Russian hackers break into 420,000 websites

According to a report published on tuesday, Russian hackers have stolen a total of 1.2 billion user names and passwords in a series of Internet frauds affecting 420,000 websites.

The identities of websites that were broken into weren't identified by The New York Times, which cited nondisclosure agreements that required Hold Security to keep some information confidential.

The reported break-ins are the latest incidents to raise doubts about the security measures that both big and small companies use to protect people's information online. Security experts believe those hackers will continue breaking into computer networks unless companies become more secure.

A security analyst at the research firm Gartner told The Times. "Companies that rely on usernames and passwords have to develop a sense of urgency about changing this," Avivah Litan"

The information security officer of Hold Security, told the newspaper that most of the sites hit by the Russian hackers are still vulnerable to further break-ins. Besides filching 1.2 billion online passwords, the hackers have also been able to get 500 million email addresses that could help them engineer other crimes.

According to the New York Times, little of the information stolen in the wave of attacks appears not to have been sold to other online crooks. Instead, the information is being used to send marketing pitches, schemes and other junk messages on social networks like Twitter.

Here's what you can do to keep your online accounts safe and your passwords strong:

• Make your password long. The recommended minimum is eight characters, but 14 is better and 25 is even better than that.

• Use combinations of letters and numbers, upper and lower case and symbols such as the exclamation mark. "PaSsWoRd!43" is far better than "password43."

• Avoid words that are in dictionaries, even if you add numbers and symbols. There are programs that can crack passwords by going through databases of known words. One trick is to add numbers in the middle of a word – as in "pas123swor456d" instead of "password123456."

• Substitute characters. For instance, use the number zero instead of the letter O, or replace the S with a dollar sign.

• Avoid easy-to-guess words, even if they aren't in the dictionary. You shouldn't use your name, company name or hometown. Avoid pets' and relatives' names and things that can be looked up, such as your birthday or ZIP code.

• Never reuse passwords on other accounts.