Find out How Your leaked Data Travels through the Dark Web

The Bitglass research team created a “complete digital identity for an employee of a fictitious retail bank, a functional web portal for the bank, and a Google Drive account, complete with seemingly real corporate and personal data. Among the files in the Google Drive were documents containing real credit card numbers, work-product, and more. The team then leaked the employee’s “phished” Google Apps credentials to the Dark Web. What the hackers didn’t know was that each file in the Google Drive was embedded with a watermark and all activities, from logins to downloads, were being tracked by Bitglass, deployed in monitor-only mode.”

And here’s what they found:

  • Over 1,400 hackers viewed the leaked credentials.
  • One in 10 hackers attempted to use the leaked creds at the bank web portal.
  • There were five attempted bank logins within the first 24 hours.
  • Visitors to the bank site came from over 30 countries across six continents.
  • 68 percent of the attempts on either the Google Drive account or bank account were from Tor-anonymized IP addresses.
  • 12 percent of those hacking the Google Drive account attempted to download files with sensitive content.
  • There were three attempted Google Drive logins within the first 24 hours.
  • 94 percent uncovered and attempted to log into other accounts.

That last bullet is particularly interesting. Like many technology users, the fictitious bank employee used the same password across many other web services, like social media. So, once the hackers determined the password worked at the bank login, they then attempted it on other web sites to see if it worked there. In some cases, it did.

As Bitglass points out, there are some things we can do to prevent this kind of thing from occurring to our data.

  1. Avoid using the same password for different services. Implement contextual, multifactor authentication. That is, set up your services to send you a text message with a login code every time you log in. Or use a token. Something other than just a password.
  2. Set up alerts for unusual activity. Google gives you this option and I’ve used it myself. It’s great.
  3. In the event your data is leaked, and you’ve been made aware of it, put a fraud alert on your credit accounts immediately. Don’t wait.

In the end, it’s all about controlling information. Whether it’s bad guys looking to do bad things, or commercial industry attempting to sell you something, or the government trying to protect you, it’s all about information.