Story image

Mega users affected by credential stuffing attack; 15,000 affected

19 Jul 2018

The dangers of using the same usernames and passwords across multiple websites have become painfully clear for around 15,000 people this week, after a security researcher exposed a data breach that has caught users of file sharing website Mega.

The New Zealand-based website, which used to be managed by mogul Kim Dotcom, launched in 2013.

According to reports, the breach compromised Mega customers’ usernames, passwords, and filenames.

Mega confirmed these details, although Mega chairman Stephen Hall says Mega’s systems were not breached.

Instead, he says the problem lies in ‘credential stuffing’, which is when cybercriminals reuse login details from other data breaches against multiple websites. Often credential stuffing uses bots that carry out the stuffing attacks.

In this case it appears that the 15,500 users affected by this breach may have used the same username and password across many sites that have been hacked.

The Open Web Application Security Project (OWASP) further states that credential stuffing “is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts.”

“This is a subset of the brute force attack category: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.”

According to statistics from Akamai, credential stuffing attacks cost businesses an average of $6 million every year.

Centrify’s senior director APAC sales, Niall King, says the exposure of users’ Mega login credentials demonstrates the problem of relying on passwords alone.

“What minimal protective value passwords offer is often undermined by the poor security habits of too many users,” he says.

“People use easily guessed passwords - Time Magazine reported the most popular password of 2017 was 123456 - and have the dreadful tendency to re-use passwords across multiple websites, which make them vulnerable to credential stuffing, as appears to be the case with these Mega logins.”

King says password alternatives and multi-factor authentication can add extra protection.

“This might be a code sent to your smartphone or a biometric identifier such as a thumbprint, but it requires a second step to prove your identity. If multi-factor authentication is required for your logins, then the exposure of your password does not present any significant risk.”

Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
Ransomware’s decline equals cryptomining’s rise
ESET’s Security Days Conference recently took place to go over the current threat environment and what to look out for next.
IoT and DDoS attacks: A match made in heaven
A10 Network’s Adrian Taylor uses findings from a number of reports to illustrate his point that advances in technology are facilitating cybercrime.
ForgeRock launches Sandbox-as-a-Service to facilitate compliance
The cloud-based testing environment for APIs enables banks to accelerate compliance with Open Banking and PSD2 deadlines.
Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.