Forgot your password?
typodupeerror
Crime Facebook Security Social Networks

Russian Hacker Selling 1.5M Facebook Accounts 193

Posted by Soulskill
from the army-of-pokes dept.
Sir Codelot writes "A hacker who calls himself Kirllos has obtained and is now offering to sell 1.5 million Facebook IDs at astonishingly low prices — $25 per 1,000 IDs for users with fewer than 10 friends and $45 per 1,000 IDs for users with more than 10 friends. Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users. Quoting: 'VeriSign director of cyber intelligence Rick Howard told the New York Times that it appeared close to 700,000 had already been sold. Kirllos would have earned at least $25,000 from the scam. Howard told the newspaper that it was not apparent whether the accounts and passwords were legitimate, but a Russian underground hacking magazine reported it had tested some of Kirllos' previous samples and managed to get into people's accounts.'"
This discussion has been archived. No new comments can be posted.

Russian Hacker Selling 1.5M Facebook Accounts

Comments Filter:
  • Translation (Score:5, Insightful)

    by eldavojohn (898314) * <.moc.liamg. .ta. .nhojovadle.> on Sunday April 25, 2010 @12:25PM (#31975320) Journal

    Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users.

    Translation: it might not be a bad time to change your password if you use Facebook.

    • Re: (Score:3, Funny)

      by advocate_one (662832)
      that's if I could get in... FB is currently down for me...
    • Re:Translation (Score:5, Insightful)

      by Bergs007 (1797486) on Sunday April 25, 2010 @12:38PM (#31975492)
      Actually... what this means is that you should change your banking passwords. It appears that what they are trying to do is use Facebook login credentials to go and see if there are any associated bank accounts with the same login information.
      • Re:Translation (Score:5, Insightful)

        by pitchpipe (708843) on Sunday April 25, 2010 @12:57PM (#31975694)

        Translation: it might not be a bad time to change your password if you use Facebook.

        Actually... what this means is that you should change your banking passwords.

        Actually... what this means is that you shouldn't use the same password for more than one site. You should use an app that is encrypted and password protected to store all of your login info.

      • Re: (Score:3, Interesting)

        by init100 (915886)

        Actually... what this means is that you should change your banking passwords.

        Do any banks actually use ordinary password authentication? My bank has provided me with a Digipass, a small device with a numeric keypad, where I enter my PIN, select an authentication mode, input a challenge (a couple of randomly generated bank-provided numbers) and when confirming transfer orders, an amount. The device then displays a string of digits, which I enter into the bank login page. Using ordinary passwords seem pretty insecure in comparison.

        • Re:Translation (Score:4, Interesting)

          by human spam filter (994463) on Sunday April 25, 2010 @01:10PM (#31975802)
          Being from Europe I was pretty surprised when I came to the US and learned that virtually all* banks use ordinary passwords for online banking.. *the ones I know of: Citi, Bank of America, US Bank
          • Re: (Score:3, Interesting)

            by hedwards (940851)
            Honestly, E*Trade is pretty much the only one I can think of off the top of my head that uses something like that. Pretty much every bank in the country just uses simple passwords with verification questions. And an astonishing number don't bother to make their home page load via SSl.

            The main reason being that they aren't generally held accountable for breaches that may occur due to their own lax security measures. In relative recent history it was still relatively common for ID thieves to be able to get
            • by creimer (824291) on Sunday April 25, 2010 @01:21PM (#31975896) Homepage
              Basically make everything the fault of the victim even if it's clearly not their fault.

              And charge a fee. Remember, in the financial industry, you're criminally stupid if you don't make money off the mistakes of those around you. That's American capitalism for you.
              • by CAIMLAS (41445)

                The American financial industry was modeled on European banking practices. And then adopted back again by Europe.

        • by c_sd_m (995261)
          I know of a large North American bank that not only uses password auth, it limits pwds to 6 characters.
          • Re: (Score:3, Interesting)

            by mirix (1649853)

            I'll do you one better, a bank I had an account with wouldn't accept passwords with ~!@#$%^&*()_+/\?|`, etc, in them. Only ([a-zA-Z0-9]*) was allowed!

            In the 21st century. Pretty fucking impressive.

