2 Million Passwords For Facebook, Yahoo, Google, Twitter Stolen

By Amy Lee | CruxialCIO

Use Facebook, Yahoo, Twitter, LinkedIn or Google?

It might be time to change that password. According to a post by security firm Trustwave, more than 2 million accounts have been compromised by a Pony botnet controller, a network of criminally controlled malware-infected computer systems designed to steal passwords and other sensitive information.

The trove of user information includes 1.58 million Website logins, more than 300,000 email account logins and thousands of other credentials. Facebook accounted for more than half of the information stolen, or 318,121 passwords. Yahoo followed with 59,549 passwords, Google with 54,437 passwords, Twitter with 21,708 passwords and LinkedIn with 8,490 passwords.

Also on the list? Payroll service provider ADP, with close to 8,000 passwords stolen. Despite information suggesting that close to 100 percent of attacks took place in the Netherlands, the presence of two other Russian social networks indicates that “decent portion of the victims compromised were Russian speakers,” according to Trustwave.

The Dutch IP address, meanwhile, seems to have been used as a gateway between infected machines and the hacker’s control center. The technique is commonly used to keep the real control server hidden from authorities. Still, at least 92 countries appear on the IP geolocation list, making it likely that attacks were spread across the world.

And all across the world, people are using bad passwords. Trustwave analyzed the 2 million passwords only to find that close to 16,000 users rely on the password “123456.” In second place, with close to 5,000 passwords, the slightly more complicated "1234566789." Other popular passwords include "password," "admin” and other variations on a sequential series of number beginning with one, including more than 1,000 users who picked "1" as their password.

More people pick "terrible" passwords — those with less than four characters consisting of only letters or numbers — than "excellent" ones, which include all four character types (numbers, letters, capitals and symbols) and are longer than eight characters. Nearly half are "medium" while another 28 percent are "bad." Since 2006, the top 10 most common passwords have increased as a percentage of all passwords.

"If you don't enforce a password policy, don't expect your users to do it for you," the Trustwave post said.

What to Do: Set passwords to be more than eight characters and/or more than four character types. Make sure all security monitoring software is patched and up-to-date. Ensure that corporate users do not access suspicious Websites on the network by setting up whitelisting or blacklisting of Websites or other forms of browsing control.