A latest Dark Web Audit Report by The Digital Shadows Photon Research Team has unveiled the real extent of the stolen login credentials that are found circulating on the dark web amongst the cybercriminals. The research team has spent 18 long months auditing the darknet marketplaces and the criminal forums across the dark web. It has found out that the number of stolen usernames and the passwords in the circulation by cybercriminals has shot up by 300% since the year 2018. Considering the present situation, there are over 15 billion of the stolen credentials available to the cybercriminals from 100,000 data breaches. Of the stated number, around 5 billion happen to be unique, having no duplicity.

Stolen Account Logins’ Treasure Chest

The Dark Web Audit Report named “From Exposure to Takeover” deliberately warns that there is a “Treasure Trove of The Account Details” circulating throughout the darknet markets. The stolen credentials consist of account logins and password pairs for social media accounts, music streaming services and online banking. To put this simply, it is equivalent to two sets of the account logins for each man, woman and child on the earth.

However, there are some duplicate data across the available credentials while the unique 5 billion login details had been at least once advertised on the darknet markets and forums. The researchers have found out that many of these account details have been given away free of cost.

The estimated average price for the commercially traded login details was $15.43, accounting to £12.32. The more valuable login credentials like the active bank account logins have commanded a premium. It has been estimated that some 25% of all the advertisements are for the stolen account credentials. The average price for the online banking and other related financial services accounts was $70.91, accounting to £56.65 each. The research team has also spotted some banking account credentials to be sold for as high as $500 accounting to £399 and depends mainly on the available funds and the freshness of the credential steal.

Another most valuable logins available of the dark web websites were antivirus and security solutions bearing an average price of $21.67 accounting to £17.30. What is surprising is that everything else has commanded average costs of “significantly” below $10 accounting to £7.99 and includes virtual private networks (VPNs), adult content sites, social media accounts, file sharing services along with music and video streaming.

The prices of these stolen accounts leapt when it came to the domain administrator accounts supporting access to the internal business networks. The Dark Web Audit Report has revealed that these were usually sold via the auction owing to their value to the criminal hackers having an average of £3,139 (£2,505) and, in some cases, even reaching a price of $120,000 (£95,732). All of these steep prices are regarded as good value as these privileged accounts can read and as well as modify the sensitive data while providing open access to the critical assets.

Breached Credentials: The Commoditization

It is to be noted that all of the prices, as mentioned above, fall in the context of solely the ones that were being traded commercially. The truth behind these is that it has never been that easy for the cybercriminals to take over the accounts nor cheaper. The 300% hike in availability over two years, as evidenced by the commoditization has pushed the pricing downwards to a point where it becomes easier to locate the freely available stolen credentials.

Not to be overwhelmed, it has to be said that when the tools needed to obtain them like the brute force password crackers and the account checkers, can be bought for as low as (£3.19) on the dark web. The breached credential databases are quite often shared with the criminal community online in the bid that others can unscramble the hashed passwords into the plaintext ones. Then the plaintext credentials are often shared free.

There are several ways in which the accounts can be best protected from leaching into the criminal industry. Apart from maintaining the password hygiene in respect to the uniqueness, utilizing some form of 2FA or two-factor authentication is mandatory. In this case, the usage of the hardware-based authentication keys must be taken into account first. They are neither stupidly expensive nor extensively complicated to setup and configure. Consider using Google Authenticator or Authy (absolutely free). Also, one needs to stay away from the SMS-based 2FA options unless there is no other option. Additionally, maintaining intelligence and awareness is vital. Utilizing a website like HaveIBeenPwned can fetch your information if any of your details are floating on the dark web.

Source: Forbes

Disclaimer: Darkweblink.com does not promote or endorse claims that have been made by any parties in this article. The information provided here is for the general purpose only and unintended to promote or support purchasing and/or selling of any products and services or serve as a recommendation in the involvement of doing so. Neither Darkweblink.com nor any member is responsible directly or indirectly for any loss or damage caused or alleged to be caused by or in relation with the reliance on or usage of any content, goods or services mentioned in this article.