Data from a 2013 breach of the YouHack cybercrime forum resurfaced online, exposing 7. 2 million email addresses and password pairs
The leak also included forum user details, usernames, IP addresses, and weakly protected MD5 password hashes
Researchers warn recycled breach data and cracked passwords remain valuable for credential-stuffing and account takeover attacks
A large treasure trove of data stolen roughly 13 years ago has again surfaced on the clear web, with millions of email addresses, belonging to both innocent victims and notorious cybercriminals leaked online and found their way to Have I Been Pwned? (HIBP). HIBP is a free online service that allows users to check whether their email address or phone number appeared in any known data breach. HIBP recently added a new database containing roughly 7. 2 million addresses. As it turns out, these addresses were stolen in May 2013, when an infamous Russian-language hacking forum YouHack suffered a breach at the hands of unnamed miscreants. The leaked archive contains almost 7. 2 million email addresses and password pairs belonging to various victims whose secrets were posted on the forum. It also contains 107,000 forum members’ email addresses, usernames, IP addresses, and MD5 password hashes – “most of which were unsalted” – HIBP said. Unsalted MD5 passwords
Decade-old email addresses, usernames, and IP addresses of various hackers are probably not valuable information. Cybercriminals are known for using VPNs and proxy services to hide their locations, as well as disposable emails, so even if the data was recent, its usability would still be questionable, at best. Passwords, however, are a different story. Just like the rest of us mortals, cybercriminals are known for failing to practice basic cyber-hygiene, often using the same passwords across a myriad of services. When those passwords are hashed with MD5 and unsalted, it becomes a problem. As a cryptographic hashing algorithm, MD5 converts passwords into fixed-length strings…