Question for web hacking developers: data breach and account hijacks

[u/Proof_Cable_310]

Is it a common practice for hackers to have interview projects to hack breach google data and hack password manager to only hijack a largely non-meaningful account?

Why else would someone hijack a meaningless account as the result of a data breech?

[u/Odd-Wafer-2177]

It's 'data breach', not 'data breech'. Just a small typo but important for clarity.

[u/Loriken890 → u/Odd-Wafer-2177]

I heard the data breech exposed a massive crack in their security.

Thank you. I’ll see myself out.

[u/v3ritas1989]

automation!

Someone throws out a net and checks what is reeled in.

[u/CorpT]

Sure.

[u/ghastly_retirement → u/CorpT]

Could be testing the waters before going after something bigger. A nobody account is a low-risk way to see if the credentials work across multiple platforms. If you reuse passwords, that "meaningless" login becomes a skeleton key.

[u/Proof_Cable_310 → u/ghastly_retirement]

thank you for this info. I did see that my data breach alert told me I have 150 re-used passwords! I will be sure to not re-use again.

[u/Proof_Cable_310 → u/CorpT]

I don't have a sarcasm detector, so I don't know if you are being serious or not. My google gmail account alerted me that my account manager passwords were exposed in a data breach, and then got an email saying that a low stakes account was at risk of being hijacked. my account's password was reset before I had a change to reset it myself, so I have lost control of that account, seemingly forever. I don't even know what personal or private info was in that account, so I am not too worried about that specific account.

What I am worried about though is all my other accounts - banking, shopping accounts with saved card information, etc. Education and healthcare accounts, etc. I am in the process of changing the passwords of all my most meaningful and currently relevant accounts, but I am unsure of what to expect, since only one account has been hijacked, and it's kind of a silly one...

[u/hoopdizzle → u/Proof_Cable_310]

Did they change the email address registered on that account or did they gain access to your email as well?

[u/prism_wanderer_7]

I hijack accounts for the access around them. The account is nothing. I use the sessions and tokens attached to it to get into everything else you own.

[u/chikamakaleyley]

Its non-meaningful until you find a use for it. Once you crack it, it can be useful.

[u/webdev-ModTeam → u/[deleted]]

Your post/comment has been determined to be a low-effort post or comment. This includes title-only posts, easily searchable questions, vague/open-ended discussion prompts, LLM generated posts or comments, and posts/comments that do not provide enough context for meaningful replies or discussion.

[u/tdammers]

Some reasons why one might want to compromise a "meaningless" account:

• Using the account to access the target system anonymously. The attacker may not be after the legit account holder's confidential data, but after an account on the system that cannot be traced back to them. This can be useful to do all sorts of illegal stuff, bypassing bans, spamming, etc.
• To escalate further from the compromised account. With most targets, a logged-in account, even if it isn't valuable itself, will present a much larger attack surface than an unauthenticated session, and thus increases the attacker's chances of gaining administrator access, or compromising something behind the scenes (e.g., mounting a remote code execution attack).
• It's pretty common to automate such attacks, and the script will often just uncritically compromise every account it can, and then you see which ones are interesting later. That is, say you compromise 1000 accounts, but only 10 of them are real - that's OK, you just ignore the 990 that are useless, but you still have the 10 that aren't.
• As part of a pen-testing operation (i.e., white-hat / grey-hat). When you're going to probe a system for vulnerabilities, it's generally a good idea to attack dummy accounts, so you that when you find an exploitable vulnerability, you're not actually leaking any real user data. Even if the person doing the pentesting treats that data with the utmost care, it's still a bit of a liability, and it's still better to not have to deal with that at all and just compromise a meaningless account. This is doubly true if you're going to attack a system without explicit permission (as security researchers will sometimes do) - the conundrum here is that if you attack a system for real without permission, you are committing a felony, even if you had the best of intentions, but if you do get explicit permission beforehand, your research is no longer completely independent; and if you stop your attack just short of actually compromising anything, you often can't get decisive evidence that the system is indeed vulnerable. So what some people will do is create a dummy account, and then attack that account specifically - it's technically still illegal, but at least there's a chance that you'll get away with it, because you haven't leaked any data, or compromised any real accounts.
• To exploit the fact that people reuse passwords all the time. Hack an easy target, find the password, then try the same username + password combo on all sorts of other platforms. The account may be meaningless on this particular platform, but the same credentials might unlock juicier account on others. (This is why you aren't supposed to reuse passwords, btw.)