The Credential Crisis: It’s Really Happening
On Dec 8, 2017, 4iQ reported the discovery of a database on the dark web containing 1.4 billion credentials—in clear text.1 The fine writers of the aforementioned article note that they’ve “tested a subset of these passwords and most of them have been verified to be true.”
1.4 billion.
A standard calculator (like the one on your smartphone) cannot display 1,400,000,000 without using scientific notation. I tried; my poor iPhone can only manage to display 140 million. There aren’t enough digits on a standard calculator to deal with numbers of this magnitude. Our brains, it turns out, are similarly limited. The numbers associated with breaches of late is so large that scientists tell us we can’t really comprehend it.2 That’s usually why we talk in terms of percentages and round up to numbers easier to swallow, because we are much better at grasping those implications.
This innate inability is problematic, because as researchers note, “the larger a number grows, the harder it becomes to deal with. But sometimes, extremely large numbers lurking in the levels of billions and trillions and more, actually are relevant to the lives of everyday people. Take the national debt and government deficit for example. In order to understand such numbers, it’s important to have an understanding of the context that number falls into.”
So, let’s put them into context.
As of June 2017, there were approximately 3.8 billion Internet users across the globe,3 and 1.4 billion is just over one-third (37%) of all Internet users. That means if just three of us get together, the credentials from one of us was likely in that database.
If you’re uncomfortable with this revelation, let me make you even more uncomfortable: that’s just the tip of the proverbial iceberg.
F5 Labs gathered and analyzed data related to a decade of data breaches and discovered that 1.4 billion is a mere pittance when viewed against the almost 12 billion records (of all kinds) compromised over the past ten years.
“In 338 cases, almost twelve billion records (11,768,384,080) were compromised. That’s an average of 34,817,704 records per breach! To put that figure into perspective, the current world population is 7.5 billion, and the population of people online as of June 30, 2017 was 3.8 billion. That’s roughly 1.6 records breached per person in the world (just because you’re not online doesn’t mean your data isn’t), or 3 records per person online that have been breached.”
This research does not include the recent find by 4iQ. If we include that, the number of records breached rises to 13 billion, or an average of 3.5 records per person online.
The point is not to scare you into a fetal position under your desk. It is to ignite awareness that we are experiencing a very real and troubling credential crisis that cannot be managed simply by changing passwords anymore. Moore’s law and cloud computing are completely indifferent as to their application. They work just as well for the defenders as they do the attackers.
Source link
lol
On Dec 8, 2017, 4iQ reported the discovery of a database on the dark web containing 1.4 billion credentials—in clear text.1 The fine writers of the aforementioned article note that they’ve “tested a subset of these passwords and most of them have been verified to be true.” 1.4 billion. A standard calculator (like the one…