The average person uses 191 services that require entering a password or other credentials, according to a report by cybersecurity firm Digital Shadows. All of these usernames, passwords and other credentials are becoming increasingly vulnerable as criminals increase and refine their “credential-hacking operations,” the report said.
There are more than 15 billion stolen credentials circulating in the marketplace – a 300% increase since 2018. The source of these credentials: 100,000 breaches.
Of those 15 billion, 5 billion are unique, meaning they are not the same passwords used across different accounts. Most of these credentials belong to ordinary users. The report emphasizes, as do many security experts, that users should never use the same password across different accounts.
“The message is simple – users should use different passwords on each account,” said Rick Holland, CISO of Digital Shadows.
Businesses individuals whose emails are public should also be careful.
How valuable is a password? Although cybercriminals offer many credentials for free, those for sale cost an average of $15.43, the report explained.
See how criminals value your credentials:
- Access to the organizations' core systems is selling for up to $140,000, with the average sale being $3,139.
- Bank and other financial accounts are selling for an average price of $70.91.
- Account accesses for antivirus programs cost around $21.67.
- Accounts for media streaming, social media, file sharing, virtual private networks (VPNs), and adult content sites are selling for less than $10.
What's driving all this criminal activity? Hacking an account "has never been easier (or cheaper) for cybercriminals," the report noted.
So-called brute force cracking tools are available on the dark web and sell for an average of $4. Brute force attacks are generally those where an attacker tries to guess passwords based on common passphrases, hoping to guess correctly.
Criminals can also purchase Account Takeover (ATO) “as-a-service.” Essentially, the criminal rents an identity, often for less than $10.
Sentry MBA is a very popular tool, as is OpenBullet.
The report cited Verizon's data breach report, which stated that over 80% of hacking-related breaches were done through brute-force cracking or using lost/stolen credentials.
