7k7k.com Data Breach Analysis

Foreword

It is speculated that a Chinese gaming website 7k7k suffered a data breach in December 2011. The hack is thought to be part of a series of attacks directed at Chinese IT portals, gaming and social networking websites. The data leak has surfaced after China’s largest programmers’ website CSDN (China Software Developer Network) suffered a data breach.

What data is at risk?

The data that the 7k7k data breach has put at risk include email addresses and passwords. As 7k7k is based in China, both email addresses and passwords often include some sort of Chinese character combination.

Email addresses

There is a very wide range of email addresses used in this data breach – 7k7k clearly had users from multiple different countries. Judging from the analysis, their users mostly came from China, but the service also had users from United States, Japan, Hong Kong and Taiwan. Having multiple countries, we can also measure the distance between them, then see how far apart their customers are (all calculations are done in kilometers):

• The distance between China and United States is approximately 11,144km;
• The distance between China and Japan is approximately 2,099km;
• The distance between China and Hong Kong is approximately 1,973km;
• The distance between China and Taiwan is approximately 1,724km;
• The distance between United States and Japan is approximately 10,903km;
• The distance between United States and Hong Kong is approximately 13,113km;
• The distance between United States and Taiwan is approximately 12,648km;
• The distance between Japan and Hong Kong is approximately 2,887km;
• The distance between Japan and Taiwan is approximately 2,102km;
• The distance between Hong Kong and Taiwan is approximately 814km.

The average distance between customers is 5,940.7km.

The used email domains also allow us to understand which countries users originated from:

#	Email Domain	Quantity	Country
1	163.com	1,869,224	China
2	qq.com	1,551,070	China
3	tianya.cn	1,157,638	China
4	126.com	659,552	China
5	sina.com	455,188	China
6	yahoo.com.cn	306,840	China
7	hotmail.com	279,484	United States
8	sohu.com	195,233	China
9	tom.com	124,495	China
10	21cn.com	84,261	China
11	yahoo.cn	78,788	China
12	gmail.com	77,557	United States
13	yahoo.com	53,239	United States
14	sina.com.cn	43,055	China
15	eyou.com	37,493	China
16	vip.qq.com	34,812	China
17	yeah.net	28,427	China
18	163.net	25,736	China
19	YAHOO.COM.TW	21,655	Taiwan
20	msn.com	17,928	United States
21	hainan.net	17,415	China
22		16,645	Unknown
23	263.net	16,286	China
24	live.cn	11,360	China
25	yahoo.com.hk	10,377	Hong Kong
26	139.com	9,812	China
27	vip.sina.com	9,595	China
28	123.com	9,491	Unknown
29	citiz.net	7,879	Unknown
30	chinaren.com	7,469	China
31	mail.china.com	7,009	China
32	etang.com	5,810	China
33	avl.com.cn	5,150	China
34	sian.com	5,000	China
35	foxmail.com	4,534	United States
36	163.COM.CN	3,891	China
37	qq.com.cn	3,610	China
38	263.com	3,554	China
39	sogou.com	3,209	China
40	tianya.com	3,130	China
41	vip.163.com	2,956	China
42	pp.com	2,874	Unknown
43	qq.cn	2,539	China
44	163.CN	2,352	China
45	china.com	2,320	China
46	63.com	2,229	Unknown
47	56.com	2,152	China
48	136.com	1,997	Unknown
49	mop.com	1,950	China
50	168.com	1,939	China

From the analysis of the top 50 email domains we can see that:

• The list has 7,286,209 users in total – that means that the top 50 email domains consume 98.13680114722213% of the entire 7k7k user base;
• The majority of users – 6,780,320 people – who used 7k7k registered from China: Chinese users consume 91.32306190428152% of the entire 7k7k user base;
• 432,742 users registered from the United States – that’s 5.828533823563282% of the entire 7k7k user base;
• 41,115 users registered from countries which couldn’t be identified – they consume 0.5537714577180036% of the entire 7k7k user base;
• 21,655 users registered from Taiwan – that’s 0.2916677834581873% of the entire 7k7k user base;
• 10,377 users registered from Hong Kong – they consume 0.13976617820113643% of the entire 7k7k user base.

Having analyzed the top 50 email domains, it is noticeable that 1.86319885277787% of the entire user base is not included in this list – that’s approximately 138,333 people.

