Huge security breach from Onliner Spambot

Author Topic: Huge security breach from Onliner Spambot  (Read 3333 times)

http://www.iflscience.com/technology/if-your-email-address-is-on-this-list-change-your-password-right-now/
https://www.troyhunt.com/inside-the-massive-711-million-record-onliner-spambot-dump/

Quote
In one of the largest single data sets of emails yet discovered, computer security experts have come across a spam list containing a pretty extraordinary 711 million email addresses. Initially uncovered by the Paris-based security researcher known as Benkow, it contains two separate troves of data, one simply of email addresses, while the second more serious set contains addresses and passwords.

The important thing to do now is to stick your email into haveibeenpwned.com to see if yours is one of the unlucky 700 million address that has been harvested, or one of the even more unfortunate souls to have also had their passwords picked too.

The site is run by a computer security expert Troy Hunt, who is the one who first got his hands on the mega list after Benkow sent it to him, and subsequently uploaded it. As he writes on his website, this is the largest single data set he has ever loaded into Have I Been Pwned, and that “for a sense of scale, that's almost one address for every single man, woman, and child in all of Europe.”

The data was harvested by a machine known only as “Onliner Spambot”, which pointed Hunt and Benkow to an IP address listed in the Netherlands, though Hunt stresses that he won’t publish this bit for fear of spreading the data further.

While law enforcement has been notified in an attempt to get it shut down, that doesn’t seem to have happened yet. So, as I’m sure you don’t need telling again, you should really check whether or not your email is on the list, and, more importantly, if they have your password too.

If you find that it has been hoovered up, then by now we should all know what to do. But I’m going to tell you anyway. Change the password. This goes not only for the email address in question, but also for any other websites that you may have used that password for. We all know that this is a total pain in the ass, but if someone had made a copy of your house key, you’d sure as hell get the locks changed.

you can check to see if you were affected using this link.

if you are, change your passwords now, or risk being compromised.

i was affected on my main email, but i use authenticator so i shouldn't be in too much of harm


im honestly surprised that i got nothing on me considering how many different email accounts i have

i was pwned last year apparently

no pwnage detected we all good



it detected something related to my email address but the thing is i have multiple passwords for accounts that use that email address, some of which are 20 character long randomly generated nonsense which im pretty sure cant be cracked

is it hashed?? plaintext?? i need more details to take an appropriate action

Lmao school email got pwned 5 times

yeah forget you edmodo


it detected something related to my email address but the thing is i have multiple passwords for accounts that use that email address, some of which are 20 character long randomly generated nonsense which im pretty sure cant be cracked

is it hashed?? plaintext?? i need more details to take an appropriate action
yeah idk

mine are not pwned few

Lowkey me anytime this happens:
"well there's a lot of other people compromised so what's the chances they will use mine?"

Just change your password. In the rare chance a hacker tries to log into your account, it won't work the first time since the passwords change, and he'll just move on.

Besides, doesn't google and everything else have phone verification and what not?

Just change your password. In the rare chance a hacker tries to log into your account, it won't work the first time since the passwords change, and he'll just move on.

Besides, doesn't google and everything else have phone verification and what not?
1. there are programs which calculate and randomize numbers and letters until it finds the password
2. yes