Edmodo Data Breach Analysis

Preface

Edmodo, an educational technology company offering a communication, collaboration and coaching platform to K-12 schools and teachers, suffered a data breach in the spring of 2017. The stolen data includes usernames, email addresses and passwords. After the company found out about the data breach, they contracted third party cybersecurity experts to conduct a full analysis to determine how the hackers managed to access their system.

What data is at risk?

The breached Edmodo data includes IDs, usernames, email addresses and hashed and salted passwords. There are exactly 77,039,863 ID, username and email records - the whole database has 77,248,517 records meaning that we can make an assumption that the hash and salt fields have 208,654 records more.

Usernames

In this data breach, there are 504 records with empty username fields - these records do not have email addresses associated with them either, but they do have passwords. It could be that these accounts had those attributes, but were chosen to be deleted from the system, and instead of deleting entire rows, Edmodo simply chose to delete other data attributes leaving only IDs and passwords in the database. Perhaps it could have been a measure to log in the user by using Simple Sign On (SSO) - by using such a property a user could login with his user ID and a password to gain access to any of several related systems: as Edmodo is a cloud-based learning management application, that would make sense.

Here's the letters that usernames begin with:

We can see that:

• The most prevalent letter - a - has been used 4,922,727 times - that's approximately 6.37% of Edmodo users;
• The letter a is followed by the letter m - the letter m has been used by approximately 5.77% of Edmodo users;
• The letter m is followed by the letter s - the letter s has been used by approxmately 5.11% of Edmodo users;
• The letter s is followed by the letter j - the letter j has been used by approximately 5.13% of Edmodo users;
• The letter j is followed by the letter c - the letter c has been used by approximately 4.03% of Edmodo users.

The five most prevalent letters combined consume a little above a quarter - approximately 26.41% of Edmodo's user base.

Judging from the analysis, we can see that the least prevalent letter is q - the letter q has been used by approximately 0.25% of Edmodo users.

Here's the numbers that usernames begin with:

We can see that the most prevalent number is 1 and the least prevalent number is 8 - the numbers have been used by 1.87% and 0.29% of Edmodo users respectively.

Email addresses

Here's the top 100 most frequently used email domains by Edmodo users:

If we would sum up the users with associated countries, we would see that:

• There were 32,545,063 users who registered from domains that were associated either with commercial things or the United States - they would consume approximately 42.39% of the entire user base;
• There were 416,907 users who registered from domains that were associated with Indonesia - they would consume approximately 0.54% of the entire user base;
• There were 369,898 users who registered from domains that were associated with Spain - they would consume approximately 0.48% of the entire user base;
• There were 230,599 users who registered from domains that were associated with the United Kingdom - they would consume approximately 0.30% of the entire user base;
• There were 215,663 users who registered from domains that were associated with Italy - they would consume approximately 0.28% of the entire user base;
• There were 105,784 users who registered from domains that were associated with Argentina - they would consume approximately 0.14% of the entire user base;
• There were 78,545 users who registered from domains that were associated with Canada - they would consume approximately 0.10% of the entire user base;
• There were 37,660 users who users who registered from domains that were associated with Australia - they would consume approximately 0.05% of the entire user base;
• There were 24,202 users who users who registered from domains that were associated with Brazil - they would consume approximately 0.03% of the entire user base;
• There were 22,346 users who users who registered from domains that were associated with Thailand - they would also consume approximately 0.03% of the entire user base.

We can take a look at email addresses that begin with letters:

We can see that:

• The most prevalent letter is a followed by the letter m;
• The letter m is followed by the letter s;
• The letter s is followed by the letter j;
• The letter j is followed by the letter c;
• The least prevalent letter is q.

We can also take a look at email addresses that begin with numbers:

Here the most prevalent number is 1, the least prevalent number is 8.

Summary

The Edmodo data breach, while pretty worrying at first, was not that bad after all - even though more than 77 million people were put at risk, Edmodo had hashed their passwords with a very strong BCrypt password hashing algorithm and they also salted their customers' passwords making bulk password cracking not worth the time for potential attackers.