By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    Man-in-the-Disk: A new and dangerous way to hack Android
    12 months ago
    Microsoft Issues New Windows 10 Update Warning
    11 months ago
    How to enable TPM and Secure Boot on Hyper-V to install Windows 11 on VM
    12 months ago
    Latest News
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    5 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    6 days ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    7 days ago
    Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Missing Sum at Bottom Right Corner in excell (FIX)
    12 months ago
    Windows 10 build 19044.1889 (KB5016616) outs for 21H2, 21H1, 20H2
    12 months ago
    How to reset Windows Update on Windows 11
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    18 hours ago
    Cloudflare account permissions, how to use them, and best practices
    Cloudflare account permissions, how to use them, and best practices
    18 hours ago
    Announcing Cloudflare Incident Alerts
    Announcing Cloudflare Incident Alerts
    18 hours ago
    Welcome to Birthday Week 2023
    Welcome to Birthday Week 2023
    2 days ago
    A new wave of innovation with Edge, your AI-powered browser
    3 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    How to run Firefox with developer tools open?
    11 months ago
    Who took the phone?
    11 months ago
    Website for voice acting
    11 months ago
    Latest News
    How to use image layers on Paint for Windows 11
    6 days ago
    How to disable Copilot on Windows 11 (completely)
    2 weeks ago
    How to blur image background in Photos for Windows 11
    2 weeks ago
    How to hide text from screenshots on Snipping Tool for Windows 11
    2 weeks ago
  • Glossary
  • My Bookmarks
Reading: How cybercriminals can get hold of your passwords
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
How To

How cybercriminals can get hold of your passwords

Tom Grant
Last updated: 30 December
Tom Grant 9 months ago
Share
12 Min Read

For most us, a password is simply the most common method for authentication for countless online services. But for cybercriminals, it’s much more — a shortcut into someone else’s life, a work tool of central importance, and merchandise that can be sold. Knowing a password, crooks not only can get hold of your accounts, data, money, and even identity; they can also use you as a weak link to attack your online friends, relatives, or even the company you work for or manage/own. To prevent this, you need to understand how outsiders can get hold of your password in the first place.

Contents
How can your password fall into the hands of cybercriminals?PhishingMalwareThird party leaksInitial access brokersBrute-force attacksPossible consequences of a leaked or brute-forced passwordHow to protect your accounts from unwanted access

How can your password fall into the hands of cybercriminals?

There’s a widespread misconception that to give your password to cybercrooks, you need to make a mistake — download and run an unchecked file from the internet, open a document from an unknown sender, or enter your credentials on some suspicious website. True, all those behavior patterns can make attackers’ life much easier, but there are other scenarios as well. Here are most common cybercriminal methods of getting access to your accounts.

Phishing

This is indeed one of the credential-harvesting methods that relies mostly on human error. Hundreds of phishing sites, aided by thousands of mailouts leading to them, appear daily. However, if you for some reason think that you’ll never fall for the phishing trick — you’re wrong. The method is almost as old as the internet itself, so cybercriminals have had plenty of time to develop numerous social engineering tricks and disguise tactics. Even professionals sometimes cannot distinguish a phishing email from a real one at a glance.

Malware

Another common way of stealing your credentials is with malware. According to our statistics, a significant proportion of active malware is made up of Trojan stealers, whose main purpose is to wait until a user logs on to some site or service, and copy their passwords and send them back to their authors. If you’re not using protective solutions, Trojans can hide on your computer undetected for years — you’ll not know that something is wrong, because they don’t cause any visible harm, just silently do their job.

And stealer Trojans are not the only malware that hunt for passwords. Sometimes cybercriminals inject web skimmers on sites and steal anything that users input, including credentials, names, card details and so on.

Third party leaks

However, you don’t have to make the same mistake yourself. It’s enough to be a user of some insecure internet service or client of a company that leaked a database with its customers’ data. Of course, companies that take their cybersecurity seriously don’t store your passwords at all, or at least do so in encrypted form. But you never can be sure that there were sufficient measures in place. For example, this year’s leak from SuperVPN contained the personal details and login credentials of 21 million users.

Also, some companies cannot avoid storing your passwords at all. Yes, I am talking about the infamous LastPass password-management-utility hack. According to the latest information, an unknown threat actor accessed cloud-based storage with some customer data, including backups of customers’ vaults. Yes, those vaults were properly encrypted, and LastPass never stored or even knew the decryption keys. But what if LastPass clients locked their vaults with a password that was already leaked from some other source? If they reused an insecure password then now cybercriminals would be able to access all their accounts at once.

Initial access brokers

And here we come to another source of stolen passwords — the black market. Modern cybercriminals prefer to specialize in certain fields. They may steal your passwords but not necessarily use them: it’s more profitable to sell them wholesale. Buying such password databases is especially attractive to cybercriminals, because it gives them an all-in-one: users tend to use the same passwords across a number of platforms and accounts, often tying them all to the same email. Thus, having the password from one platform, cybercriminals can gain access to many other accounts of the victim – from their gaming accounts to their personal email or even private accounts on adult websites.

An advert from a hacker's forum: someone is offering 280 thousands of usernames and passwords for various game platforms for just $4,000

An advert from a hacker’s forum: someone is offering 280 thousands of usernames and passwords for various game platforms for just $4,000

Leaked corporate databases that may or may not contain credentials are also sold on the same black market. The price of such databases varies depending on the amount of data and the industry of the organization: some password databases may be sold for hundreds of dollars.