        • by Anonymous Coward

          Here in Finland, banks usually provide you with a list of ~50-100 one-time use codes, so it's basically impossible to figure out the next code unless you manage to find some pattern in the random digit generator that the banks use to generate those one-time codes. To me this seems even more secure than using those keypads that most other european countries seem to be using. The only way I can concieve this to be hacked is to figure out what someone's userid is (random generated string, i.e. basically a trad

          • Re: (Score:2, Interesting)

            by YXdr (1396565)

            the only way I can conceive this to be hacked ...
            Always a dangerous statement - just because you can't think of an attack doesn't mean there isn't one.

            You are correct that no one is going to guess the next one-time password. Instead, they are going to attack your machine, and piggyback on your session after you have logged in. This is happening in the wild today, although it's mostly aimed at larger commercial accounts.

            Those keypads are more secure because they can be used to enter unique data for

      • There are banks that allow you to log in with the same username/password auth system that sites like facebook use? If so, you should probably expect it to have been hacked ages ago.

    • Re:Translation (Score:5, Interesting)

      by tomhudson (43916) <barbara DOT huds ... a-hudson DOT com> on Sunday April 25, 2010 @01:16PM (#31975852) Journal
      1. Write script to make a million face facebook accounts, friend each other at random
      2. Sell fake accounts.
      • Re: (Score:2, Interesting)

        Some New Zealand guy found his account on a list that was published earlier by the hacker, sure he may be complicit in the fraud, but then that wouldn't explain why the Russian hacker magazine didn't notice anything special about those accounts, such as a lack of messages. Also I would assume that FB has some mechanisms in place for preventing one IP to be used for signing up several hundred times, so he would have to use stuff like a bot net, and a captcha breaker anyway. So creating 1.5M fake accounts wo
      • Only if they can break the reCaptcha shown when you register a new account.

    • by Hurricane78 (562437) <deleted@s[ ]hdot.org ['las' in gap]> on Sunday April 25, 2010 @01:46PM (#31976116)

      As if you needed a password to get the data of a Facebook account...
      Dude, just ask Zuckerberg nicely. You’re by far not the first one he sold account data out to.

      • by Bodrius (191265)

        If I had mod points I would tag this as insightful.

        I keep waiting for the inevitable Onion article for "Facebook CEO complains about unfair price competition from Russian hackers", except I wouldn't be too surprised to see it instead on the WSJ.

    • Re:Translation (Score:4, Insightful)

      by halcyon1234 (834388) <halcyon1234@hotmail.com> on Sunday April 25, 2010 @04:21PM (#31977618) Journal

      Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users.

      Translation: it might not be a bad time to change your password if you use Facebook.

      If Facebook was concerned about the safety of their users, why not just go UPDATE users SET must_reset_password = 1; Throw a reCaptcha onto the reset page, too, so the "hacker" can't automate that process.

      Of course there's a fatal flaw in my plan. "If Facebook was concerned about the safety of their users..."

    • by kerrbear (163235)

      >Translation: it might not be a bad time to change your password if you use Facebook.

      According to the article, the passwords are gleaned from malware installed on the user's machine. So even if you change your password, what is to prevent the same malware from sending the new password to this hacker guy and allowing him to resend the changed account info to his buyers?

    • So, I wonder....

      Am I safe? I have a six-character, alphanumeric password on facebook. But it's also my weakest password. I chose that one specifically because I don't trust FB, and didn't want to compromise my other passwords. Did they dictionary/brute force it, or did they get the passwds some other way?

      (Not that I have any personal info stored on FB anyway...)
  • by kyrio (1091003) <slashdot@@@lurkmore...com> on Sunday April 25, 2010 @12:25PM (#31975324) Homepage

    I can increase the size of my friend network and be the biggest star on the net!

