LeakedSource provided sensitive personal information namely logins, passwords, birth date, IP address and more, obtained from data breaches to anyone willing to pay for it – has been closed indefinitely after raids by law enforcement.
For a small fee, it also allowed consumers to check if their details were in the hacked databases. It played both sides and authorities felt its actions were more black than white.
Its website is gone and all that remains is a notice posted on a hacker’s forum. "Yeah, you heard it here first. Sorry for all you kids who don't have all your own Databases. Leakedsource is down forever and won't be coming back. Owner raided early this morning. Wasn't arrested, but all SSD's got taken, and Leakedsource servers got subpoena'd and placed under federal investigation. If somehow he recovers from this and launches LS again, then I'll be wrong. But I am not wrong. Also, this is not a troll thread.”
iTWire recently ran an article about credential stuffing titled “More than three billion credential spills in 2016 – 2% success rate in exploits” and has sought comment from Shuman Ghosemajumder, CTO of Shape Security.
{loadposition ray}
LeakedSource was cracking passwords and making them available to anyone that would pay their subscription fee – good or bad. This directly added to the market of stolen credentials available for use in credential stuffing attacks.
Removing 3.1 billion passwords that were so readily available makes it less convenient for cybercriminals, but only makes a small dent when you realize that there are countless other sources for the same data. Credential stuffing is now the single largest source of account takeover and automated fraud on large online services.
We have reached a tipping point for credential theft and awareness of where the real danger is. Whenever a data breach occurs that results in a credential spill, there is a lot of focus on the service (e.g., Yahoo!) that suffered the breach. But the longer-term issue is that those stolen passwords persistent forever in markets like LeakedSource and are used in perpetuity to attack every other service.
This is why the National Institute of Standards and Technology (NIST) recommended in their Digital Identity Guidelines published in December that online services should check their users’ credentials against known spills, and why companies like Facebook have been doing so for some time.