Jump to content
OLLI_S

[Forwarded] Check Entries agains known Breaches

Recommended Posts

Hello,

I have a suggestion for Enpass that increases the security of passwords and alerts the user when a website was hacked and a password change is recommended.

The password manager 1Password has a feature called watchtower.
They have an internal database of security breaches (database with information about hacked websites where user-data was stolen).
In this database they store the website and also the date of the breach.

1Password stores for password entries two modification dates:

  • modification date of the password
  • modification date of the entry

1Password checks the password entries against this database.
When a website was hacked after the password was changed in 1Password, then 1Password recommends to change the password.
When the password was changed after the hack of the website, then users get no notification.
So when the entry for a page was last changed today (like added some notes), but the password itself was changed 2 years ago, then users get a warning when the website was hacked 2 weeks ago.

For the password manager KeePass there is a plugin available called HaveIBeenPwned.
The plugin and the source code are available here: https://github.com/andrew-schofield/keepass2-haveibeenpwned
This plugin downloads the public breach lists form "'have i been pwned?" and from "Cloudbleed Checker".
The plugin checks (on demand) your passwords against these lists.

In KeePass there is no modification date of the password.
To get the modification date of the password the plugin checks the history of each entry and compares the passwords (to find out the modification date of the password).

Suggestion:
Please add also such a feature in Enpass in the Password Audits.
In my opinion it is OK if you use the public available lists from "'have i been pwned?" and from "Cloudbleed Checker" (like the KeePass Plugin).
This requires that you also store the "password modification date".

When you import entries from KeePass then you should also determine the password modification date of the entry.
In the KeePass XML the complete history is also exported.


Regards

OLLI

Edited by OLLI_S
  • Like 1

Share this post


Link to post
Share on other sites

Hello,

today I read in the media that there was a large data breach where 773 Million User Records were stolen:
https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/

In the article I can read:
In total, there are 1,160,253,228 unique combinations of email addresses and passwords.
The unique email addresses totalled 772,904,991. 

So a breach check that works with URLs (like described above) would really be helpful.
Especially when you actively warn the user.

Best regards

OLLI

  • Like 1

Share this post


Link to post
Share on other sites

Hey @OLLI_S,

The features for checking pwned passwords have already available in the Enpass. You can check under the ≡ menu from the toolbar -->  select Tools → Check for Pwned Passwords. For more details please have a look at our user manual.

Pwned passwords will be shown in Weak section of audit.

Thanks!

Share this post


Link to post
Share on other sites

Hello @Anshu kumar,

1Password and also the HaveIBeenPwnd plugin for KeePass check all my passwords agains HaveIBeenPwnd and warn me when I have not changed my passwords after the breach.

When any website gets hacked in December 2018 and I changed my password in October 2018 (before the breach), then I get a warning.
When I have changed the password in January 2019 (after the breach), then I don't get a warning.

So 1Password and the HaveIBeenPwnd plugin for KeePass remind me to change the password when a specific website gets hacked.
I am not a security expert but checking if the URL got hacked is different than checking if any passwords are found in the big password leag (from multiple sources).

This is the reason why the HaveIBeenPwnd plugin for KeePass offers 3 different menu entries:

  • Site/Domain based
  • Username based
  • Password based

Details see https://github.com/andrew-schofield/keepass2-haveibeenpwned

Best regards

OLLI

  • Like 1

Share this post


Link to post
Share on other sites

Hello @Anshu kumar,

I read in the German c't magazine that there were new password collections found in the web.
They called them Collections #2 to Collections #5.
Details see here: https://www.heise.de/security/meldung/Neue-Passwort-Leaks-Insgesamt-2-2-Milliarden-Accounts-betroffen-4287538.html

In the article they write that 2.2 billion accounts are affected.
So it is very important that Enpass helps us to find out if we are affected.

You should check like the HaveIBeenPwnd plugin for KeePass the following ways:

  • Site/Domain based
  • Username based
  • Password based

Best regards

OLLI

Edited by OLLI_S
  • Like 1

Share this post


Link to post
Share on other sites

Hello,

today I read in the c't magazine that a new database with 620 million accounts was found:
https://www.heise.de/security/meldung/Gehackte-Websites-620-Millionen-Accounts-zum-Verkauf-im-Darknet-4305517.html

They link also to an English article in The Register:
https://www.theregister.co.uk/2019/02/11/620_million_hacked_accounts_dark_web/

Here the following websites are affected:

  • 8fit (20 million)
  • 500px (15 million)
  • Animoto (25 million)
  • Armor Games (11 million)
  • Artsy (1 million)
  • BookMate (8 million)
  • CoffeeMeetsBagel (6 million)
  • DataCamp (700,000)
  • Dubsmash (162 million)
  • EyeEm (22 million)
  • Fotolog (16 million)
  • HauteLook (28 million)
  • MyFitnessPal (151 million)
  • MyHeritage (92 million)
  • ShareThis (41 million)
  • Whitepages (18 million)

It would be very useful if Enpass would alert users that have an account at one of these servers and asks them to change the password.
Only if the password change date is newer than the breach of the website, then the account is marked as safe.

Best regards

OLLI

Edited by OLLI_S
  • Like 1

Share this post


Link to post
Share on other sites

Hello,

sorry if I post again, but there was an other database found with 127 million accounts affected:
https://www.heise.de/security/meldung/Datenverkauf-im-Darknet-Nachschlag-mit-127-Millionen-weiteren-Accounts-4310778.html

Here the English article they link to:
https://techcrunch.com/2019/02/14/hacker-strikes-again/

Here the following websites are affected:

  • Houzz (57 million accounts affected)
  • YouNow (40 million accounts affected)
  • Ixigo (18 million accounts affected)
  • Stronghold Kingdoms (5 million accounts affected)
  • Roll20 (4 million accounts affected)
  • Ge.tt (1.8 million accounts affected)
  • PetFlow (1 million accounts affected)
  • Coinmama (450.000 accounts)

Best regards

OLLI

Edited by OLLI_S
  • Like 1

Share this post


Link to post
Share on other sites

Hello,

today I read that the Chinese e-commerce company Gearbest had a "Huge Data Breach".
Hackers could (and still can) access different parts of Gearbest’s database.

See article Report – Gearbest Hack: Hundreds of Thousands Affected Daily by Huge Data Breach
https://www.vpnmentor.com/blog/gearbest-hack/

The email addresses and the passwords were stored unencrypted!

So this is really a mess!

Best regards

OLLI

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...