  • ... to become a new man.
  • NOOO! (Score:3, Funny)

    by Anonymous Coward on Sunday April 25, 2010 @12:35PM (#31975462)

    What is going to happen to my beautiful farm :(

  • Great PoE (Score:5, Insightful)

    by BountyX (1227176) on Sunday April 25, 2010 @12:39PM (#31975504)
    I'm suprised they are not worth more since they represent a great point of entry for social attacks. Think Personalized spam (i.e. "Hey John, I think Laura wanted you to buy this for the concert you are attending next week"), targeted dictionaries, localized phising (i.e. location data deploys phising to compromised machines near you). Once you break a single friend in the "network" you gain additional information to everyone in that scope, so the return on entry is very promosing. An attacker can begin profiling ideal targets in the guise of friends. Ah, so many possibilties. Such a gold mine.
    • Re:Great PoE (Score:4, Interesting)

      by Bigjeff5 (1143585) on Sunday April 25, 2010 @12:45PM (#31975570)

      The wonderful thing about his product though, is that he can keep selling it even after he has sold it.

      He doesn't have 1.5 million accounts to sell once, he has 1.5 million accounts to sell over and over and over. He may only be able to get $50k for the lot, but he can sell them all a dozen times. Depending on if they catch him or not, and how effective they are at getting people to change their passwords (the only way to make the accounts worthless), this guy could make half a million dollars or more pretty easily.

      • by phillips321 (955784) on Sunday April 25, 2010 @12:51PM (#31975630)

        The wonderful thing about his product though, is that he can keep selling it even after he has sold it.

        He doesn't have 1.5 million accounts to sell once, he has 1.5 million accounts to sell over and over and over. He may only be able to get $50k for the lot, but he can sell them all a dozen times. Depending on if they catch him or not, and how effective they are at getting people to change their passwords (the only way to make the accounts worthless), this guy could make half a million dollars or more pretty easily.

        Not if I'm the first to buy them and change the passwords on the accounts....

        • Re: (Score:3, Interesting)

          by Anonymous Coward
          Yes, but that would make the accounts worthless pretty quickly. The "value" of the account is that both the buyer and the actual account owner know the password. So it looks like a completely legitimate thing when the buyer (pretending to be the actual account owner) sends messages to the account owners "friends" asking them to go to certain sites, run certain "cool" programs, etc. The value goes down pretty quickly if the original owner is locked out by a password change and tells all their "friends" that
          • by vegiVamp (518171)
            > pretty suspicious even to the average idiot user.

            Go see your doctor, you appear to be suffering from a bout of hopeless optimism complicated with unwarranted faith in mankind.
      • Re: (Score:3, Funny)

        by poena.dare (306891)

        In other news, FB has slashed prices on IDs to their spamverstisers!

      • by timeOday (582209) on Sunday April 25, 2010 @02:34PM (#31976542)

        He may only be able to get $50k for the lot, but he can sell them all a dozen times.

        Are you impugning the dignity of this entreprenuer? A man's word is his bond, and the most valuable asset he possesses. I'd be surprised if he isn't contacting legal counsel to initiate legal action against you for defamation of character as we speak!

    • by DarkOx (621550)

      Don't forget the value of all the answers for to factor authentication as well. Lots of banking sites and stuff will after you enter your password/username pair correctly also ask you something like, what is your mothers maiden name, or What is your favorite kind of car, or what elementary school did you attend, etc etc. All things that someone with access to your facebook account might have a very good shot at knowing.

  • Koobface (Score:3, Informative)

    by fineous fingers (927189) on Sunday April 25, 2010 @12:40PM (#31975516)
    Hmm, maybe 1 out of every 300 Facebook users' computers is infected with Koobface......
    http://news.cnet.com/8301-1009_3-20002112-83.html [cnet.com]
  • Play with fire (Score:5, Insightful)

    by Becausegodhasmademe (861067) on Sunday April 25, 2010 @12:45PM (#31975576)

    According to the Facebook statistics page the average account has 130 friends. If 1 in 300 accounts are compromised and you have circa 130 friends then the odds are quite high that the personal data you have "only available to friends" is going to become available to some fairly unfriendly people shortly.

    Reminds me of the evertrue saying 'play with fire and you'll get burnt'. I have always been mindful of the threat FB poses to my privacy and have completely closed down my account several times, but keep giving in and going back due to peer pressure from family & friends. This time I'm killing it off for sure. No organization, be it governmental or corporate should have control over so much of an individuals personal data.

    • Re: (Score:3, Informative)

      by Anonymous Coward
      For those of you who don't know how to leave Facebook... http://www.facebook.com/help/contact.php?show_form=delete_account [facebook.com]
      • Re: (Score:2, Offtopic)

        by daveime (1253762)

        I'M SORRY ANONYMOUS COWARD, I CAN'T LET YOU DO THAT.

