Skip to main content

Russia hack is not that scary

By Chester Wisniewski
updated 11:39 AM EDT, Thu August 7, 2014
STORY HIGHLIGHTS
  • New York Times says 1.2 billion usernames and passwords were hacked by Russians
  • Chester Wisniewski: This is not as scary as it seems, carry on
  • He says company that found the hack may have a commercial interest in the reactions
  • Wisniewski: Of course, it's always good practice to use strong passwords

Editor's note: Chester Wisniewski is a senior security adviser at Sophos Inc., Canada. He researches computer security and privacy issues and is a regular contributor to the Naked Security blog. The opinions expressed in this commentary are solely those of the author.

(CNN) -- At least 1.2 billion usernames and passwords hacked. Is this truly scary or corporate fearmongering?

The New York Times published an article this week that has shocked the public. The article says that a Russian cybercrime group by the name of CyberVor has amassed this astoundingly large number of credentials from upwards of 420,000 distinct web sites.

My immediate response was: Yeah, so?

Chester Wisniewski
Chester Wisniewski

In the context of the story it would seem that countless passwords are now known to this criminal group, and we should be panicking and changing all of our passwords.

But wait a minute. Hold Security, the company that found this hack, may have a commercial interest in this reaction. Hold Security offers to tell companies if their usernames and passwords were compromised for the princely sum of $120. Arguably, Hold Security stood to make more money out of this story than the Russian hackers themselves.

Rather than go down the rabbit hole, let's focus on what this really means and how we should react.

While 1.2 billion is a big number, it appears that many of these credentials could have been obtained from previous large-scale breaches such as Adobe, Sony, LinkedIn, RockYou.com and eBay. The totals from these sites alone adds up to close to half a billion.

We can also assume that many of the 420,000 hacked websites were Mom and Pop blogs, forums and other places where people often consider using a "throwaway" password. The concept is that things like your email, social media and bank require secure, unique passwords. But all the other junk in our lives can just use a simple, less secure password.

The criminals don't have the passwords in most cases. They have cryptographic representations of the passwords known as hashes. These hashes come in a lot of varieties with varying degrees of security associated with them. The purpose of a hash is to slow down an attacker from being able to acquire your password if a password database is stolen.

This hashing is most effective if you follow good security practices, like not using dictionary words, and making sure to include numbers and symbols in your password. People in general are bad at choosing passwords. That means hashing is often only a speedbump for a determined attacker.

But the hashes bring out the truth of the matter. The criminals don't necessarily even have your password. They have a hash that could result in them discovering your password, especially if it is poorly chosen like password123 or qwrtyasdfg.

Read: Cyberattacks: Why you're the weakest link

Many of these stolen hashes may have been obtained some time ago, which means they are less useful to the crooks now. Of course, we don't know the truth and can't analyze what is known because Hold Security is trying to figure out how to monetize the knowledge, leaving even the experts a bit in the dark about how serious a discovery this truly is.

My advice? Keep calm and carry on. It is always a good practice to use strong passwords and different passwords on the different sites we use and change them if we have reason to believe they might be compromised.

There are many tools available to assist with automating this task, making it only a minor inconvenience to keep track of your new stronger passwords. Many are available at no cost. And if we have learned anything during our first 20 years of web surfing, it's that we need a helping hand with our passwords.

Hold Security's findings are interesting. If the research community gains access to the information we will all jump in with both feet to determine how it happened, what it means for Internet security going forward and possibly even who is behind the attacks.

But for the rest of the world? It's business as usual. Think before you click, do your best to follow best practices with regard to your privacy and safety and enjoy your online experience. It's not as scary as it looks.

Read CNNOpinion's new Flipboard magazine

Follow us on Twitter @CNNOpinion.

Join us on Facebook.com/CNNOpinion.

