OPSEC VS Leaked Credentials: Password reuse in Large-Scale Data Leaks

Uzonyi, Dávid Gábor; Pitropakis, Nikolaos; McKeown, Sean; Politis, Ilias

Abstract

Security and authentication are ubiquitous problems that impact all modern networked systems. Password-based authentication systems are still prevalent, and information leaked via other channels may be used to attack networked systems. Researchers have previously used email addresses as an identifier in leaked data breach information to understand password reuse and behaviours, but this has its limitations. In this work, we explore the use of passwords themselves as identifiers in linking accounts together to provide an alternative view of large-scale reuse. We filter for high entropy passwords on the Compilation of Many Breaches (COMB) data set, which contains 3.2 billion email/password combinations. Using this approach, we find that passwords are reused 13 times on average, with a username reuse rate of 66.7% (compared to 40% when considering emails mergers). We identify that potentially malicious actors are engaging in large-scale email and password generation and reuse, which also appears to be prominent on social media.

Citation

Uzonyi, D. G., Pitropakis, N., McKeown, S., & Politis, I. (2023, November). OPSEC VS Leaked Credentials: Password reuse in Large-Scale Data Leaks. Presented at 2023 IEEE 28th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), Edinburgh, UK

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 2023 IEEE 28th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD)
• Start Date: Nov 6, 2023
• End Date: Nov 8, 2023
• Acceptance Date: Oct 9, 2023
• Online Publication Date: Mar 27, 2024
• Publication Date: 2023
• Deposit Date: Jul 12, 2024
• Publicly Available Date: Jan 1, 2026
• Publisher: Institute of Electrical and Electronics Engineers (IEEE)
• Peer Reviewed: Peer Reviewed
• Pages: 74-79
• Series ISSN: 2378-4873
• Book Title: 2023 IEEE 28th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD)
• ISBN: 9798350303506
• DOI: https://doi.org/10.1109/camad59638.2023.10478420
• Keywords: password reuse, user credentials, OPSEC, data leak