        Filter error: Don't use so many caps. It's like YELLING. Nope, I'm just trying to emulate what was done on Tron and later revamped on Southpark. Stop being so fucking judgmental, you don't know me !

        • Re: (Score:2, Funny)

          by Sir_Lewk (967686)

          I'm just trying to emulate what was done on Tron and later revamped on Southpark.

          "I'm sorry [NAME], I can't let you do that." is a reference to HAL 9000 of 2001: A Space Odyssey fame.

          Not get off my lawn!

          • by daveime (1253762)

            Facepalm ... I'll hand in my geek card in the morning.

            Not get off my lawn!

            Okay, I'll stay right here on your lawn.

    • Re: (Score:3, Insightful)

      by Nidi62 (1525137)
      No one forces you to fill in all the information. Just have a page with your name on it if friends and family want you to have one. Just leave blank all the other sections. Then you have no problems with your personal information.
      • Re:Play with fire (Score:4, Informative)

        by Ron Bennett (14590) on Sunday April 25, 2010 @01:47PM (#31976132) Homepage

        No one forces you to fill in all the information. Just have a page with your name on it if friends and family want you to have one. Just leave blank all the other sections. Then you have no problems with your personal information.

        Wrong! This is one of the biggest misconceptions people have. The true value isn't one's profile per se, but who one's "friends" are and the various interactions between them.

        Unless your friends are all strangers who know little about you, your personal information is likely more exposed on Facebook than you realize. Often I see instances of a parent, sibling, in-laws, significant other, etc post personal details on one's Facebook wall, gallery, etc that are often visible to others on one's friend list, and even often to friends of friends too.

        And that's not even getting into the issue of rogue friends, which can easily sneak in to gather information; among the value of stealing FB IDs ... it's not always about getting passwords, but rather collecting data for other uses, such as, spear-phishing / more targeted attacks - learning one's security questions they have setup on say a banking site.

        Ron

        • by Nidi62 (1525137)
          Your friends aren't going to be putting where you live, where you work, your phone number, or any of that other crap on their page. And even if they are, you just tell them, don't put my personal information on there". If they don't respect your wish, de-friend them. You are throwing the baby out with the bathwater if you simply cancel your whole account.
          • Maybe not outright but little details add up. Keeping track of said details could be a full time job with some FB addicts.

            Good luck explaining why you defriended someone though.

      • by GIL_Dude (850471)
        I removed my personal information by just changing it to random cities, phone number of a business in that random city (address too). I was one of those who had some level of "real" info there in the past that was locked down to be visible by certain users only. However, with all the "privacy" changes (read turning off privacy) that FB has been making lately I went and changed the info to false info. I'd imagine some cache somewhere will still have the real stuff for awhile, but that it will become harder a
    • Exactly. Makes spear-phishing a cinch.

      You mention closing down your FB account permanently. If so, be sure you delete everything out of it, including unfriending everyone, all public / private messages, gallery pictures, etc. If you've recently closed your account, just log back in and reactivate it (may be occur automatically), delete everything, and then delete the account again. And to ensure your FB account remains deleted, do not try logging into it for a month (FB says wait two weeks, but don't trust

    • Re: (Score:3, Interesting)

      by flyingfsck (986395)

      Uhmm, you keep going back and keep keying in real personal data?

      Your Geek Card should be revoked.

      I also have a FB account, with nothing in it. Well, nothing that is remotely true anyway.

    • This time I'm killing it off for sure.

      No you won't.

    • According to the Facebook statistics page the average account has 130 friends. If 1 in 300 accounts are compromised and you have circa 130 friends then the odds are quite high that the personal data you have "only available to friends" is going to become available to some fairly unfriendly people shortly.

      Of course, the way facebook itself is headed odds are high that "only available to friends" data is already going to be available to everybody shortly. At least that's what facebook's retroactive TOS chan

    • by Jim Hall (2985)

      According to the Facebook statistics page the average account has 130 friends. If 1 in 300 accounts are compromised and you have circa 130 friends then the odds are quite high that the personal data you have "only available to friends" is going to become available to some fairly unfriendly people shortly.

