Skip to main content

Russia hack is not that scary

By Chester Wisniewski
updated 11:39 AM EDT, Thu August 7, 2014
STORY HIGHLIGHTS
  • New York Times says 1.2 billion usernames and passwords were hacked by Russians
  • Chester Wisniewski: This is not as scary as it seems, carry on
  • He says company that found the hack may have a commercial interest in the reactions
  • Wisniewski: Of course, it's always good practice to use strong passwords

Editor's note: Chester Wisniewski is a senior security adviser at Sophos Inc., Canada. He researches computer security and privacy issues and is a regular contributor to the Naked Security blog. The opinions expressed in this commentary are solely those of the author.

(CNN) -- At least 1.2 billion usernames and passwords hacked. Is this truly scary or corporate fearmongering?

The New York Times published an article this week that has shocked the public. The article says that a Russian cybercrime group by the name of CyberVor has amassed this astoundingly large number of credentials from upwards of 420,000 distinct web sites.

My immediate response was: Yeah, so?

Chester Wisniewski
Chester Wisniewski

In the context of the story it would seem that countless passwords are now known to this criminal group, and we should be panicking and changing all of our passwords.

But wait a minute. Hold Security, the company that found this hack, may have a commercial interest in this reaction. Hold Security offers to tell companies if their usernames and passwords were compromised for the princely sum of $120. Arguably, Hold Security stood to make more money out of this story than the Russian hackers themselves.

Rather than go down the rabbit hole, let's focus on what this really means and how we should react.

While 1.2 billion is a big number, it appears that many of these credentials could have been obtained from previous large-scale breaches such as Adobe, Sony, LinkedIn, RockYou.com and eBay. The totals from these sites alone adds up to close to half a billion.

We can also assume that many of the 420,000 hacked websites were Mom and Pop blogs, forums and other places where people often consider using a "throwaway" password. The concept is that things like your email, social media and bank require secure, unique passwords. But all the other junk in our lives can just use a simple, less secure password.

The criminals don't have the passwords in most cases. They have cryptographic representations of the passwords known as hashes. These hashes come in a lot of varieties with varying degrees of security associated with them. The purpose of a hash is to slow down an attacker from being able to acquire your password if a password database is stolen.

This hashing is most effective if you follow good security practices, like not using dictionary words, and making sure to include numbers and symbols in your password. People in general are bad at choosing passwords. That means hashing is often only a speedbump for a determined attacker.

But the hashes bring out the truth of the matter. The criminals don't necessarily even have your password. They have a hash that could result in them discovering your password, especially if it is poorly chosen like password123 or qwrtyasdfg.

Read: Cyberattacks: Why you're the weakest link

Many of these stolen hashes may have been obtained some time ago, which means they are less useful to the crooks now. Of course, we don't know the truth and can't analyze what is known because Hold Security is trying to figure out how to monetize the knowledge, leaving even the experts a bit in the dark about how serious a discovery this truly is.

My advice? Keep calm and carry on. It is always a good practice to use strong passwords and different passwords on the different sites we use and change them if we have reason to believe they might be compromised.

There are many tools available to assist with automating this task, making it only a minor inconvenience to keep track of your new stronger passwords. Many are available at no cost. And if we have learned anything during our first 20 years of web surfing, it's that we need a helping hand with our passwords.

Hold Security's findings are interesting. If the research community gains access to the information we will all jump in with both feet to determine how it happened, what it means for Internet security going forward and possibly even who is behind the attacks.

But for the rest of the world? It's business as usual. Think before you click, do your best to follow best practices with regard to your privacy and safety and enjoy your online experience. It's not as scary as it looks.

Read CNNOpinion's new Flipboard magazine

Follow us on Twitter @CNNOpinion.

Join us on Facebook.com/CNNOpinion.

ADVERTISEMENT
Part of complete coverage on
updated 9:05 AM EDT, Tue September 16, 2014
LZ Granderson says Congress has rebuked the NFL on domestic violence issue, but why not a federal judge?
updated 7:49 AM EDT, Tue September 16, 2014
Mel Robbins says the only person you can legally hit in the United States is a child. That's wrong.
updated 1:23 PM EDT, Mon September 15, 2014
Eric Liu says seeing many friends fight so hard for same-sex marriage rights made him appreciate marriage.
updated 3:38 PM EDT, Mon September 15, 2014
SEATTLE, WA - SEPTEMBER 04: NFL commissioner Roger Goodell walks the sidelines prior to the game between the Seattle Seahawks and the Green Bay Packers at CenturyLink Field on September 4, 2014 in Seattle, Washington. (Photo by Otto Greule Jr/Getty Images)
Martha Pease says the NFL commissioner shouldn't be judge and jury on player wrongdoing.
updated 9:15 AM EDT, Tue September 16, 2014
It's time for a much needed public reckoning over U.S. use of torture, argues Donald P. Gregg.
updated 8:25 AM EDT, Tue September 16, 2014
Peter Bergen says UK officials know the identity of the man who killed U.S. journalists and a British aid worker.
updated 7:28 AM EDT, Tue September 16, 2014
Joe Torre and Esta Soler say much has been achieved since a landmark anti-violence law was passed.
updated 4:55 PM EDT, Fri September 12, 2014
David Wheeler wonders: If Scotland votes to secede, can America take its place and rejoin England?
updated 8:41 AM EDT, Tue September 16, 2014
Jane Stoever: Society must grapple with a culture in which 1 in 3 teen girls and women suffer partner violence.
updated 4:36 PM EDT, Fri September 12, 2014
World-famous physicist Stephen Hawking recently said the world as we know it could be obliterated instantaneously. Meg Urry says fear not.
updated 6:11 PM EDT, Fri September 12, 2014
Bill Clinton's speech accepting the Democratic nomination for president in 1992 went through 22 drafts. But he always insisted on including a call to service.
updated 6:18 PM EDT, Fri September 12, 2014
Joe Amon asks: What turns a few cases of disease into thousands?
updated 1:21 PM EDT, Thu September 11, 2014
Sally Kohn says bombing ISIS will worsen instability in Iraq and strengthen radical ideology in terrorist groups.
updated 6:31 PM EDT, Tue September 16, 2014
Analysts weigh in on the president's plans for addressing the threat posed by the Islamic State of Iraq and Syria.
updated 9:27 AM EDT, Thu September 11, 2014
Artist Prune Nourry's project reinterprets the terracotta warriors in an exhibition about gender preference in China.
updated 9:36 AM EDT, Wed September 10, 2014
The Apple Watch is on its way. Jeff Yang asks: Are we ready to embrace wearables technology at last?
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT