• Germany's news in English

How to hack 16 million email accounts

Alex Evans · 24 Jan 2014, 08:11

Published: 24 Jan 2014 08:11 GMT+01:00

Facebook Twitter Google+ reddit

The digital theft of millions of usernames and passwords was revealed by the Federal Office for Online Security (BSI) on Tuesday, but details of the cyber-attack remain unclear.

In an interview with The Local, Professor Prechelt, who specializes in network security, viruses and hacking, described how the heist was probably pulled off.

How did it happen?

Prechelt confirmed reports that the attack came from a "botnet" – a massive network of computers infected with malware (malicious software) by the culprits, which can be used to force access to those computers.

The hackers most likely installed "keylogger" software on the infected systems, he explained – illegal programs which record everything the user types, to be trawled for personal information.

Combining this with other software, which detects when certain data entry fields are active in internet browsers, makes it easy for the programmes to identify passwords and usernames automatically, which can then be sold en masse.

"If you do this with a lot of computers at the same time, you can collect a lot of data," Prechelt said. "But collecting these 16 million probably took a few months."

Who is behind this?

Theoretically, the heist could be one-man job, according to Prechelt. "One highly competent person could definitely do this,” he said. “There is a black market where you can buy the tech to build up a botnet like this, and after that you don't need any special skill to run it."

But a team of hackers is more likely.

"Once you've got the data you've then got to actually do something with it,” he said. “Making money off it afterwards is another skill set entirely, so it's quite unlikely it was someone working alone."

And selling this information is a big business. In the right hands, it can be used to steal everything from credit card numbers to getting online banking access, either to make purchases and empty accounts, or to sell on to other criminals for the same purpose.

The Frankfurter Allgemeine Zeitung reported on Wednesday that this "flourishing" black market is so flush with stolen data, credit card numbers are sold for as little as $1. Email addresses, meanwhile, can be sold in bulk to spammers for as little as $1 for 1,000 addresses.

Where did this attack come from?

Like most cyber-crime, it is difficult to say where the culprits are based, but the fact that around half the hacked accounts were German-based addresses tells us much about the hackers' intentions, according to Prechelt.

"It seems they had Germany in their sights," he said. "Whatever they hope to do [with the data] after the attack, it has been planned with German circumstances in mind – that's why they targeted German users."

While the hackers could be based anywhere in the world, the fact they targeted Germany could suggest they were planning to sell the data to criminals active in the country.

"If you have a customer willing to buy the data, who's planning activities in Germany, then it's best to focus efforts on collecting that data in particular,” he said.

And another benefit of limiting the target area is stealth. Prechelt said: "Narrowing the range of the attack means the chances of being discovered are a bit lower. If you try something on a global scale, there are more people who could get on your trail."

How can you protect yourself?

"The biggest chance of picking up a virus is hanging round the darker nooks and crannies of the web, on dubious websites and downloading from questionable sources," Prechelt said.

But avoiding dodgy websites isn't necessarily a solution as a site could still be dangerous even if it is reputable. Any website that isn't totally secure can be "manipulated by hackers to infect computers with the sort of programs used for the data theft reported on Tuesday, Prechelt said.

"These seemingly reputable websites end up infecting thousands of people with malware," he added.

The first priority is good anti-virus software, he insisted, as the longer it takes for a virus to be detected and neutralized, the higher the chance it could do damage to your system - and spread to others.

But decent protective software should find malicious programs and quarantine them before they have a chance to collect any sensitive information.

Anyone worried their email address may have been compromised by the attack can use a website set up by the BSI on Tuesday to check if their details were among those stolen.

READ MORE: Comms giant pushes anti-spy network

For more news from Germany, join us on Facebook and Twitter.

Alex Evans (news@thelocal.de)

Facebook Twitter Google+ reddit

Your comments about this article

Today's headlines
Outrage over ruling on 'brutal' gang rape of teen girl
The now convicted suspects, sitting in court in Hamburg. Photo: DPA.

A 14-year-old girl was gang-raped and left partially clothed and unconscious in freezing temperatures. Now prosecutors are appealing the sentences for the young men found guilty, most of whom will not set foot in jail.

Dozens of Turkish diplomats apply for asylum in Germany
Demonstrators holding a giant Turkish flag protest against the attempted coup in Istanbul in July. Photo: DPA.

Since the failed putsch attempt in Turkey in July, Germany has received 35 asylum applications from people with Turkish diplomatic passports, the Interior Ministry confirmed on Wednesday.

Hertha Berlin fan club criticised for 'anti-gay banner'
Hertha BSC beat FC Cologne 2-1. Photo: DPA

A 50 metre fan banner apparently mocking the idea of gay adoption has overshadowed Hertha BSC's win in the Bundesliga.

Germany stalls Chinese takeover of tech firm Aixtron
Aixtron headquarters in Herzogenrath. Photo: DPA

The German government on Monday said it had withdrawn approval for a Chinese firm to acquire Aixtron, a supplier to the semiconductor industry, amid growing unease over Chinese investment in German companies.

Politicians call for tough sentences for 'killer clowns'
File photo: DPA.

Now that the so-called 'killer clown' craze has spread from the US to Germany, elected officials are drawing a hard line against such "pranks", with some threatening offenders with jail time of up to a year.

Nearly one in ten Germans are severely disabled
Photo: DPA

New figures reveal that 9.3 percent of the German population last year were considered severely disabled.

The Local List
Germany's top 10 most surreal sites to visit
The Upside-Down House, in Mecklenburg–Western Pomerania. Photo: Olaf Meister / Wikimedia Commons

From upside-down houses on Baltic islands to a fairy-tale castle near the Austrian border, Germany is a treasure trove of the extraordinary.

Bavarian critics back Merkel for Chancellor again
Photo: DPA

The Christian Social Union (CSU) have long delayed backing Angela Merkel as their candidate for Chancellor in next year's general election. But now key leaders are supporting her publicly.

Four taken to hospital after hotel toilet bursts into flames
File photo: DPA.

Four guests at a Nuremberg hotel were taken to hospital due to smoke inhalation early Monday morning after a toilet there burst into flames.

Creepy clown scare spreads to Germany
Two of the clowns were apparently equipped with chainsaws. Photo: Pedro Pardo / AFP file picture

Police said Friday five incidents involving so-called scary clowns had occurred in two north German towns, including one assailant who hit a man with a baseball bat, amid fears that Halloween could spark a rash of similar attacks.

10 things you never knew about socialist East Germany
Sponsored Article
Last chance to vote absentee in the US elections
How Germans fell in love with America's favourite squash
How I ditched London for Berlin and became a published author
12 clever German idioms that'll make you sound like a pro
23 fascinating facts you never knew about Berlin
9 unmissable events to check out in Germany this October
10 things you never knew about German reunification
10 things you're sure to notice after an Oktoberfest visit
Germany's 10 most Instagram-able places
15 pics that prove Germany is absolutely enchanting in autumn
10 German films you have to watch before you die
6 things about Munich that’ll stay with you forever
10 pieces of German slang you'll never learn in class
Ouch! Naked swimmer hospitalized after angler hooks his penis
Six reasons why Berlin is now known as 'the failed city'
15 tell-tale signs you’ll never quite master German
7 American habits that make Germans very, very uncomfortable
Story of a fugitive cow who outwitted police for weeks before capture
Eleven famous Germans with surnames that'll make your sides split
The best ways to get a visa as an American in Germany
jobs available
Toytown Germany
Germany's English-speaking crowd