Are your staff emails hacked? Check here

Powered by SC Magazine
 

So easy, even your mum could use it.

A Sydney security researcher has developed a web portal that allows administrators to check if work email accounts have been compromised.

The portal, (https://shouldichangemypassword.com) allows users to search through databases of stolen email addresses collated by researcher Daniel Grzelak.

It could be a gem for companies concerned that staff have reused work passwords and email addresses on other web sites which have subsequently been compromised in the recent spate of hacking incidents.

Such concerns are not without warrant: Dozens of government agencies were included in LulzSec's recent publication of 62,000 emails and passwords, and the group's followers boasted that they had reused the details to gain access to user accounts on other web sites including PayPal and Amazon.

Grzelak had integrated some 800,000 email addresses into the portal database, that were lifted from 13 databases exposed by LulzSec.

He told SC Magazine Australia that he intends to expand the list and would consider building a batch processing facility that would allow businesses to check an entire staff email directory.

"There is an information asymmetry in the security industry, where attackers know everything and users know nothing," Grzelak, a former penetration tester of seven years said. "This is about changing the balance."

Without it, administrators would have to download stolen databases and search them manually for affected email addresses.

The PHP portal requires an email address to search the list. If it returns a hit, it displays details about the email address was last compromised and how many times it has been included in stolen databases.

Grzelak has removed passwords and other sensitive information from the portal database that are often coupled with stolen emails addresses.

All of the emails are publicly available on sites like The Pirate Bay, which reduces the benefit from hacking Grzelak's portal.

The portal, orginally developed for Grzelak's mum and friends, could have the batch processing facility ready within days, he said.

He doesn't agree with LulzSec's hacking spree, but recognised the paradoxical argument that the group is highlighting secuity flaws that would otherwise remain unnoticed.

"If they weren't publishing this stuff, others may be silently using the details for financial gain, and I would not be able to build the database."

Check your email address here.

Copyright © SC Magazine, Australia


Are your staff emails hacked? Check here
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 437

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 210

Vote