IT Jobs
Spyware, not phishing, caused Hotmail passwords leak, says security guru
ScanSafe researcher blames botnets, keylogging for password leaks
By Gregg Keizer | Computerworld US
Published: 11:15 GMT, 08 October 09
A security researcher at ScanSafe isn't buying Microsoft's and Google's explanation that hijacked Hotmail and Gmail passwords were obtained in a massive phishing attack.
Mary Landesman, a senior security researcher at San Francisco-based ScanSafe, said it's more likely that the massive lists -- which include approximately 30,000 credentials from Hotmail, Gmail, Yahoo Mail and other sources -- were harvested by botnets that infected PCs with keylogging or data stealing Trojan horses.
Landesman based her speculation on an accidental find in August of a cache of usernames and passwords, including those from Windows Live ID, the umbrella log-on service that Microsoft offers users to access Hotmail, Messenger and a slew of other online services.
One in ten users hack social networks
That cache contained about 5,000 Windows Live ID username/password combinations, said Landesman, who found the trove while researching a new piece of malware. "From the organisation [of that cache] and what the data looked like in raw form, I think it's more likely that this latest was the result of keylogging or data theft, not phishing," Landesman said.
She dismissed the idea that the passwords had been collected in a large-scale, industry-wide phishing attack, as Microsoft and Google both maintained.
"Another indicator is the sheer number of compromised accounts," Landesman said, referring to the two lists that have gone public. "Phishing is not generally a wildly successful scam, it doesn't have a big return. People are more savvy about phishing than we give them credit for."
Instead, it's more logical to assume that the passwords were acquired by botnet operators, who hijack PCs using security exploits, then later plant data-stealing malware on those machines. "That's a much more realistic source," said Landesman.
Email
Print
Comment
Permalink
Contact Us
RSS
Digg
Add your commentComments