Passwords

Having a glimpse at the most prevalent passwords used by people who used the 7k7k service, we can see that not all of the passwords used are ordinary – there’s a lot of at what might seem at first gibberish passwords among the usual ones. Here’s the top 50 passwords used:

#	Password	Quantity
1	123456	550,346
2	111111	153,044
3	0	109,405
4	123456789	84,680
5	123123	68,999
6	111222tianya	64,822
7	5201314	40,292
8	12345678	26,652
9	123321	25,119
10	123	21,041
11	666666	18,964
12	wangyut2	17,016
13	888888	16,770
14	7758521	15,754
15	1234567	15,396
16	11111111	13,871
17	1314520	13,801
18	111222	13,197
19	woaini	12,856
20	654321	12,079
21	112233	11,344
22	a123456	10,237
23	88888888	9,317
24	123654	9,247
25	100200	9,142
26	520520	8,540
27	1234567890	8,344
28	123456a	8,252
29	121212	8,149
30	999999	8,080
31	123698745	7,837
32	AAAAAA	7,684
33	110110	7,632
34	7758258	7,580
35	123123123	7,317
36	5211314	7,147
37	asdasd	6,744
38	1111111	6,669
39	147258	6,432
40	zxcvbnm	5,770
41	iloveyou	5,765
42	222222	5,487
43	159357	5,418
44	1234	5,380
45	12345	5,251
46	1	5,247
47	147258369	5,169
48	31415926	4,721
49	521521	4,628
50	333333	4,578

Among those passwords starting from number 60 we would have another list – this time, with unusual passwords included (unusual passwords are bold):

#	Password	Quantity
60	EtnXtxSa65	3,728
61	137900	3,718
62	123000	3,652
63	789456	3,642
64	qwerty	3,642
65	1qaz2wsx	3,635
66	774517397	3,632
67	qazwsx	3,518
68	456852	3,463
69	456123	3,454
70	201314	3,354
71	111	3,281
72	778899	3,190
73	sgdHhfC4x2	3,126
74	abc123	3,076
75	789456123	2,896
76	NBvBB32fa9	2,892
77	ApjSqpM844	2,876
78	zzzzzz	2,869
79	kb9zc8uxtx	2,862
80	password	2,740
81	666888	2,701
82	584520	2,699
83	uifKjhF522	2,674
84	JxsGx2Yd87	2,662
85	753951	2,622
86	1q2w3e4r	2,607
87	ndaCebx2wx	2,592
88	123789	2,537
89	sxUaIehAtp	2,528
90	qwe123	2,481
91	qweqwe	2,468
92	2m66xF2AJT	2,468
93	vjfLkiG522	2,436
94	102030	2,422
95	cazzo1001	2,414
96	qwqwqw	2,407
97	windows	2,395
98	asd123	2,372
99	6Cxd2X986x	2,372
100	1111111111	2,370
101	qfcFgdA3zx	2,366
102	110120	2,365
103	11111	2,328
104	d54q7xjmhx	2,328
105	zxcvbn	2,328
106	PCwAC33gb9	2,324
107	1230123	2,323
108	101010	2,321
109	1234560	2,319
110	qq123456	2,319
111	314159	2,293
112	i97wb6sxq7	2,290
113	147896325	2,289
114	b33m6yghef	2,282
115	456789	2,277
116	xm55xExBZS	2,274
117	lssy123	2,274
118	168168	2,259
119	mcaBdaw2vx	2,258
120	CrkUrrP954	2,250
121	d54p7xjkha	2,248
122	3uc9xN53xH	2,242
123	jianfei000	2,220
124	777777	2,210
125	qwertyuiop	2,209
126	4wdaxQ642F	2,194
127	theIigD4x2	2,190
128	asdfasdf	2,188
129	7Fxf3Jba8t	2,188
130	11223344	2,158
131	110119	2,157
132	yniQnmK733	2,154
133	987654	2,153
134	131421	2,118
135	7758520	2,114
136	zWN6Vbdvpj	2,108
137	741852	2,078
138	asdfgh	2,072
139	8x2h4Fddap	2,052
140	tangkay	2,040
141	LztEz2xe98	2,038
142	789789	2,025
143	e65r82kni2	2,010
144	g86ua5qsn5	2,008
145	ymhPnmJ733	1,984
146	147852	1,982
147	6Exe3Za97v	1,980
148	131420	1,979
149		1,978
150	xj453CxDXQ	1,978
151	VHBtH55jec	1,976
152	4yfb2S753C	1,960
153	123654789	1,952
154	FRI3Q9arjg	1,940
155	709394	1,936
156	ZLEnK77nge	1,932
157	5bt2jtzTKE	1,918
158	2r97xJ3xEY	1,912
159	963852	1,893
160	c44n6vijgc	1,892
161	a12345	1,886
162	211314	1,867
163	a33k5Afgdh	1,852
164	xfx3ayFJRK	1,844
165	12301230	1,841
166	zouyong	1,838
167	xgx39zGISL	1,836
168	majiajun8888	1,832
169	741852963	1,830
170	diank123	1,812
171	SEyxE44hca	1,796
172	asdfghjkl	1,781
173	8xxg4Gcc9q	1,768
174	12341234	1,765
175	woaiwojia	1,762
176	f5GhyjqHAv	1,752
177	caonima	1,749
178	DsmWssR955	1,748
179	7007	1,747
180	123abc	1,744
181	19960309	1,744
182	ja8yc8uxsx	1,734
183	808080	1,733
184	5845201314	1,726
185	JMFxL78nhe	1,716
186	UGAuG55jdb	1,716
187	5zgb2T764B	1,712
188	951753	1,709
189	555666	1,706
190	XJCrI66kfd	1,694
191	xk55xDxCYR	1,694
192	1q2w3e	1,694
193	999999999	1,694
194	xi345BJFVP	1,676
195	10203	1,667
196	20080808	1,659
197	b43m6xhiee	1,654
198	3344520	1,644
199	woaini1314	1,634
200	28zxrpvNFA	1,630
201	a123456789	1,623
202	456456	1,619
203	abcd1234	1,611
204	f76t93nqk3	1,610
205	HvqJvxVb76	1,610
206	12344321	1,606
207	123456789a	1,601
208	1123581321	1,600
209	369369	1,597
210	579395571	1,596
211	g76t94prm4	1,596
212	qebEfcz3yx	1,596
213	25257758	1,583
214	321654	1,577
215	2n66xG2zIU	1,574
216	wkgMkjH623	1,558
217	112358	1,552
218	HwrIwxWc76	1,552
219	q123456	1,549
220	woshishui	1,546
221	DSK4R9bskh	1,542
222	28zxrpuNFA	1,540
223	111111111	1,537
224	6cs2huAULF	1,534
225	3sa8xK4xDZ	1,528
226	123456abc	1,518
227	GvqJvxVb76	1,516
228	2q87xI3vFX	1,512
229	HPH2N89qif	1,506
230	AVM6Ubdunj	1,500
231	qazwsxedc	1,489
232	4xeaxR653E	1,484
233	20082008	1,484
234	m2YdEgkDws	1,480
235	445566	1,479
236	520530	1,478
237	xh246AIGUN	1,474
238	564335	1,473
239	uIS9Zdgysn	1,470
240	shmily	1,469
241	246810	1,469
242	7895123	1,468
243	RDxyD43hca	1,468
244	922i4Deebm	1,466
245	963852741	1,455
246	922i4Ceebk	1,452
247	3.1415926	1,452
248	tianya	1,448
249	444444	1,439
250	a123123	1,436
251	xiaoxiao	1,434
252	135246	1,433
253	ja8yc7txs8	1,432
254	ja8xb7txr8	1,422
255	DsmVssQ955	1,420
256	BqkTqqN844	1,418
257	i4IfBinFyu	1,416
258	rui100	1,410
259	wang123	1,409
260	1234qwer	1,409
261	JMFxL78phe	1,402
262	ww111111	1,397
263	e65r82mnj2	1,392
264	7Fxf3Jaa7u	1,390
265	584521	1,388
266	5Bhc2V875z	1,386
267	zniRpnL744	1,386
268	2r97xJ3xEX	1,382
269	e65r82mpj2	1,376
270	x7BktntLEz	1,372
271	xYQ7Xcewqk	1,370
272	476730751	1,370
273	f75s83nqk3	1,370
274	IxrHx2Xc87	1,366
275	h87va5rtp6	1,362
276	336699	1,361
277	4xebxR653D	1,358
278	i98xb7sxr7	1,356
279	KytFy2xd98	1,354
280	8x2h4Eddan	1,354
