This month, almost 5 million Gmail credentials published in a Bitcoin security forum by a Russian hacker. According to RIA Novosty (one of the largest news agencies in Russia), this leak comes just a couple of days after the hackers published at the same forum 1.25 million Yandex accounts credentials and over 4.6 million Mail.ru credentials.
But does it all true?
In an interview published on the International Business Times right after the leak, a Google spokesperson has confirmed what many security experts had already suggested, that many of the passwords in question were likely taken from a website other than Google. “The security of our users’ information is a top priority for us. We have no evidence that our systems have been compromised, but whenever we become aware that accounts may have been, we take steps to help those users secure their accounts.”
Also Yandex and Mail.ru published a very similar response to these publications which said that the databases containing the compromised email accounts comprised mostly inactive and hacked accounts which had been collected over a long period of time via phishing and Trojan viruses. The internal security systems of the companies were not compromised, they said.
Using various techniques, the F5 SOC team analyzed the leaked database and the most common passwords are still the same as they were in the past. Here is a list of the top 25 passwords and how many times they appeared in the original leaked file:
If you want to make sure your account hasn’t been compromised, just click here and enter your e-mail address.
Later that day, September 10th, Google published on its security blog that out of the 5 million (so called) compromised accounts no more than 10,000 combinations of usernames and passwords are real. “We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords.”
F5 customers who use the WebSafe application level encryption have already taken an additional step forward to protect their end users. WebSafe encryption component encrypts the sensitive data sent by the end-user to the organization’s servers from the application level – meaning 100% of the way and not just on the network level (SSL level). When implemented on the organization’s website, WebSafe prevents theft of credentials and foils a Trojan’s abilities.
F5 SOC recommends taking the following steps in order to keep all you private online accounts safe, from e-mail accounts to your online banking accounts:
1) Create a very strong password that contains at least two capital letters, 6 numbers & letters and two symbols.
2) Don’t wait to be asked by your provider to change your password! Change it on a regular basis every couple of weeks.
3) Don’t use the same passwords for all your accounts.
4) If offered, use second factor authentication for each account.
5) If you don’t remember all your passwords, do not keep them in one file on your laptop and make sure to add a password to each file.
6) Do not keep your passwords as a ‘Notes’ on you iPhone or iPad!!
7) Last but not least - be aware to which public Wi-Fi networks you are connecting to when traveling. You don’t want to be a victim to the next Man In The Middle attack…