{"id":20528,"date":"2022-12-29T21:22:24","date_gmt":"2022-12-29T17:22:24","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/how-criminals-can-get-your-password\/20528\/"},"modified":"2022-12-29T21:22:59","modified_gmt":"2022-12-29T17:22:59","slug":"how-criminals-can-get-your-password","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/how-criminals-can-get-your-password\/20528\/","title":{"rendered":"How your password \u0441an get into the wrong hands"},"content":{"rendered":"

For most us, a password is simply the most common method for authentication for countless online services. But for cybercriminals, it\u2019s much more \u2014 a shortcut into someone else\u2019s life, a work tool of central importance, and merchandise that can be sold. Knowing a password, crooks not only can get hold of your accounts, data, money, and even identity; they can also use you as a weak link to attack your online friends, relatives, or even the company you work for or manage\/own. To prevent this, you need to understand how outsiders can get hold of your password in the first place.<\/p>\n

How can your password fall into the hands of cybercriminals?<\/h2>\n

\nThere\u2019s a widespread misconception that to give your password to cybercrooks, you need to make a mistake \u2014 download and run an unchecked file from the internet, open a document from an unknown sender, or enter your credentials on some suspicious website. True, all those behavior patterns can make attackers\u2019 life much easier, but there are other scenarios as well. Here are most common cybercriminal methods of getting access to your accounts.<\/p>\n

Phishing<\/h3>\n

\nThis is indeed one of the credential-harvesting methods that relies mostly on human error. Hundreds of phishing sites, aided by thousands of mailouts leading to them, appear daily. However, if you for some reason think that you\u2019ll never fall for the phishing trick \u2014 you\u2019re wrong. The method is almost as old as the internet itself, so cybercriminals have had plenty of time to develop numerous social engineering tricks and disguise tactics. Even professionals sometimes cannot distinguish a phishing email from a real one at a glance.<\/p>\n

Malware<\/h3>\n

\nAnother common way of stealing your credentials is with malware. According to our statistics, a significant proportion of active malware is made up of Trojan stealers, whose main purpose is to wait until a user logs on to some site or service, and copy their passwords and send them back to their authors. If you\u2019re not using protective solutions, Trojans can hide on your computer undetected for years \u2014 you\u2019ll not know that something is wrong, because they don\u2019t cause any visible harm, just silently do their job.<\/p>\n

And stealer Trojans are not the only malware that hunt for passwords. Sometimes cybercriminals inject web skimmers on sites and steal anything that users input, including credentials, names, card details and so on.<\/p>\n

Third party leaks<\/h3>\n

\nHowever, you don\u2019t have to make the same mistake yourself. It\u2019s enough to be a user of some insecure internet service or client of a company that leaked a database with its customers\u2019 data. Of course, companies that take their cybersecurity seriously don\u2019t store your passwords at all, or at least do so in encrypted form. But you never can be sure that there were sufficient measures in place. For example, this year\u2019s leak from SuperVPN <\/u>contained the personal details and login credentials of 21 million users.<\/p>\n

Also, some companies cannot avoid storing your passwords at all. Yes, I am talking about the infamous LastPass password-management-utility hack. According to the latest information, an unknown threat actor accessed cloud-based storage with some customer data, including backups of customers\u2019 vaults. Yes, those vaults were properly encrypted, and LastPass never stored or even knew the decryption keys. But what if LastPass clients locked their vaults with a password that was already leaked from some other source? If they reused an insecure password then now cybercriminals would be able to access all their accounts at once.<\/p>\n

Initial access brokers<\/h3>\n

\nAnd here we come to another source of stolen passwords \u2014 the black market. Modern cybercriminals prefer to specialize in certain fields. They may steal your passwords but not necessarily use them: it\u2019s more profitable to sell them wholesale. Buying such password databases is especially attractive to cybercriminals, because it gives them an all-in-one: users tend to use the same passwords across a number of platforms and accounts, often tying them all to the same email. Thus, having the password from one platform, cybercriminals can gain access to many other accounts of the victim \u2013 from their gaming accounts to their personal email or even private accounts on adult websites.<\/p>\n