281	qweasd	1,346
282	xkhNmkI633	1,344
283	3tb9xM42xI	1,342
284	8en3dwDXPI	1,338
285	abc123456	1,324
286	5zgc2T764B	1,324
287	922i4Ddebm	1,322
288	654123	1,315
289	FupYuxTa66	1,310
290	134679	1,306
291	xk45xDxCYR	1,302
292	g76u94prm4	1,300
293	2p76xG2yHV	1,296
294	3651118xun	1,294
295	KytFy2xd97	1,294
296	LzuDz2xe98	1,294
297	z123456	1,287
298	e5FhxkqIBw	1,286
299	123465	1,284
300	251314	1,283
301	g86u94psn5	1,280
302	87654321	1,278
303	b43n6whifd	1,274
304	721521	1,266
305	4yfb2S753D	1,266
306	QDxzC43gba	1,264
307	911911	1,261
308	888999	1,253
309	258369	1,253
310	5Ahc2V875z	1,252
311	c44n6vijfc	1,242
312	k3ZeDhmExs	1,238
313	135790	1,238
314	a7CkuntLDy	1,236
315	mc9Ad9w2ux	1,232
316	xh248zHHTM	1,232
317	xfk3bxEZQJ	1,224
318	WIBsH56kec	1,224
319	a11111	1,223
320	TFzwF44idb	1,220
321	wZQ8Xcfxqm	1,220
322	wwwwww	1,218
323	4vdaxP542G	1,218
324	pdbDfby2xx	1,218
325	811009	1,215
326	3ub9xM53xI	1,212
327	22222222	1,209
328	yangyang	1,208
329	asdasdasd	1,206
330	518518	1,206
331	zxczxc	1,203
332	buzhidao	1,203
333	TGzvF55idb	1,202
334	n2XcFgjCvr	1,194
335	124578	1,191
336	aaaaaaaa	1,186
337	wZR8Ycfxrm	1,182
338	p2WcFfjCvr	1,176
339	h4HgAipGzu	1,172
340	FQI3P8arjg	1,168
341	118720	1,166
342	232323	1,164
343	YKDpJ67mgd	1,162
344	HPG2N89qif	1,160
345	2p76xH2xHV	1,156
346	abcdefg	1,155
347	BqkTrqN844	1,154
348	theIigE4x2	1,154
349	w123456	1,153
350	guo150	1,152
351	woainima	1,151
352	111000	1,148
353	a22j5Bffci	1,142
354	a111111	1,140
355	x8AxspuMEz	1,134
356	majiajun	1,134
357	qweasdzxc	1,134
358	4weaxQ642E	1,134
359	258258	1,127
360	922j5Cefcj	1,126
361	wkgMmjH623	1,122
362	GvqZvxUb76	1,122
363	ncaBeax2vx	1,122
364	q1w2e3r4	1,121
365	wocaonima	1,121
366	vJS9Zdgyrn	1,120
367	f76t94prm4	1,110
368	12121212	1,109
369	3tb8xL42BJ	1,108
370	xh247AHGUM	1,108
371	xi345BIFVN	1,106
372	yXP7Wbewpk	1,106
373	loveyou	1,104
374	pebDfcz3yx	1,100
375	qxVbGfiBuq	1,098
376	qecEgdA3zx	1,096
377	7654321	1,096
378	c54p7uikgb	1,094
379	zniQpnK733	1,094
380	147852369	1,094
381	666999	1,092
382	ffffff	1,092
383	JysGy2Yd87	1,090
384	8x2h4Fccap	1,090
385	123457	1,090
386	BUL5Tacumi	1,088
387	c6DjvmsKCx	1,088
388	pebEfcz3yx	1,088
389	5845211314	1,088
390	120120	1,084
391	121314	1,084
392	tHTaJehzsp	1,084
393	119119	1,083
394	142536	1,083
395	p2XcFgjCvr	1,078
396	3344521	1,077
397	4wdaxP642F	1,076
398	5203344	1,076
399	b43m6xhife	1,074
400	123456q	1,073
401	584131421	1,072
402	39xxpqwQHB	1,070
403	7cr2guBVMG	1,070
404	k3ZeChmExt	1,070
405	111222333	1,067
406	2n76xG2yIU	1,066
407	weiwei	1,065
408	520123	1,062
409	2q87xI3wGW	1,058
410	FupYuxTb66	1,054
411	7Exe3Zaa7u	1,052
412	a22j5Bffcj	1,052
413	5Ahc2U874A	1,048
414	qwe123456	1,048
415	CrmVssQ955	1,042
416	12369874	1,042
417	123456aa	1,040
418	852456	1,037
419	1.23457E+11	1,035
420	29yxqqvPGB	1,032
421	zxc123	1,028
422	yXP7Wcewpk	1,026
423	pebDfcy3xx	1,026
424	INGxM78phf	1,026
425	rxVbHfiBuq	1,022
426	h97wa6ruq6	1,020
427	9em3dwDYPI	1,020
428	g4HgzjpHzv	1,018
429	vjgLkiG522	1,018
430	UHAuG55jec	1,016
431	h123698745	1,016
432	rgdGheB4xx	1,016
433	FtpYuxTa65	1,014
434	131313	1,012
435	CTK4Sabtmi	1,010
436	IwrHw2Xc87	1,006
437	j3JeChmExt	1,006
438	2q87xI3wFW	1,006
439	3ta8xL42CJ	1,006
440	147369	1,006
441	qwer1234	1,005
442	b6DjvmsKCx	1,002
443	REyxE44hca	1,000
444	theJigE4x2	996
445	xmhPnkJ633	996
446	1q2w3e4r5t	993
447	24081986	990
448	wanshuai198202	990
449	521314	985
450	CrmVsrQ955	984
451	uieJjhE5x2	984
452	1230	982
453	YKDpK67mgd	978
454	d6EiwkrJBx	978
455	BUL5Tactmi	978
456	forever	974
457	e65s83mpj2	972
458	7788521	972
459	556677	971
460	IwrIwxWc87	970
461	123456123	970
462	4avxmsxRID	968
463	521125	968
464	QCwzC33gb9	966
465	820919	961
466	123456987	960
467	aa123456	957
468	i4JfBinFyt	948
469	h87va5qtp6	942
470	fuckyou	941
471	19870111	940
472	nicholas	939
473	asd123456	936
474	1234566	935
475	kb9Ad9vxux	932
476	rfcGgeB3xx	932
477	vjfKjiG522	932
478	1234abcd	928
479	ja8yc8txsx	928
480	1234554321	927
481	x7BxtntMEz	924
482	worinima	923
483	xmhNmkI633	922
484	3vc9xN53xH	922
485	369258	920
486	5Ahc2U875A	920
487	4awxnrxRIC	920
488	b33k5ygheg	920
489	123456qq	919
490	258456	919
491	c44p7uijgb	918
492	QDxzD43gba	916
493	6Exe3Ya97v	916
494	DSJ4R9bskh	914
495	1357924680	913
496	NBvCA32fa9	910
497	520025	909
498	7Gxf3Ibb8s	908
499	110	907
500	922i4Deebk	902

