Skip to main content

Russia hack is not that scary

By Chester Wisniewski
updated 11:39 AM EDT, Thu August 7, 2014
STORY HIGHLIGHTS
  • New York Times says 1.2 billion usernames and passwords were hacked by Russians
  • Chester Wisniewski: This is not as scary as it seems, carry on
  • He says company that found the hack may have a commercial interest in the reactions
  • Wisniewski: Of course, it's always good practice to use strong passwords

Editor's note: Chester Wisniewski is a senior security adviser at Sophos Inc., Canada. He researches computer security and privacy issues and is a regular contributor to the Naked Security blog. The opinions expressed in this commentary are solely those of the author.

(CNN) -- At least 1.2 billion usernames and passwords hacked. Is this truly scary or corporate fearmongering?

The New York Times published an article this week that has shocked the public. The article says that a Russian cybercrime group by the name of CyberVor has amassed this astoundingly large number of credentials from upwards of 420,000 distinct web sites.

My immediate response was: Yeah, so?

Chester Wisniewski
Chester Wisniewski

In the context of the story it would seem that countless passwords are now known to this criminal group, and we should be panicking and changing all of our passwords.

But wait a minute. Hold Security, the company that found this hack, may have a commercial interest in this reaction. Hold Security offers to tell companies if their usernames and passwords were compromised for the princely sum of $120. Arguably, Hold Security stood to make more money out of this story than the Russian hackers themselves.

Rather than go down the rabbit hole, let's focus on what this really means and how we should react.

While 1.2 billion is a big number, it appears that many of these credentials could have been obtained from previous large-scale breaches such as Adobe, Sony, LinkedIn, RockYou.com and eBay. The totals from these sites alone adds up to close to half a billion.

We can also assume that many of the 420,000 hacked websites were Mom and Pop blogs, forums and other places where people often consider using a "throwaway" password. The concept is that things like your email, social media and bank require secure, unique passwords. But all the other junk in our lives can just use a simple, less secure password.

The criminals don't have the passwords in most cases. They have cryptographic representations of the passwords known as hashes. These hashes come in a lot of varieties with varying degrees of security associated with them. The purpose of a hash is to slow down an attacker from being able to acquire your password if a password database is stolen.

This hashing is most effective if you follow good security practices, like not using dictionary words, and making sure to include numbers and symbols in your password. People in general are bad at choosing passwords. That means hashing is often only a speedbump for a determined attacker.

But the hashes bring out the truth of the matter. The criminals don't necessarily even have your password. They have a hash that could result in them discovering your password, especially if it is poorly chosen like password123 or qwrtyasdfg.

Read: Cyberattacks: Why you're the weakest link

Many of these stolen hashes may have been obtained some time ago, which means they are less useful to the crooks now. Of course, we don't know the truth and can't analyze what is known because Hold Security is trying to figure out how to monetize the knowledge, leaving even the experts a bit in the dark about how serious a discovery this truly is.

My advice? Keep calm and carry on. It is always a good practice to use strong passwords and different passwords on the different sites we use and change them if we have reason to believe they might be compromised.

There are many tools available to assist with automating this task, making it only a minor inconvenience to keep track of your new stronger passwords. Many are available at no cost. And if we have learned anything during our first 20 years of web surfing, it's that we need a helping hand with our passwords.

Hold Security's findings are interesting. If the research community gains access to the information we will all jump in with both feet to determine how it happened, what it means for Internet security going forward and possibly even who is behind the attacks.

But for the rest of the world? It's business as usual. Think before you click, do your best to follow best practices with regard to your privacy and safety and enjoy your online experience. It's not as scary as it looks.

Read CNNOpinion's new Flipboard magazine

Follow us on Twitter @CNNOpinion.

Join us on Facebook.com/CNNOpinion.

ADVERTISEMENT
Part of complete coverage on
updated 2:19 PM EDT, Fri October 31, 2014
As a woman whose parents had cancer, I have quite a few things to say about dying with dignity.
updated 9:04 AM EDT, Fri October 31, 2014
David Gergen says he'll have a special eye on a few particular races in Tuesday's midterms that may tell us about our long-term future.
updated 10:52 AM EDT, Fri October 31, 2014
What's behind the uptick in clown sightings? And why the fascination with them? It could be about the economy.
updated 9:01 AM EDT, Fri October 31, 2014
Midterm elections don't usually have the same excitement as presidential elections. That should change, writes Sally Kohn.
updated 11:39 AM EDT, Thu October 30, 2014
Mike Downey says the Giants and the Royals both lived through long title droughts. What teams are waiting for a win?
updated 2:32 PM EDT, Thu October 30, 2014
Mel Robbins says if a man wants to talk to a woman on the street, he should follow 3 basic rules.
updated 5:03 PM EDT, Wed October 29, 2014
Peter Bergen and David Sterman say more terrorism plots are disrupted by families than by NSA surveillance.
updated 5:25 PM EDT, Wed October 29, 2014
Time magazine has clearly kicked up a hornet's nest with its downright insulting cover headlined "Rotten Apples," says Donna Brazile.
updated 4:55 PM EDT, Wed October 29, 2014
Leroy Chiao says the failure of the launch is painful but won't stop the trend toward commercializing space.
updated 7:45 AM EDT, Wed October 29, 2014
Timothy Stanley: Though Jeb Bush has something to offer, another Bush-Clinton race would be a step backward.
updated 8:37 AM EDT, Tue October 28, 2014
Errol Louis says forced to choose between narrow political advantage and the public good, the governors showed they are willing to take the easy way out over Ebola.
updated 2:03 PM EDT, Mon October 27, 2014
Eric Liu says with our family and friends and neighbors, each one of us must decide what kind of civilization we expect in the United States. It's our responsibility to set tone and standards, with our laws and norms
updated 7:45 AM EDT, Mon October 27, 2014
Sally Kohn says the UNC report highlights how some colleges exploit student athletes while offering little in return
updated 3:04 PM EDT, Sun October 26, 2014
Terrorists don't represent Islam, but Muslims must step up efforts to counter some of the bigotry within the world of Islam, says Fareed Zakaria
updated 9:02 AM EDT, Fri October 24, 2014
Scott Yates says extending Daylight Saving Time could save energy, reduce heart attacks and get you more sleep
updated 8:32 PM EDT, Sun October 26, 2014
Reza Aslan says the interplay between beliefs and actions is a lot more complicated than critics of Islam portray
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT