Password Crackers For Hire

Earlier this week we wrote about how attackers are selling bogus security software suites to not only rip unsuspecting Web surfers off, but also infect their systems with malware. Now, an IBM researcher says many of those Webmail online password "recovery" services may actually be hackers for hire.Imagine you want to snoop on your wife, girlfriend, employees, or whomever: a good place to start would be reading their e-mail. Consider the case of the Philadelphia KYW-TV news personality was busted for allegedly reading his co-worker's e-mail.

Turns out, if his co-worker had of caught on that her e-mail was being snooped on, and changed her password, any number of services on the Web are available to crack someone's Webmail account. This is from Tim Wilson's story today on Dark Reading, quoting Gunter Ollmann, chief security strategist at IBM's Internet Security Systems unit:

"For between 0 to 0, a hacker can find a full suite of Webmail cracking tools on the 'Net, complete with the ability to do brute-force "guessing" of simple passwords and enhanced tools for penetrating the CAPTCHA authentication methods used on Webmail services, he notes.

And now those capabilities are being turned into hack-for-hire services, Ollmann says. Such services have been around for about two years, he notes, but today's CAPTCHA-breaking methods have become so effective that for about 0, the service provider can not only promise to give you the password to a specific Webmail account, but it can also promise to give you subsequent passwords if the legitimate owner should change passwords.

"These services can essentially give you a 'lifetime service contract' that you will always know the password to that account," Ollmann said.

"

So whether it's bogus software suites, scare ware, or hacking someone else's Webmail account as-a-service - the bad guys are changing tactics. When I first started writing about security, more than a decade ago, a hacker either had to guess someone's password, or install keystroke loggers or a sniffer on their network or system. Today, it's just outsourced.

Here's Ollmann's original blog, it's an eye opener.