Obviously, the exact count of “unusual” passwords is up for debate, but if we take the top 500 used passwords and count passwords that were in use on the service and are classified as unusual (such passwords are visible in bold), we would have 229 instances of unusual password usage and 329,847 total unusual passwords in use.

If we count from the top 500 used passwords, 229 instances of unusual password usage would consume 45.8% of the top 500 passwords and if we count unusual passwords against all of the passwords that have been used, we could see that unusual passwords consume 4.442657278703887% of the entire user base – that means that unusual passwords have been used by approximately 329,847 people.

It is likely that these passwords were typed on keyboards that had a different layout than the “qwerty” keyboards do – in China, Pinyin is a very prevalent keyboard layout so it is likely that this layout was used. The majority of the unusual passwords consist of 10 characters and contain uppercase, lowercase letters and numbers without any special symbols – that means that it is very unlikely for them to have been generated by a password manager as the vast majority of password managers include special symbols in generated passwords unless specified otherwise.

In this case, unusual passwords are usually of 33 bits of entropy which means that they could be cracked relatively quickly – a supercomputer could crack such passwords in approximately 5 seconds and a PC with a GPU could crack such passwords in approximately 10 hours.

Summary

As the 7k7k data leak surfaced after a part of a continuous cyber attack after China’s largest programmers’ website CSDN (China Software Developer Network) suffered a data breach, this data leak might show that not all hackers choose their targets. Dubbed “the most serious Chinese user data leak in history”, this data breach should teach the affected people a lesson – users should enhance the protection of their personal account information by using password managers that allow them to choose complicated passwords and change them regularly.