There are certain services on darknet that aggregate leaked passwords and databases, and then and enable paid subscription-based or single time access to their collections. In October 2022, the infamous ransomware group LockBit hacked a healthcare company, and stole their user databases with medical information. They not only sold subscriptions to this information on the darknet — presumably they bought initial access on the same black market.

A darknet services that provides paid access to databases with stolen data

A darknet services that provides paid access to databases with stolen data

Brute-force attacks

In some cases, cybercriminals don’t even need a stolen database to find out your password and hack into your account. They can use brute-force attacks, in other words try thousands of typical password variants until one of them works. Yes, it doesn’t sound too reliable. But they don’t need to iterate over all possible combinations — there are certain tools (Wordlist Generators) that can generate a list of possible common passwords (so-called brute-force dictionaries) based on the victim’s personal information.

Such programs look like a mini questionnaire about the victim. They ask for the name, last name, date of birth, personal information about partners, children, and even pets. Attackers may even add additional keywords they know about the target that can be thrown into the mix. Using this mix of related words, names, dates, and other data, wordlist generators create thousands of password variants, that attackers later try while logging.

A service that can generate a dictionary for bruteforce attacks based on information known about the intended victim.

A service that can generate a dictionary for bruteforce attacks based on information known about the intended victim.

To use such method, cybercriminals need to conduct research first — and this is when those leaked databases may come in handy. They may contain pieces of information such as birth dates, addresses, or answers to “secret questions”. Another source of the data is oversharing in social networks. Something that looks absolutely insignificant, such as a photo from Dec. 6 with the caption “today is my beloved doggie’s birthday”.

Possible consequences of a leaked or brute-forced password

There are some obvious consequences: cybercriminals can take over your account and hold it for ransom, use it to scam your contacts and online friends, or, if they’re able to get the password to your banking site or app, empty your account. However, sometimes their intent is not so straightforward.

For example, with more games introducing in-game currency and micro-transactions, more users have their payment methods linked to their accounts. This makes gamers an interesting target for hackers. By obtaining access to the gaming account, they can steal in-game valuables like skins, rare items or internal game currency, or misuse the victim’s credit card data.

The leaked databases and information that can be obtained while searching your accounts can be used not just for financial gain but also for reputational harm and other types of social damage, including doxing. If you’re a celebrity, you can be blackmailed and face a choice: disclosure of personal information (that could affect your reputation) or loss of money.

Even if you’re not a celebrity, you can become a victim of doxing — the act of revealing identifying information about someone online — such as their real name, home address, workplace, phone, financial, and other personal information. Doxing attacks can range from the relatively harmless, such as sign-ups to countless mailing lists or fake pizza delivery orders in your name, to the far more dangerous ones, such as various forms of cyberbullying, identity theft, or even in-person stalking.

Finally, if you’re using the same password for personal and work accounts, cybercriminals can take over your corporate e-mail and use it for business e-mail compromise schemes or even targeted attacks.

How to protect your accounts from unwanted access

First of all — always keep password hygiene in mind:

  • do not reuse the same password for several accounts;
  • make your passwords long and strong;
  • store them securely;
  • change them immediately upon first hearing news about a data breach at the service or website that this password is used to protect.

Our password manager software can help you with all those tasks. It is available as a part of our security solutions for SMB’s and for home clients.

Also, Kaspersky application monitors the security of all your passwords in real-time. It even has a service for checking whether a leak really occurred or not. Called Data Leak Checker, it’s found under the Privacy tab. It lets you check whether your email has been spotted in a stolen database somewhere. If so, you’ll receive a list of leaky sites, the type of data made public (personal, banking, online activity history and so on), as well as recommendations on what to do about it.

And here’s some additional advice:

  1. Enable two-factor authentication wherever possible. It provides an additional layer of security and will prevent hackers accessing your account — even if someone manages to obtain your login and password.
  2. Set up your social networks for better privacy. This will make it more difficult to find information about you, and therefore complicate use of a brute-force dictionary for attacking your accounts.
  3. Stop oversharing personal information, even if it’s visible only to friends. Today’s friend may become tomorrow’s enemy.

Source: kaspersky.com

Translate this article

TAGGED: Authentication, Malware, Phishing, PoC, RC4, SASE, Security, SMTP, Social engineering, Software, Targeted Attack, Threat, Tips
Tom Grant December 30, 2022 December 30, 2022
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps 18 hours ago
Cloudflare account permissions, how to use them, and best practices
Cloudflare account permissions, how to use them, and best practices
Apps 18 hours ago
Announcing Cloudflare Incident Alerts
Announcing Cloudflare Incident Alerts
Apps 18 hours ago
Welcome to Birthday Week 2023
Welcome to Birthday Week 2023
Apps 2 days ago
A new wave of innovation with Edge, your AI-powered browser
Windows 3 days ago

You Might Also Like

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)

18 hours ago
Cloudflare account permissions, how to use them, and best practices
Apps

Cloudflare account permissions, how to use them, and best practices

18 hours ago
Announcing Cloudflare Incident Alerts
Apps

Announcing Cloudflare Incident Alerts

18 hours ago
Welcome to Birthday Week 2023
Apps

Welcome to Birthday Week 2023

2 days ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

Curator can help you with PC Game Pass picks
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
How to use image layers on Paint for Windows 11
New! Rate Limiting analytics and throttling
Previous Next
Hot News
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Cloudflare account permissions, how to use them, and best practices
Announcing Cloudflare Incident Alerts
Welcome to Birthday Week 2023
A new wave of innovation with Edge, your AI-powered browser
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?