\"An<\/a>

An advert from a hacker\u2019s forum: someone is offering 280 thousands of usernames and passwords for various game platforms for just $4,000<\/p><\/div>\n

Leaked corporate databases that may or may not contain credentials are also sold on the same black market. The price of such databases varies depending on the amount of data and the industry of the organization: some password databases may be sold for hundreds of dollars.<\/p>\n

There are certain services on darknet that aggregate leaked passwords and databases, and then and enable paid subscription-based or single time access to their collections. In October 2022, the infamous ransomware group LockBit hacked <\/a>a healthcare company, and stole their user databases with medical information. They not only sold subscriptions to this information on the darknet \u2014 presumably they bought initial access on the same black market.<\/p>\n

\"A<\/a>

A darknet services that provides paid access to databases with stolen data<\/p><\/div>\n

Brute-force attacks<\/h3>\n

\nIn some cases, cybercriminals don\u2019t even need a stolen database to find out your password and hack into your account. They can use brute-force attacks, in other words try thousands of typical password variants until one of them works. Yes, it doesn\u2019t sound too reliable. But they don\u2019t need to iterate over all possible combinations \u2014 there are certain tools (Wordlist Generators) that can generate a list of possible common passwords (so-called brute-force dictionaries) based on the victim\u2019s personal information.<\/p>\n

Such programs look like a mini questionnaire about the victim. They ask for the name, last name, date of birth, personal information about partners, children, and even pets. Attackers may even add additional keywords they know about the target that can be thrown into the mix. Using this mix of related words, names, dates, and other data, wordlist generators create thousands of password variants, that attackers later try while logging.<\/p>\n

\"A<\/a>

A service that can generate a dictionary for bruteforce attacks based on information known about the intended victim.<\/p><\/div>\n

To use such method, cybercriminals need to conduct research first \u2014 and this is when those leaked databases may come in handy. They may contain pieces of information such as birth dates, addresses, or answers to \u201csecret questions\u201d. Another source of the data is oversharing in social networks. Something that looks absolutely insignificant, such as a photo from Dec. 6 with the caption \u201ctoday is my beloved doggie\u2019s birthday\u201d.<\/p>\n

Possible consequences of a leaked or brute-forced password<\/h2>\n

\nThere are some obvious consequences: cybercriminals can take over your account and hold it for ransom, use it to scam your contacts and online friends, or, if they\u2019re able to get the password to your banking site or app, empty your account. However, sometimes their intent is not so straightforward.<\/p>\n

For example, with more games introducing in-game currency and micro-transactions, more users have their payment methods linked to their accounts. This makes gamers an interesting target for hackers. By obtaining access to the gaming account, they can steal in-game valuables like skins, rare items or internal game currency, or misuse the victim\u2019s credit card data.<\/p>\n

The leaked databases and information that can be obtained while searching your accounts can be used not just for financial gain but also for reputational harm and other types of social damage, including doxing<\/em>. If you\u2019re a celebrity, you can be blackmailed and face a choice: disclosure of personal information (that could affect your reputation) or loss of money.<\/p>\n

Even if you\u2019re not a celebrity, you can become a victim of doxing \u2014 the act of revealing identifying information about someone online \u2014 such as their real name, home address, workplace, phone, financial, and other personal information. Doxing attacks can range from the relatively harmless, such as sign-ups to countless mailing lists or fake pizza delivery orders in your name, to the far more dangerous ones, such as various forms of cyberbullying, identity theft, or even in-person stalking.<\/p>\n

Finally, if you\u2019re using the same password for personal and work accounts, cybercriminals can take over your corporate e-mail and use it for business e-mail compromise schemes or even targeted attacks.<\/p>\n

How to protect your accounts from unwanted access<\/h2>\n

\nFirst of all \u2014 always keep password hygiene in mind:<\/p>\n