Identity Theft News

Hotmail passwords likely hacked, not phished, security researcher says

Tuesday, October 13, 2009

Microsoft said a phishing scam was the likely culprit behind last week's exposure of 30,000 email passwords from Windows Live Hotmail, Gmail and other webmail accounts. But a security researcher says the passwords were likely pilfered using data-stealing malware.

Mary Landesman, a senior security researcher at ScanSafe who has closely analyzed the list of email account passwords published by hackers on a public website last week, said the strength of most of the passwords indicates more sophisticated users than those typically duped by phishing scams.

Landesman wrote on the ScanSafe STAT blog that several characteristics of the list point to data-stealing Trojans, which can record keystrokes of PC users, not phishing scams.

An analysis by Microsoft of passwords phished from MySpace users found that 4 percent to 5 percent of the passwords were tip-offs that users realized they were being phished, with passwords like "fake" and "urhacking," according to Landesman.

But the recent cache of email passwords did not include any of this type, Landesman said.

"Certainly no one but the original thief can say for sure and thus the question of origin of the stolen data will likely never be fully answered," she said in the blog. "But as of now, data theft still seems a very likely cause."