      Does anyone out there actually give complete and correct information to Facebook? I work with university students, and it's scary how much "private" information they put out there, just because there's a box for it on a FB web form. I'm an 83-year-old grandmother, at least as far as FB's data collection goes. A bunch of other [optional] stuff was left blank.

      Although it is interesting that that 83-year-old went to the same high school and university that I did....

  • by blind biker (1066130) on Sunday April 25, 2010 @12:53PM (#31975662) Journal

    ...and yet, time after time, FB users ignored the abuse and kept on using the service. I really have little sympathy for such blatant and above all, stubborn disrespect for one's own security. And for what? To have "virtual friends"? To "keep in touch"? Both friends, conversing and socializing are more fulfilling when done in some of the more traditional ways.

    • Re: (Score:2, Insightful)

      by davepermen (998198)
      what do you care about your security if all you do is post crap? i care about my security for personal things. but those don't happen on facebook, where community things happen. and i don't care about privacy, there, at all. why should i?
    • by Anonymous Coward on Sunday April 25, 2010 @01:13PM (#31975838)

      You know, I really despise these "High and mighty" posts about how all FB users are irresponsible idiots. There are a number of great uses for Facebook, and many of us actually PREFER to be contacted via facebook by our friends, rather than the endless deluge of phone calls and text messages. If you're having a get-together, I'd much rather you invite me on FB than tell me in person, because chances are, I'm going to forget. And I don't really see the point of the privacy crap either. I only put information on a social site that I'm comfortable sharing socially. I don't get it.

    • by msimm (580077) on Sunday April 25, 2010 @01:39PM (#31976044) Homepage
      ...Don't hate the players hate the game dawg!

      Facebook users aren't security experts, they're family members, friends and loved ones. You remember those, right?

      Living in my IT bubble in San Diego it was easier for me to bag on Facebook and 'look down' on it's users but now that I'm unemployed and living temporarily with family I seen how useful it is for them to keep in touch with friends and relatives in a way that letters or email simply can't emulate.

      Besides, if we really thought Facebook was that bad instead of bitching about it we'd be the talent pool responsible for creating a better alternative (unless you believe that only venture-funded MBAs can take on such a technological challenge). For instance, I've never liked any of the popular/available dating sites, so what do you think I'm doing while I learn Mongodb in my free time?
    • by Haeleth (414428) on Sunday April 25, 2010 @02:02PM (#31976254) Journal

      Both friends, conversing and socializing are more fulfilling when done in some of the more traditional ways.

      Like what? Email, so my messages can get lost in the sea of spam? Phoning, during the roughly 1 hour each day when both I and my overseas friends are awake and at home, and they're exhausted after a long day and I'm rushing to get off to work? Maybe I should just hop on a plane every weekend to meet people face to face -- I'm sure that would be a fulfilling use of my time and money!

      Sorry, but services like Facebook fill an important gap that nothing else really caters for. If you don't like it, think of something better, but don't go round bashing it just because you personally have never moved out of your home town or made any friends who lived more than a street away.

    • by rliden (1473185) on Sunday April 25, 2010 @02:16PM (#31976394)

      I have a FB account. I have reestablished contact with old friends and very distant family members I didn't otherwise have contact with. The alternative to finding someone you have lost contact with (if your other close family and friends don't know where someone is or how to contact them) is by searching Google and hoping you find a reasonable match. Even then most sites that find a person for you want an idiotic amount of money and a buy in to their scam service to get the contact info. Then there isn't a guarantee that it is the right person or the contact info is still relevant.

      People do use FB for more than asking someone to fertilize their crops or signing some mob-mentality world solving petition. It's possible to use social networking in a responsible manner. Facebook does seem to have a blatant disregard for their users and it's possible that a better service will come along and people will move to it. Another point condescending pedants might be missing is the exposure of security and privacy risks can help to educate people who might not otherwise even know about them. That is, just because people aren't using social networking doesn't make them any more safe on the internet. There were plenty of online scams and security risks before social networking; at least now people can communicate the nature of them and educate users how to safeguard themselves. One of the first things I did after seeing that CBS news story is post it on FB so that people could change their FB and email password info.

