Redditor finds list of 47k email addresses with passwords

http://www.reddit.com/r/AskReddit/comments/m8uuc/reddit_i_just_came_across_a_list_of_about_47k/

by 8ig8 • 15 years ago

103 27 15 years ago

TomGullen• 15 years ago

Easiest thing would be to send the list to Hotmail

stfu• 15 years ago

Yeah, but logging into half of the accounts first wasn't probably the smartest idea. Hope he is working from behind a proxy and not getting negative consequences out of that stupid idea.

artursapek• 15 years ago

I wonder why he felt the need to run it for two hours before deciding the login combinations were legit.

aptwebapps• 15 years ago

Revisit the link for an update. He or she spoke with Microsoft. From a comment it seems they initiated contact through Reddit, in fact.

powertower• 15 years ago

Not a smart thing to do (to log into those accounts).

If you found a bunch of house keys, each one labled with the address of the house, would you go to each house and open each door? Stepping inside is not necessary.

That of itself, might not break any laws (without prior warning, or intent to cause harm, it might not be trespassing), but computer tresspass laws only require unauthorized access.

koenigdavidmj• 15 years ago

You might not have entered the house, but you did enter the land.

derfclausen• 15 years ago

The account probing might be unlawful, but I think the key analogy is a bit of a reach.

eigenvector• 15 years ago

Right, in many jurisdictions unauthorized access to a home is a much more serious offence than standard trespass.

pbhjpbhj2• 15 years ago

Isn't what he's done more like war-dialing than actual cracking in real terms though.

I'll agree that in legal terms he's almost certainly the wrong side of the tracks.

vinhboy• 15 years ago

I never like it when people compare the digital world to the real world.

It's like the whole "would you download a pizza" statement.

The answer is always, yes, yes I would.

I hope our politicians and law enforcement officials do not treat the digital world like its the real world. Things are just not the same... We need separate rules and separate code of ethics for each.

code_duck• 15 years ago

I consider my email to be like a personal folder, where I have an expectation of privacy. If I accidentally left my briefcase at your office, I would hope you wouldn't look through it.

If you found the keys to a room full of filing cabinets with other people's papers, it wouldn't be right to go open them all. Similarly, if you find a list of credentials that grant you access to the electronic documents of others, it's not right to use those credentials. Of course 'downloading a car' is a terrible metaphor, but comparing electronic documents to printed documents seems very straightforward.

tptacek• 15 years ago

The Python script was a terrible idea. No matter what your opinion of the equivalence between real property and email accounts is, he essentially played russian roulette with many thousands of dollars of legal fees.

Just assume the passwords work and move from there.

dlitz• 15 years ago

> If you found a bunch of house keys, each one labled with the address of the house, would you go to each house and open each door?

I'm so tired of these analogies. The Internet is not like the physical world. Why don't we talk about what actually happened, rather competing to come up with the worst analogies?

ell• 15 years ago

Is there a reason why the list contains Hotmail accounts only? Does this mean Hotmail users are easier to hack into?

xenophanes• 15 years ago

I'm curious too. If they had a big list and broke it up into pieces to put on different computers, it wouldn't make sense to organize it by email provider. That makes it easier to get caught if all the hotmail access comes from one computer instead of spread around.

Maybe a seller split up a master list that way. "I'll sell you 50k hotmail accounts".

bbarthel• 15 years ago

According to the op he found the site via a phishing email. So likely it was just a mass mailing to hotmail accounts, or designed to look like it came from the hotmail team - naturally only Hotmail users would be worried about an email them.

CyrusL• 15 years ago

Most likely the phisher had a Hotmail-specific method to hit inbox, so their spam was more effective on Hotmail than other providers. The other possibility is that the phishing page emulated a Hotmail login, so only those with Hotmail accounts would believe it enough to enter their info.

gglanzani• 15 years ago

I think hotmail has serious security flaws. I get almost weekly emails from hotmail user whose account has been spammed. I warn them, they change password (they make it more difficult) and sometimes they hack their account again!! It's unbelievable.

omarchowdhury• 15 years ago

Hotmail has a higher daily limit on how many e-mails each account can send out than other free services.

For a spammer, there's higher throughput to be had per account than going with Yahoo or GMail.

karolist• 15 years ago

As suggested on reddit, they all might belong to the same spammer. I don't know about hotmail account creation, but if it's protected by captchas only spammers have no problems making the accounts. Some captchas can be decoded in code with high success relatively quickly, others can be fed to mturk style services.

Google has phone verification now, I guess that's harder to overcome.

craigmc• 15 years ago

You can (or could) buy 'aged' hotmail address for cents - these have never been used by real users. As for captchas a quick google search will offer up a heap of solving services, many even with APIs! The only way to protect a service against spammers or blackhatters is to stop it from being useful to them in the first place (i.e. don't allow links in profiles, etc. Harder for services like email which can't really be hobbled to prevent this sort of use without trashing the key function).

Either through automation software or (as you note) mturk style services, pretty much any anti-spam defence can be breached.

Presumably if the list of hotmail accounts was just for outbound spamming then one of the addresses on the list would have been used to send the original phishing email.

sukuriant• 15 years ago

See. I'm torn. I know it's illegal, but if you present the information about the list to a company (without logging in to the accounts), and they don't take action, what do you do?

I suppose you could email all of the people on the list, but how effective would that be?

pbhjpbhj2• 15 years ago

You'd probably need a good spamming system to get it past the spam checkers. They're going to spam-bin short duplicate emails sent to a large multitude of users I'd expect.

learc83• 15 years ago

I say the chinese government is building a massive list of email password pairs that they can use down the road.

chrisdroukas• 15 years ago

That's not a reasonable assumption given the data presented.

nmridul• 15 years ago

From the look of it, this need not have to be hacked accounts. Normally spammers create thousands of accounts on free email services and the bots are used to auto login and send spams out. Mails sent from hotmail, msn etc has better chances of reaching your inbox than that sent from custom domains which could easily end up in spam folders.

The spammers favorites are hotmail and msn as they are easy to create. Gmail has phone verification and other added stuffs that makes it difficult for bots to create accounts.

The server that redditer accessed could be the spammer's server where he stored the user name / passwd in plaintext format for the bots.

Redditor finds list of 47k email addresses with passwords

Related Stories