sb-nz logo
Story image

Mega users affected by credential stuffing attack; 15,000 affected

19 Jul 2018

The dangers of using the same usernames and passwords across multiple websites have become painfully clear for around 15,000 people this week, after a security researcher exposed a data breach that has caught users of file sharing website Mega.

The New Zealand-based website, which used to be managed by mogul Kim Dotcom, launched in 2013.

According to reports, the breach compromised Mega customers’ usernames, passwords, and filenames.

Mega confirmed these details, although Mega chairman Stephen Hall says Mega’s systems were not breached.

Instead, he says the problem lies in ‘credential stuffing’, which is when cybercriminals reuse login details from other data breaches against multiple websites. Often credential stuffing uses bots that carry out the stuffing attacks.

In this case it appears that the 15,500 users affected by this breach may have used the same username and password across many sites that have been hacked.

The Open Web Application Security Project (OWASP) further states that credential stuffing “is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts.”

“This is a subset of the brute force attack category: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.”

According to statistics from Akamai, credential stuffing attacks cost businesses an average of $6 million every year.

Centrify’s senior director APAC sales, Niall King, says the exposure of users’ Mega login credentials demonstrates the problem of relying on passwords alone.

“What minimal protective value passwords offer is often undermined by the poor security habits of too many users,” he says.

“People use easily guessed passwords - Time Magazine reported the most popular password of 2017 was 123456 - and have the dreadful tendency to re-use passwords across multiple websites, which make them vulnerable to credential stuffing, as appears to be the case with these Mega logins.”

King says password alternatives and multi-factor authentication can add extra protection.

“This might be a code sent to your smartphone or a biometric identifier such as a thumbprint, but it requires a second step to prove your identity. If multi-factor authentication is required for your logins, then the exposure of your password does not present any significant risk.”

Story image
SecOps opens new Cyber Defence Operations Centre in Auckland
Privacy Commissioner John Edwards officially opened the centre this week, recognising SecOps’ efforts to provide managed security services to New Zealand businesses.More
Link image
Webcast series: The necessary tools to secure a remote workforce
Experts from across the A/NZ region discuss the best security practices in a remote working world - with sessions available on the first Thursday of every month.More
Story image
McAfee finds vulnerabilities in 'temi' the videoconferencing robot
Temi is commonly used in environments including businesses, healthcare, retail, hospitality, and other environments including the home.More
Story image
Why it’s essential to re-write IT security for the cloud era
Key components of network security architecture for the cloud era should be built from the ground up, as opposed to being bolted on to legacy solutions built for organisations functioning only on-premises or from only managed devices.More
Story image
Check Point acquires Odo Security to bolster remote security offering
The deal will integrate Odo’s remote access software with Check Point’s Inifinity architecture, bolstering the latter company’s remote security capabilities in a time where working and learning from home has become the norm, and looks to largely remain that way in the near future.More
Story image
Exabeam and Code42 partner up to launch insider threat solution
The solution will give customers a fuller picture of their environment, and will leverage automated incident response to obstruct insider threat before data loss occurs.More