A simple experiment conducted by cloud security provider Bitglass has shown how quickly a compromised account, whose password has been leaked, can attract hackers.
The Bitglass experiment revolved around a fake identity created for a fictional bank employee. The researchers created a fake banking portal, a virtual Google Drive , and added boobytrapped files that were controlled through the Bitglass service.
Once the researchers created the fake service, they leaked it on the Dark Web as phished credentials for a Google Drive account.
Within a day of posting the data online, Bitglass detected three connections to the Google Drive account, as well as five more to the fake banking portal. After two days, the hackers had already downloaded the files, and within a month, Bitglass had recorded more than 1,400 connection attempts from 30 different countries, with many hackers returning multiple times over several consecutive days.
The hackers also tried to use the leaked credentials for the victim's other accounts, showing exactly why password is a dangerous habit.
As you might have guessed, the majority of the traffic came from Tor IPs. 68% of the hackers used the service to anonymize their IP address, and those who didn't used it used a VPN instead.
There were a few “strange” hackers who connected from real IP addresses, and most of them came from Austria, the Netherlands, the Philippines, Turkey, and the US.
The experiment, called Project Cumulus, also showed that once inside a Google Drive, some attackers didn't just sit idle but tried to download sensitive files.
Bitglass says that 12% of the hackers who managed to connect tried to download files and some even managed to open encrypted documents.
This was the second time Bitglass has conducted this research, having done so again in April 2015. The company examined the data from the last experiment once again and was surprised to discover that after hackers initially avoided downloading and accessing data from the first attempt at first, eight months later, over 200 people had access to these particular booby-trapped files.
Bitglass's Where's Your Data? report is available for download. At just six pages, it's a very interesting and quick read
