Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Every now and then a known website is hacked, such as what happened to Adobe or Cupid Media.
In such incidents user data is leaked, including usernames, encrypted (and sometimes plain text!) passwords. Users who reuse their password might have their accounts in other web applications compromised as well.

The company I work for runs a large web application. We would like to protect our clients from the collateral damage of such security breaches, by reseting the passwords of users whose accounts were compromised, such as what Facebook did in the recent Adobe breach.

How can we find the leaked user lists in such incidents?

share|improve this question
1  
Torrent sites... –  razethestray Nov 21 '13 at 9:01
add comment

3 Answers

up vote 1 down vote accepted

Some breaches are publicly disclosed on PasteBin or similar sites, but these are relatively few and far between. Even if you could get a list of all e-mail addresses belonging to compromised accounts from all the data breaches, this will only help you find users who might be affected. This does nothing to tell you if your users actually used the same password on both your site and a compromised site, so you may end up forcing resets on passwords that didn't really need it. At the rate breaches happen these days, you could be doing this fairly often and this will really begin to upset your users.

If you're storing passwords correctly, there is no way you could even check a list of known-compromised passwords against your entire user database. The best you could hope to do is to inject some sort of check into your login process, where you have a chance to capture your users' passwords (temporarily) in the clear. This could help you to spot users with compromised passwords when they log in, but not all of your users are going to log in any time soon and thus some of your users may never have their passwords checked. This would also add otherwise-unnecessary complexity to a security-sensitive process, which is generally ill advised.

Even if you could check all of your users' passwords and verify whether or not they've been compromised, this still leaves open the possibility that the users did not re-use their compromised password on your site but did re-use it on their e-mail address - generally a critical component in password reset processes, and probably part of yours. These accounts would still be vulnerable to compromise on your site, after their e-mail accounts have been hijacked, and you would never know it.

Instead of resetting account passwords every time there's a breach, and thus having to go through the trouble of figuring out whose passwords really needs to be reset, your best point of focus (as mentioned by @LucasKauffman) is on user education. Keep your ear to the ground for notices of website breaches, particularly those where account names/e-mail addresses and passwords are leaked, and make sure your users are made aware of them when they happen.

Send out an e-mail notice to all of your users that tells them what accounts may have been breached, and what they should do if they think they are affected. Make sure to remind them that they should not just change their password on the affected site, but also on any other account which used the same password. Also remind them that they should be using strong passwords which are not being re-used on different accounts. You may wish to include (by mentioning product/website names and/or key search terms - not using hyperlinks) pointers on where users can go for more information regarding the breach or for tools to help them create and manage secure passwords. Remind them to be vigilant against phishing attacks, which often can follow high-profile data breaches, and never to provide account details or follow suspicious links in e-mail.

share|improve this answer
add comment

Web security guru Troy Hunt has a site called have I been pwned? which checks an email address against those associated with a number of breaches. The passwords gleaned from the breaches are not retained there, so it's useful for determining if an account may be affected but does not disclose what the passwords or hashes were that were stolen.

share|improve this answer
    
Note that Troy's site is not generally intended to be used to check lists of e-mail addresses. The public search function only allows checking of a single address at a time, or an entire domain which you can prove you have control over. You may be able to do some batch checking via the API, and a custom script, though. –  Iszi Feb 19 at 18:33
add comment

The problem is that they are not shared publically through normal channels. Often you can find them on the back channels. LastPass has found a database like this and offer a checking service on their website. However I would recommend you not to use this as you will be transfering all your user accounts to LastPass.

You could try looking for the database yourself. As an alternative you could send an email to all your customers insisting to change their passwords if they used a similar at Adobe.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.