      • People do use FB for more than asking someone to fertilize their crops...

        Disgusting.

      • Re: (Score:3, Insightful)

        by Ritchie70 (860516)

        Agreed. I've had a lot of fun catching up with high school friends I haven't seen or heard from in almost 25 years.

        Would I have ever gone and found these people via a more traditional mechanism? Of course not.

        Is it fun to chat with them, hear about who died, who had kids, and argue about politics? Yes.

        Could I live without it? Yes.

    • You are on Slasdot on Sunday, it's not like you have friends or social life, so stop pretending and get down from the high horse...

      • When you have a newborn at home, you don't have time to go out much. Especially when the baby has colics.

        But you're right: I don't have much of a social life at the moment. I definitely don't feel lonely, though!

  • ...the use of owning 1000 Facebook IDs ? What is the idea ? Who would want it ? I may be dense but appart from spam senders I don't see the use of this.
    • by larry bagina (561269) on Sunday April 25, 2010 @01:18PM (#31975876) Journal
      1. collect facebook ids
      2. ???
      3. profit!
    • It's much bigger than spam. Thousands upon thousands of other websites will let you log in by using only your facebook credentials. It takes two clicks (easily automated). If you don't already have an account, it typically just creates one for you.

      Now think about what those other websites might be.
      Now think about what those websites do with information in order to sell you things.
      Now think about what kind of information people would put on those other websites, knowing that "only facebook" has weird privacy

    • Re: (Score:3, Insightful)

      by drinkypoo (153816)

      ...the use of owning 1000 Facebook IDs ? What is the idea ? Who would want it ? I may be dense but appart from spam senders I don't see the use of this.

      You can make them all your friend to give you more power in Mafia Wars...

    • ...the use of owning 1000 Facebook IDs ? What is the idea ?

      Apparently to try the usernames and passwords on banking sites as some users use the same for both. Plus I'd imagine there are ways you could use it to blackmail/extort people...

  • I am pretty sure Facebook was going to enable "post-on-behalf-of" for everyone on their next privacy settings revision anyway for extra fun.

  • Pff, I bet I can get those accounts for a couple of bucks, by just asking Zuckerberg.
    After all, according to him, there is no privacy. Just make an app or something, and there you have the data.

    Man am I happy that I deleted my Facebook account. (Which was, other than the friends list, completely empty anyway. But you know. Friends, photos, messages... that’s already too much.)

  • To anyone who didn't get the message yet, there are three rules you should follow:

    1) Never use the same password in more than one place.

    2) Store the passwords somewhere safe.

    3) Use good quality passwords.

    Unix fans can generate good quality passwords with:
    od -N4 -tx4 /dev/random | cut -b9-
    or slightly better ones with:
    dd if=/dev/random count=6 bs=1 | uuencode -m - | tail -2 | head -1

  • They're probably just the type of fake accounts I've seen before attempting to friend random people. Most of them probably are female, with pretty photos lifted from the internet. The tipping point for price belies their nature: under or over ten? Real accounts usually have at least over fifty, if not hundreds of friends. That said, this still is a big security issue given the amount of data people's friends can get on their profile, and the proclivity for the younger kids to add anyone who friends the
  • i think he got me (Score:2, Interesting)

    by perryizgr8 (1370173)
    facebook today told me: "your account was accessed from an unusual place and has been blocked." then i had to do all sorts of things to prove i'm human and it told me to create a new password. i created such a strong password that i have forgotten it. now will have to change it again.
  • by Animats (122034) on Sunday April 25, 2010 @03:19PM (#31977050) Homepage

    Facebook shouldn't be storing your Facebook passsword, just an hash of it. That's how login systems have worked for thirty years. Doesn't anybody there have a clue about security?

  • ...probably some people "deserve" the trouble they attract when using computers. Using an easy login/password combination is something it's not my problem. Maybe illiterate people have this problem, but then "what did they expect" of computers and internet usage? They pretend it to be like turning on a bulb. It works, it doesn't work. I would sincerely propose something like "computer usage credentials certificate". Someone is ALWAYS pretending "using computers is something anyone can do" (ha!)

    No matter how

Computers are unreliable, but humans are even more unreliable. Any system which depends on human reliability is unreliable. -- Gilb

Working...