Police make arrest over capture of online passwords

Investigations continuing into mailbox break-ins

print this

Police have arrested a young Finnish man on suspicion of involvement in the theft of nearly 80,000 Internet passwords, which came to light last weekend.
      The man is suspected of having broken into a number of online gaming and social networking sites and lifting the user registers containing log in names, password hashes, and e-mail addresses. He got in behind the defences of these sites by exploiting known weaknesses in software security.
     
Last Saturday, the 79,000 uncracked password hashes - and some easily readable passwords - surfaced on a server located in the United States and directed towards Finnish users.
      The case passed almost immediately to the National Bureau of Investigation, Finland's central criminal police. A spokesman said on Thursday that the police were still examining the motives for the crime and whether the man had worked alone or in collaboration with other Finnish youths.
      Around a dozen sites are believed to have been hit.
     
Police are also looking into the knock-on effects of the initial leakage of the passwords and email addresses, namely intrusions into victims' email mailboxes. In a number of cases this has happened: someone has got hold of the details of a person's mailbox and has been able to break in and send mail in the other person's name.
      Police have yet to determine whether this entire incident is an example of youth crime and mischief-making or part of something more sinister in the form of organised online crime carried out for economic gain.
      The police are being assisted by CERT, the national Computer Emergency Response Team, part of the Communications Regulatory Authority Ficora.
     
One aspect of the fallout from the leak has been to warn people of the need to change their passwords regularly - and also to put more effort into their choice of character-string when making a password: although most of the stolen passwords were in cryptic form, the simpler the password, the easier it is to crack.
      Many people are foolish enough to use just one password -often a simple extension of their name - for all or most of their online dealings.


Previously in HS International Edition:
  Leaked list of passwords already put to nefarious use (16.10.2007)
  Police suspect Finnish connection as 80,000 online passwords are compromised (15.10.2007)

Links:
  Cert.fi (Finnish national Computer Emergency Response Team)

Helsingin Sanomat