailman wrote: post #16

Earlier quoted context omitted.

I think he is referring to Troy Hunts pwned password list.(which is about 9gb, afaik) Presumably it will be updated with these new plaintext passwords. Once it’s updated, you can check all your passwords against the list. It’s a list of sha256-hashed passwords.(so he isn’t sharing tons of plaintext passwords, as sha256 can’t be reversed) You would sha256 your own passwords and check them all against the list. Edit: t…

I think Firefox is going to use Trent's list to check passwords use when browsing. That would actually make Firefox more functionally useful that other browsers.

https://thenextweb.com/security/2018/06/26/mozilla-bakes-hav...

Re: The 111M Record Pemiblanc Credential Stuffing List

#45

Post by icebraining »

djsumdog wrote: post #7
acover wrote: post #5

Earlier quoted context omitted.

You can also do this with Gmail by adding a . Or two randomly in your email.

Gmail and other MTAs support +something in the e-mail address user part too. If you forget your password, you do have to dig through your e-mail and figured out which one you used, but this method does let you track down when someone sells/shares your e-mail address or 3rd parties.

this method does let you track down when someone sells/shares your e-mail address or 3rd parties.

Unless they strip out the +something part.

Re: The 111M Record Pemiblanc Credential Stuffing List

#46

Post by icebraining »

ubernostrum wrote: post #39
dannyw wrote: post #30

Earlier quoted context omitted.

I'm not sure why you're being downvoted when you're exactly right. I have lost a lot of respect for Troy Hunt when he pretty much turned his blog and HIBP into a native advertisement for 1Password; without any disclosure that he is being paid by 1Password.

I'm looking at: https://haveibeenpwned.com/ I see a link below the search box, which when I click explains he has "partnered" with 1Password, why, and why he liked it prior to the partnership. It also links to this: https://www.troyhunt.com/have-i-been-pwned-is-now-partnering... which has a lot more detail. That's not what I call "without any disclosure". And makes me wonder what your idea of "disclosure" would be.

"Without any disclosure" is clearly false, but it would be nice if the About page didn't still say "[s]hort of the odd donation, all costs for building, running and keeping the service currently come directly out of my own pocket."

Re: The 111M Record Pemiblanc Credential Stuffing List

#47

Post by rutthenut »

dannyw wrote: post #32

Is anyone else annoyed by the native advertising for 1Password there, without any disclosures that they are affiliate links? I've lost pretty much all of my respect for Troy Hunt as he went from maintaining a useful service to just being another ad for 1Password.

Not at all annoyed about that. It is the principle he pushes and I have no concern at all that this one password manager he explicitly names is one that he gets some benefit from. That site doesn't run for free, you know. If you read info on his site, you should have enough sense to think to look for free alternatives if you wish.

Re: The 111M Record Pemiblanc Credential Stuffing List

#48

Post by jstarfish »

georgeappiah wrote: post #18
kbenson wrote: post #10

Earlier quoted context omitted.

You just have to remember the exact username/email you used in case you forget it. That can include the sitename itself, or some simple transform, but sometimes services change names... so make sure to keep records of exactly the email used for each service (or don't delete your email from them), forgetting that is worse than losing the password, since there's often no helpful recovery service they offer.

The bigger problem is MANY MANY sites don't accept the (+) in an email address.

Yes. More and more sites are using common frameworks and/or validation libraries where a + is not considered to be an acceptable part of the recipient name.

Re: The 111M Record Pemiblanc Credential Stuffing List

#49

Post by ComodoHacker »

djsumdog wrote: post #8

So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…

>The trade off: your algorithm probably sucks

I suspect most people will end up having weak algorithms the same way they have weak passwords.

Re: The 111M Record Pemiblanc Credential Stuffing List

#50

Post by jstarfish »

graystevens wrote: post #35

If the term Credential Stuffing is new to anyone, we’ve done a deep dive into what it is and the tools that are used here: https://breachinsider.com/blog/2017/credential-stuffing-how-... We saw this pretty regularly at my old job, with attacks almost daily. They range from ‘script kiddie’ who just use the default tool settings and do it all from one IP making it easy to spot, to persistent attackers who would play ca…

UAs are often hardcoded into compiled malware binaries that get shared/leaked amongst actors and groups. Latter users dont have access to the source so at best all they can do is dick around with hex editors and maybe change a character or two instead of the whole string.
Post reply on HN