My Life on Flash Sales on the Dark Web?!
summary
A developer found their Chrome-saved passwords sold on the Dark Web as a $100 bundle covering 450 domains, exposed for 11 days before discovery by a partner’s threat intel. The response included rotating Azure AD and service accounts, moving off Chrome to a zero-knowledge password manager, wiping the infected PC after confirming a GPU-benchmark EXE had dropped a trojan coin‑miner/ransomware, and about 12 hours spent rotating passwords. Key takeaways are to avoid browser password stores, use MFA apps or hardware keys, and prefer WebAuthn/FIDO.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:06Alarm message received
- 2:34Initial check and reaction
- 4:19Immediate actions and password rotation
- 6:24Password recommendations
- 7:08Hashing function and security
- 12:30Password cracking tools
- 15:41Risks of non-unique passwords
- 17:08Complexity vs entropy
- 23:06Recommended password managers
- 26:32Multifactor authentication
- 29:02Social engineering and human errors
- 31:31FIDO and passwordless auth
- 37:08WebAuthn demo
- 38:34Leak origin and malware analysis
- 42:05Essential security steps
- 43:53Avoid browser password managers
- 44:15Conclusion
related talks
49mInside the Information Stealer Ecosystem: From Compromise...
40mNavigating the Shadows: A Comprehensive Exploration of Popular and Malicious Tools on the Dark Web
40mHow the Cookie Crumbles: What OSINT Tells Us About Dark Web Cookie Sales
57mSomething Something Security
34mBreaching the Perimeter via Cloud Synchronized Browser Settings
17mKey 2016 Cybersecurity Trends
32mData Heist: How Stolen Information Becomes a Hot Commodity
18mEffective password management