ADVERTISEMENT
Part of complete coverage on
updated 6:10 PM EST, Mon November 24, 2014
If Obama thinks pushing out Hagel will be seen as the housecleaning many have eyed for his national security process, he'll be disappointed, says David Rothkopf.
updated 8:11 AM EST, Tue November 25, 2014
The decision by the St. Louis County prosecuting attorney to announce the Ferguson grand jury decision at night was dangerous, says Jeff Toobin.
updated 3:57 AM EST, Tue November 25, 2014
China's influence in Latin America is nothing new. Beijing has a voracious appetite for natural resources and deep pockets, says Frida Ghitis.
updated 4:51 PM EST, Mon November 24, 2014
Iranian President Hassan Rouhani speaks during a press conference in the capital Tehran on June 14, 2014.
The decision to extend the deadline for talks over Iran's nuclear program doesn't change Tehran's dubious history on the issue, writes Michael Rubin.
updated 2:25 PM EST, Fri November 21, 2014
Maria Cardona says Republicans should appreciate President Obama's executive action on immigration.
updated 7:44 AM EST, Fri November 21, 2014
Van Jones says the Hunger Games is a more sweeping critique of wealth inequality than Elizabeth Warren's speech.
updated 6:29 PM EST, Thu November 20, 2014
obama immigration
David Gergen: It's deeply troubling to grant legal safe haven to unauthorized immigrants by executive order.
updated 8:34 PM EST, Thu November 20, 2014
Charles Kaiser recalls a four-hour lunch that offered insight into the famed director's genius.
updated 3:12 PM EST, Thu November 20, 2014
The plan by President Obama to provide legal status to millions of undocumented adults living in the U.S. leaves Republicans in a political quandary.
updated 10:13 PM EST, Thu November 20, 2014
Despite criticism from those on the right, Obama's expected immigration plans won't make much difference to deportation numbers, says Ruben Navarette.
updated 8:21 PM EST, Thu November 20, 2014
As new information and accusers against Bill Cosby are brought to light, we are reminded of an unshakable feature of American life: rape culture.
updated 5:56 PM EST, Thu November 20, 2014
When black people protest against police violence in Ferguson, Missouri, they're thought of as a "mob."
updated 3:11 PM EST, Wed November 19, 2014
Lost in much of the coverage of ISIS brutality is how successful the group has been at attracting other groups, says Peter Bergen.
updated 8:45 AM EST, Wed November 19, 2014
Do recent developments mean that full legalization of pot is inevitable? Not necessarily, but one would hope so, says Jeffrey Miron.
updated 8:19 AM EST, Wed November 19, 2014
We don't know what Bill Cosby did or did not do, but these allegations should not be easily dismissed, says Leslie Morgan Steiner.
updated 10:19 AM EST, Wed November 19, 2014
Does Palestinian leader Mahmoud Abbas have the influence to bring stability to Jerusalem?
updated 12:59 PM EST, Wed November 19, 2014
Even though there are far fewer people being stopped, does continued use of "broken windows" strategy mean minorities are still the target of undue police enforcement?
updated 9:58 PM EST, Mon November 17, 2014
The truth is, we ran away from the best progressive persuasion voice in our times because the ghost of our country's original sin still haunts us, writes Cornell Belcher.
updated 4:41 PM EST, Tue November 18, 2014
Children living in the Syrian city of Aleppo watch the sky. Not for signs of winter's approach, although the cold winds are already blowing, but for barrel bombs.
updated 8:21 AM EST, Mon November 17, 2014
We're stuck in a kind of Middle East Bermuda Triangle where messy outcomes are more likely than neat solutions, says Aaron David Miller.
updated 7:16 AM EST, Mon November 17, 2014
In the midst of the fight against Islamist rebels seeking to turn the clock back, a Kurdish region in Syria has approved a law ordering equality for women. Take that, ISIS!
updated 11:07 PM EST, Sun November 16, 2014
Ruben Navarrette says President Obama would be justified in acting on his own to limit deportations
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT