One of the regulars at Paul’s Pub (my little Facebook group for marketers) read the post here from the other day, titled “How scared should you be?” It’s about taking a common sense view of online security, and mentioned an article from the Times which stated that Russian hackers had collected 1.2 billion username/password combinations.

The poster looked at the huge number of credentials the thieves had gathered and suggested “you’d have more chance of catching aids off a nun than anything happening to your website.”

Apparently our colorful correspondent has not yet learned to think like a creep.

First, let’s keep in mind that the guys who stole those log-in pairs have access to a botnet. That’s a large group of computers that belong to other people, which are infected with malware that lets the crooks use their systems without the owners knowing it.

Your machine might be one of them.

Even a modest network of 10,000 zombied machines gives them a lot of computing power and distributed IPs. According to the article in the Times, they managed to grab credentials from 420,000 sites, so dismissing a task as being too large seems a bit hasty.

1.2 billion log-in pairs. In that, they have 500 million email addresses. One assumes the rest are username/password combos, or a combination of all three.

Let’s look at the records that include email addresses, and think like a creep. How could we use that info?

To start with, there are probably duplicate addresses in the list. If I were the kind of person to play this game, I’d sort on those and look for duplicate addresses that used the same password at more than one site. They probably use the same password everywhere. So, that’s a good bet for checking out possible financial and shopping accounts. Paypal, Amazon, banks local to them, etc.

If the SQL dumps they got all this data from include IPs, it wouldn’t be hard to find the most likely local banks. And they probably have bots in the network that are in the same geographic areas.

No need to be tripping alarms, eh?

Next, I’d generate a list of the most commonly used passwords. With over a billion in hand, they’ve probably got an authoritative sample. To do this step, you’d really only need to start with a few million records, which a fast computer could do in a lot less time than you might think. We’re talking hours, if that. Possibly minutes.

Then you just run through the master list in batches.

I’d look for accounts that used one of the top 20 or 50 passwords (depending on how simple they are) and sort them to a separate file. People who use simple passwords are reasonably likely to use the same one at many places.

Same potential for criminal joy as above.

Note that none of this is rocket science. You don’t need to be an evil genius to do it. Just evil.

The previous scenarios are only of concern to people who use weak passwords, or re-use them at multiple sites. Now we get into the more annoying “everyone’s a target” stuff.

I’d get a list of the 500 or 1000 most commonly visited sites in the database (same simple process as above) and look through that. Might be some gems in there for an enterprising villain.

Hard to guess what, since we don’t know which sites were compromised in this attack, but the Times did say they included “household names” and “Fortune 500 companies.”

I’d also search the domains and usernames based on high-value keywords. More potential gold in them thar ills.

Come to think of it, I’d start by sorting out every record with the username “admin.” Gotta be a few thousand of those, right?

Oh, the places you’d go.

I’d also look into categorizing those top sites by interest and segmenting them into separate lists for “targeted bulk email deployment.” (read: spam.)

No need to send the stuff yourself, of course. There are plenty of spammers happy to buy that kind of tinsel.

Then there’s the potential in selling the log-ins to link spammers.  How would you feel if you went to a favorite site and discovered your account had been used to spam porn links or some other NSFW nonsense in a parenting forum?

Why yes. Yes, they would.

According to Hold Security, the firm that discovered this, the folks who assembled this access goldmine are currently only using it to send contract spam on social networks. Even if that’s all they ever plan to do with it themselves, there’s a good chance they won’t ignore the extra dosh to be made in selling it. And there are people out there who would do everything I’ve outlined here, and things I probably haven’t even heard of, without a moment’s hesitation.

There is a market for all that data. If the people who stole it decide to push the cash flow, it will end up being sold at least once. Some of it a lot more.

And, being the upright citizens you’d expect buyers of this sort of information to be, they’ll sell it on again. As often as they can get people to pay.

Feelin’ all warm and fuzzy yet?

So, why hasn’t Hold Security announced the list of sites that were hacked?

Well, for starters, that would create chaos. Chaos is usually not a helpful thing to add to a security snafu. That starts rumors and misinformation, and all manner of other Bad Stuff.

As a rule, it’s better to notify the affected companies, toward which it appears an effort is under way. They can take measures to pre-empt further breaches and misuse of the data without panicking people unduly.

Again, it’s just social network spam at this point. A nuisance, but generally not all that devastating. (There are exceptions, but that’s a story for another time.)

That being the case, I believe a quiet heads up where possible is the most responsible course of action.

Edited Sept 2, 2014, to add: This is no longer true. Some collection of creeps is currently trying to use these credential pairs to get access to hosting and/or domain registration accounts at Namecheap.

Namecheap is the only one publicly mentioning this and warning their customers. If they aren’t already hitting other hosts and/or registrars, they will be soon.

For the sites they can’t contact the owners of, I might think about sending emails warning people that their passwords had been compromised. That’s a course fraught with its own perils, though. Especially since a villainous critter who has that data could be sending their own emails and using a man in the middle attack to be sure they had the new access info. For some sites, that might be a profitable approach.

And you can be pretty sure a lot of people would accuse the person warning them of being the ones who stole the data in the first place.

They might also face significant liability if people reacted badly in ways that affected the firms from which the data was stolen. You can bet a lot of lawyers have made good coin advising on this sort of situation.

Back to you.

Bottom line is, there’s a pretty good chance one or more of your log-ins is included in that archive. If you use simple passwords or re-use them at more than one site, I’d do a couple of things, really quick. First, I’d do as complete a scan of my computer as possible, to reduce the odds that the creeps aren’t already on your system. Then I’d start changing the important passwords. Now.

Third, I would be absolutely certain none of my email addresses used the same password I used anywhere else. If thieves get the password to an email address you have linked to any important accounts, they can get into all of them.

Password reminder is not always your friend.

The point of this isn’t really to be a security tutorial, though. It’s to suggest that dismissing the risks in situations you aren’t familiar with isn’t generally a good idea. Advising others to ignore them is even less good, as plans go.

Especially if you haven’t learned to think like a creep.

There’s no question about it. The Internet has more than its share of scumbags, lowlifes, and general miscreants. And boy, do they get press.

The New York Times recently ran a story about a small Russian group that has collected the log-in credentials for 1.2 billion accounts at various sites and services online. There’s an app running around that promises to let you change the colors on your Facebook page, but really just loads malware onto your phone if you enable it. Target was hacked to the tune of 40 million customer credit cards. And Coco the WarKitteh is mapping vulnerable wifi systems in people’s homes.

We’ll get to that last one soon enough.

Some of these scares are exaggerated to attract media coverage. Others are highlighted to sell products.

For example, while I was writing this, I got an email with the subject line, “Malware Has Been Found on Your Site.”

(Ooops. Got a second copy – both spam – minutes later.)

As someone who’s seen a fair number of those about a server with domains I host for friends, I take that seriously. Turns out, it was a pitch for a piece of security software for websites.

I have no problem with pitching security software. It’s a valuable type of product, when it works. Certainly a good hedge against the damage a hack can do. I don’t object to scary subject lines, either, if they’re legit.

That one crossed over into deceptive, though. Hardly surprising for a spam, but still…

I have no doubt it got a lot of people to open the email. This is an area people are justly concerned about. And there are plenty of folks who are willing to exploit that.

Sometimes, though, the threat is less real than the fear.

The Target breach got plenty of press. Based on what I’ve read, they used “less than adequate” systems for protecting customer data. Fortunately, there are already safeguards in place to deal with that kind of problem. Gonna cost Target a bunch, but hey, when you’re that big, you need to always consider yourself a … well … a target.

Since no other personal info was involved, the damage per individual is mostly limited to $50 or less. The 1.2 billion username/password collection is much less clear.

The credentials were supposedly collected by hitting a ton of websites using a hack called SQL injection. It causes vulnerable systems to spit out the entire contents of the database being attacked. Out there in front of Dog and everybody, ripe for the picking.

The attacks appear to have been carried out by zombied machines. That is, computers used by innocent people who weren’t aware their hardware had turned criminal.

Maybe even yours.

The firm that discovered this database hasn’t revealed which sites were compromised. Seems they ran the gamut from very small systems to big companies. It’s also not clear what percentage of the passwords involved were unencrypted or easily decrypted.

The interesting question that should really concern you is, why would hackers bother with credentials for tiny mom-and-pop websites?

Two words: Password re-use.

It’s fairly common for people to use the same password for multiple log-ins. If the virtual snakes get hold of one, they’ve got them all. And believe it, it doesn’t take a lot of fancy programming to test those combos at banks, Paypal, Amazon, and other places you don’t want them getting into.

Even more of a problem… If they test the password on the email account you use for other accounts and it works, they can access anything connected to it by using the password reminder system.

At the moment, the crew that stole that batch is only known to be using them for spamming. That could change at any time. There’s a huge black market out there for that kind of data.

There is no way to guarantee you won’t be affected by something like this, but you can reduce the odds and the risk significantly. Try not to use the same email address for every account, and don’t ever use the same password for more than one site.

And use strong passwords.

This doesn’t have to be as big a problem as most people make it out to be. It can be easy to create strong passwords that are easily remembered. Consider the following sentence:

This blog is dedicated to my 1958 Chevy!

As a password, that translates into Tbidtm1958C!

12 characters, mixed case letters, numbers, and a punctuation mark. Very strong. And you could keep a file of those (or just handwritten notes), and no-one would be likely to guess the purpose.

Simple. And it works.

The phony Facebook app is no joke, either. That’s a straight out scam. Avoiding that one is largely a matter of not approving apps when you don’t know the source. Sort of like “Don’t download pirated software, since it’s often got hidden nasties buried in the code.”

But what about scares from known sources?

There was one hell of a hullabaloo recently about the permissions you need to give Facebook messenger. FB requires people on cellphones to download and use their new app in order to use FB messages from their phones, and that got a lot of people angry. The suggestion that the permissions could be used for spying made that a hotter topic than it already was.

The fact is, the permissions for that app are no different than any other app that lets you take and upload video, chat via text, or any of the other things Facebook Messenger does. They are required in order to give people the functions they want.

The scare was due in large part to one news source alleging potential government involvement.

Now, it’s not surprising a lot of folks don’t trust Facebook. Their reputation on privacy issues isn’t enviable. Yes, there are risks with anything that gives an app access to the camera, microphone, and GPS service on your phone. And obviously Facebook’s app would be the most attractive target, simply because of the number of people using it.

Still, there’s no reason to blast them for offering something that requires permissions that have to be there to do what you want.

There’s an opportunity there for an encrypted social chat app. Or you could switch to some other app, just to spread the data around. Or you could do what I do…

Don’t use Facebook from your phone.

Don’t kid yourself, kids. You aren’t going to become a social pariah if you stick to text messages and stop broadcasting everything you do to the whole world.

If that’s a problem, you need new friends.

Then there’s the ongoing concern about WordPress security. Given the number of blogs that get auto-hacked every day, it’s a valid issue.

Yes, added security is good. Yes, automated backups are good.

Here’s a simple 5-step formula that will eliminate most of the potential problems.

1. Back up your files and database regularly.

2. Keep text file backups of your posts.

3. Give your admin user a name that is unlikely to be guessed (NOT admin), and a strong password. Then never post using that account.

4. Create a separate account with Author or Contributor status, and only post using that account.

5. Install the Wordfence plugin.

Bang. Twenty minutes, tops. It ain’t bulletproof, but it’ll keep out most random roving hackers and the like. Unless you are specifically targeted by someone with skillz, it’s probably more than enough.

There’s a lot more you can do to protect a WP blog, but much of it needs to be done when the blog is being installed. These, you can do pretty much any time.

Oh yeah. If you’ve already been making public posts using your admin username, create another user and give that one admin privileges. Then demote the existing account to Editor.

And change the password.

And we come at last to Coco the Siamese WarKitteh.

Yes, that one is real. Dude put together a little gizmo with some common chips and hand-rolled code, and attached it to a family cat’s collar. As cute little Coco wandered the neighborhood, the unremarkable device collected data on wifi connections within range. Including 4 that used the easily hacked WEP protocol, and 4 more that were completely open.

Now, people could easily be suspicious of some guy sitting in a car with a wifi amplifier on the dashboard. Or even just a stranger walking around the neighborhood.

Who would suspect a stray cat of being a cyber-spy?

The potential problems from having strangers sending who-knows-what out over your connection are obvious. The real issue is the ease with which it can be done.

Attach a widget like that to a mail truck and pick it up the next day. Or spend a few more bucks making it possible to read the thing remotely. Hide it on the neighbor kid’s bike. Or just keep it in your pocket for your daily stroll.

Again, it’s easy to avoid most of this.

Make sure your wifi modem has a strong password (not the default, and not your address). If it doesn’t support at least WPA, get a new one. WPA2 is better. Your provider should have them available, or you can buy one at reasonable prices from any decent electronics store or local superstore.

Not rocket science.

These incursions aren’t limited to scary criminal strangers.

A friend of mine constantly complained about his Internet connection getting very slow at the same time every evening. It messed with his gaming, and he said some very unpleasant things about (and to) the customer service folks at his ISP.

I suggested he get a newer modem (WPA2 capable) and change his wifi password. Solved the problem. He later found out one of his neighbors was using a cheap wifi antenna to leech off his connection.

My buddy is lucky the guy wasn’t doing anything illegal on his evening surf…

So, should you be worried?

Maybe. You should certainly be careful. But the extreme levels of fear and paranoia that some people associate with the online world are not useful. Fear doesn’t stop bad things from happening.

Get good security software, and don’t let it lull you into a false sense of security. It won’t protect you from innocent mistakes like enabling a malicious app, or brilliant moves like sending money to a “Nigerian Prince.”

Do the basic things I just outlined, and you’ll eliminate, or at least minimize, a lot of the issues.

Worried about buying things online? See if your bank offers separate accounts for online use, so you can make sure you’re only at risk for what you knew you’d be spending. Most do, and the fees can be as low as $3 or $4 a month. A small price to pay for peace of mind. Or use pre-paid debit cards and only add what you need.

Don’t log in to online financial or shopping accounts by clicking on links in emails.

Simple stuff. Common sense.

The problem is, many people think they’re insulated from problems because they’re the only one in the room. They forget they’re sending data out into a world that’s rife with would-be spies.

Think of these steps as installing curtains on your digital windows.

Make no mistake, nothing is 100% protection against bad stuff happening. But, like looking both ways before crossing the street, a little attention can go a very long way.

Don’t be afraid. Be aware.