Bach Seat

Pwnedlist.com will tell you if your email has compromised. The site checks emails against a collection of nearly 5 million possibly compromised accounts. Brian Krebs at Krebs on Security reports that a user can enter a username or email address into Pwnedlist.com’s search box, and it will check to see if the information was found in any suspicious public data dumps.

Alen Puzic and Jasiel Spelman, two security researchers from DVLabs, a division of HP/TippingPoint created Pwnedlist.com. Mr. Puzic said. “… I could create a site that would help the everyday user find if they were compromised.”

Pwnedlist.com currently allows users to search through nearly five million emails and usernames found online at sites like Pastebin. The site also often receives large caches of account data that people directly submit to its database. Mr. Puzic told Krebs on Security it is growing at a rate of about 40,000 new compromised accounts each week.

The researcher said information contained in these data donations often makes it simple to learn which organization lost the information. “Usually, somewhere in the dump files there’s a readme.txt file or there’s some type of header made by a hacker who caused the breach, and there’s an advertisement about who did the hack and which company was compromised,” Mr. Puzic in the article. “Other times it’s really obvious because all the emails come from the same domain.”

DVLabs’ Puzic said in the article that Pwnedlist.com doesn’t store the username, email address, and password data itself; instead, it records a cryptographic hash of the information and then discards the plaintext data. According to the blog, a “hit” on any searched email or username only produces a binary “yes” or “no” answer about whether any hashes matching that data were found. It won’t return the associated password, nor does it offer any clues about where the data was leaked from.

Advice from the Pwnedlist developers

If Pwnedlist says your email or user ID is in their database, they offer the following advice:

1. “Don’t panic! Just because your email was found in an account dump does not mean it has been compromised.
2. Immediately change any passwords that might be associated with listed email accounts.
3. Go through all your accounts and create new passwords for each of them, just in case. “Better safe than sorry.”

The two researchers plan to publish regular updates to their Twitter account (@pwnedlist) when new data dumps are discovered. Longer-term, Mr. Puzic told Krebs that he plans a longitudinal study on password security.

rb-

I have several emails, professional and personal which thankfully Pwnedlist does not have in their databases. Follow password best practices and use an 8 character or longer password with at least one letter, number, and special character. Also, change your passwords regularly.

End-user password best practices:

1. Passwords should be something you can remember but difficult for others to guess. That means avoid information anyone can pick up from Facebook.
2. Use at least 8 characters. Some authentication systems will ask for more, but 8 well-chosen characters is usually enough.
3. Mix letters, numbers, uppercase, lowercase, and even symbols when possible. 1GrdDC@82 is stronger than letter22
4. Avoid dictionary words. Many brute force attacks are designed to guess them. ”Password” is not a good password.
5. Use a unique password for each account. Your password at work should be different from your Facebook password.
6. Do not share your password.

Related articles

• New Website Helps Discovering Compromised User Accounts (circleid.com)

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.