Thursday, March 28, 2024

24.6 Billion Pairs of Credentials For Sale on The Dark Web

As of this year, there are over 24.6 billion credential pairs are available or actively getting circulated on the dark marketplaces or dark web. However, it indicates that cybercrime has become a profitable business, one that has become extremely widespread.

At this point, it seems that one of the most hyped internet security categories is passwordless technology. Despite those initiatives, the reality is that passwords still remain firmly entrenched in the minds of many users.

As compared to the figures for the year 2020, the figures for last year showed an increase of 64%. In comparison to the two years prior to 2020, this represents a significant slowdown.

Limitless compromised data

The number of credentials for sale flew up by over 300 percent in the year between 2018 and the year the pandemic started. 

It is estimated that 6.7 billion of the 24.6 billion credentials are unique, which represents that over the past two years there is an increase of 1.7 billion. The figure equates to a 34 percent increase over where we were in 2020.

Cybersecurity analysts at Digital Shadows have claimed that almost 75% of the passwords, that’s the majority of passwords, available online for sale are purely common and easy to guess; in short, there is no uniqueness.

It is very easy for a cybercriminal to choose a compromised credential and attempt to use it since they have a limitless list of hacked credentials.

Here the primary culprit is the “Weak Password,” in short, an attacker can easily guess the passwords with the help of automated tools and compromise multiple accounts at a time.

The 123456 password appears in almost every 200 passwords offered by criminals, which is why many of those credentials have been stolen and compromised.

Weak Spots Enabling The ATO Attacker

Here below we have mentioned all the weak spots that are enabling the Account Takeover (ATO) attacker:-

  • Ever-Expanding Digital Footprint
  • Authentication Blind Spot
  • Too Late Attempts At Account Protection

Lifecycle of an ATO Attack

Taking part in an ATO is much like engaging in any kind of cyberattack: It begins with a mistake or a misconfiguration that enables the threat actors to take full advantage of the situation.

It continues to be difficult to detect until it is too late, but it is eventually caught. In a typical lifecycle, ATO can thrive in many scenarios, but the four main stages are parts of a typical lifecycle. And here below we have listed them all:-

  • Identification
  • Acquisition
  • Verification
  • Exploitation

Among the companies that have already agreed to implement FIDO-based authentication are Apple, Google, as well as Microsoft.

The problem of stolen and manipulated credentials used for ATO remains a growing problem, and organizations cannot afford to ignore it.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles