Edmodo Data Breach Analysis
Tags: security, webdev, news, datascience
Published: 2022-11-12 07:00:00

<!-- wp:heading -->
<h2>Preface</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Edmodo, an educational technology company offering a communication, collaboration and coaching platform to K-12 schools and teachers, suffered a data breach in the spring of 2017. The stolen data includes usernames, email addresses and passwords. After the company found out about the data breach, they contracted third party cybersecurity experts to conduct a full analysis to determine how the hackers managed to access their system.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>What data is at risk?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The breached Edmodo data includes IDs, usernames, email addresses and hashed and salted passwords. There are exactly <strong>77,039,863</strong> ID, username and email records - the whole database has <strong>77,248,517</strong> records meaning that we can make an assumption that the hash and salt fields have <strong>208,654 </strong>records more.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Usernames</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>In this data breach, there are 504 records with empty username fields - these records do not have email addresses associated with them either, but they do have passwords. It could be that these accounts had those attributes, but were chosen to be deleted from the system, and instead of deleting entire rows, Edmodo simply chose to delete other data attributes leaving only IDs and passwords in the database. Perhaps it could have been a measure to log in the user by using <strong>Simple Sign On (SSO)</strong> - by using such a property a user could login with his user ID and a password to gain access to any of several related systems: as Edmodo is a cloud-based learning management application, that would make sense.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here's the letters that usernames begin with:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Letter that a username begins with</th><th>User count</th></tr><tr><td>1</td><td>a</td><td>4,922,727</td></tr><tr><td>2</td><td>b</td><td>2,096,025</td></tr><tr><td>3</td><td>c</td><td>3,110,247</td></tr><tr><td>4</td><td>d</td><td>2,527,984</td></tr><tr><td>5</td><td>e</td><td>1,865,287</td></tr><tr><td>6</td><td>f</td><td>1,185,165</td></tr><tr><td>7</td><td>g</td><td>1,424,801</td></tr><tr><td>8</td><td>h</td><td>1,345,874</td></tr><tr><td>9</td><td>i</td><td>1,056,430</td></tr><tr><td>10</td><td>j</td><td>3,964,428</td></tr><tr><td>11</td><td>k</td><td>2,457,254</td></tr><tr><td>12</td><td>l</td><td>2,365,989</td></tr><tr><td>13</td><td>m</td><td>4,455,507</td></tr><tr><td>14</td><td>n</td><td>1,694,399</td></tr><tr><td>15</td><td>o</td><td>494,123</td></tr><tr><td>16</td><td>p</td><td>1,475,123</td></tr><tr><td>17</td><td>q</td><td>191,028</td></tr><tr><td>18</td><td>r</td><td>2,140,257</td></tr><tr><td>19</td><td>s</td><td>3,949,875</td></tr><tr><td>20</td><td>t</td><td>1,945,199</td></tr><tr><td>21</td><td>u</td><td>253,171</td></tr><tr><td>22</td><td>v</td><td>845,521</td></tr><tr><td>23</td><td>w</td><td>760,843</td></tr><tr><td>24</td><td>x</td><td>276,044</td></tr><tr><td>25</td><td>y</td><td>729,145</td></tr><tr><td>26</td><td>z</td><td>510,445</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can see that:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>The most prevalent letter - <strong>a</strong> - has been used <strong>4,922,727</strong> times - that's approximately <strong>6.37%</strong> of Edmodo users;</li><li>The letter <strong>a</strong> is followed by the letter <strong>m</strong> - the letter <strong>m</strong> has been used by approximately <strong>5.77%</strong> of Edmodo users;</li><li>The letter <strong>m</strong> is followed by the letter <strong>s</strong> - the letter <strong>s</strong> has been used by approxmately <strong>5.11%</strong> of Edmodo users;</li><li>The letter <strong>s</strong> is followed by the letter <strong>j</strong> - the letter <strong>j</strong> has been used by approximately <strong>5.13%</strong> of Edmodo users;</li><li>The letter <strong>j</strong> is followed by the letter <strong>c</strong> - the letter <strong>c</strong> has been used by approximately <strong>4.03%</strong> of Edmodo users.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The five most prevalent letters combined consume a little above a quarter - approximately <strong>26.41%</strong> of Edmodo's user base.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Judging from the analysis, we can see that the least prevalent letter is <strong>q</strong> - the letter <strong>q</strong> has been used by approximately <strong>0.25%</strong> of Edmodo users.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here's the numbers that usernames begin with:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>Number that a username begins with</th><th>User count</th></tr><tr><td>0</td><td>517,760</td></tr><tr><td>1</td><td>1,442,167</td></tr><tr><td>2</td><td>835,546</td></tr><tr><td>3</td><td>439,890</td></tr><tr><td>4</td><td>347,110</td></tr><tr><td>5</td><td>303,248</td></tr><tr><td>6</td><td>229,003</td></tr><tr><td>7</td><td>240,434</td></tr><tr><td>8</td><td>220,547</td></tr><tr><td>9</td><td>278,843</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can see that the most prevalent number is <strong>1</strong> and the least prevalent number is <strong>8</strong> - the numbers have been used by <strong>1.87%</strong> and <strong>0.29%</strong> of Edmodo users respectively.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Email addresses</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Here's the top 100 most frequently used email domains by Edmodo users:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Email Domain</th><th>User count</th><th>Purpose / Country</th></tr><tr><td>1</td><td></td><td>33,044,473</td><td>None</td></tr><tr><td>2</td><td>gmail.com</td><td>15,806,574</td><td>Commercial / United States</td></tr><tr><td>3</td><td>hotmail.com</td><td>7,549,528</td><td>Commercial / United States</td></tr><tr><td>4</td><td>yahoo.com</td><td>6,087,578</td><td>Commercial / United States</td></tr><tr><td>5</td><td>aol.com</td><td>455,198</td><td>Commercial / United States</td></tr><tr><td>6</td><td>yahoo.co.id</td><td>416,907</td><td>Indonesia</td></tr><tr><td>7</td><td>outlook.com</td><td>398,350</td><td>Commercial / United States</td></tr><tr><td>8</td><td>live.com</td><td>354,372</td><td>Commercial / United States</td></tr><tr><td>9</td><td>ymail.com</td><td>347,700</td><td>Commercial / United States</td></tr><tr><td>10</td><td>icloud.com</td><td>283,111</td><td>Commercial / United States</td></tr><tr><td>11</td><td>hotmail.es</td><td>217,006</td><td>Spain</td></tr><tr><td>12</td><td>comcast.net</td><td>159,545</td><td>Network Infrastructure</td></tr><tr><td>13</td><td>hotmail.co.uk</td><td>154,569</td><td>United Kingdom</td></tr><tr><td>14</td><td>rocketmail.com</td><td>128,987</td><td>Commercial / United States</td></tr><tr><td>15</td><td>students.ocps.net</td><td>111,647</td><td>Network Infrastructure</td></tr><tr><td>16</td><td>charterschoolsusa.com</td><td>105,010</td><td>Commercial / United States</td></tr><tr><td>17</td><td>education.nsw.gov.au</td><td>101,821</td><td>Government</td></tr><tr><td>18</td><td>qq.com</td><td>94,113</td><td>Commercial / United States</td></tr><tr><td>19</td><td>ccpsnet.net</td><td>86,486</td><td>Network Infrastructure</td></tr><tr><td>20</td><td>yahoo.es</td><td>82,201</td><td>Spain</td></tr><tr><td>21</td><td>me.com</td><td>75,712</td><td>Commercial / United States</td></tr><tr><td>22</td><td>msn.com</td><td>75,643</td><td>Commercial / United States</td></tr><tr><td>23</td><td>live.com.mx</td><td>74,481</td><td>Mexico</td></tr><tr><td>24</td><td>outlook.es</td><td>70,691</td><td>Spain</td></tr><tr><td>25</td><td>att.net</td><td>69,316</td><td>Network Infrastructure</td></tr><tr><td>26</td><td>libero.it</td><td>68,869</td><td>Italy</td></tr><tr><td>27</td><td>sbcglobal.net</td><td>66,498</td><td>Network Infrastructure</td></tr><tr><td>28</td><td>mail.ru</td><td>63,589</td><td>Russia</td></tr><tr><td>29</td><td>HOTMAIL.COM</td><td>62,252</td><td>Commercial / United States</td></tr><tr><td>30</td><td>verizon.net</td><td>59,871</td><td>Network Infrastructure</td></tr><tr><td>31</td><td>hotmail.it</td><td>58,556</td><td>Italy</td></tr><tr><td>32</td><td>naver.com</td><td>58,078</td><td>Commercial / United States</td></tr><tr><td>33</td><td>GMAIL.COM</td><td>57,753</td><td>Commercial / United States</td></tr><tr><td>34</td><td>edmodo.com</td><td>54,696</td><td>Commercial / United States</td></tr><tr><td>35</td><td>email.com</td><td>50,426</td><td>Commercial / United States</td></tr><tr><td>36</td><td>det.nsw.edu.au</td><td>49,201</td><td>Education</td></tr><tr><td>37</td><td>bellsouth.net</td><td>48,169</td><td>Network Infrastructure</td></tr><tr><td>38</td><td>cps.edu</td><td>45,591</td><td>Education</td></tr><tr><td>39</td><td>Gmail.com</td><td>45,216</td><td>Commercial / United States</td></tr><tr><td>40</td><td>yahoo.co.uk</td><td>44,138</td><td>United Kingdom</td></tr><tr><td>41</td><td>facebook.com</td><td>43,879</td><td>Commercial / United States</td></tr><tr><td>42</td><td>gamil.com</td><td>43,853</td><td>Commercial / United States</td></tr><tr><td>43</td><td>yahoo.com.mx</td><td>43,161</td><td>Mexico</td></tr><tr><td>44</td><td>yahoo.com.ar</td><td>42,007</td><td>Argentina</td></tr><tr><td>45</td><td>hotmail.com.ar</td><td>41,620</td><td>Argentina</td></tr><tr><td>46</td><td>cox.net</td><td>41,348</td><td>Network Infrastructure</td></tr><tr><td>47</td><td>hotmail.fr</td><td>41,230</td><td>France</td></tr><tr><td>48</td><td>mail.com</td><td>39,805</td><td>Commercial / United States</td></tr><tr><td>49</td><td>yahoo.com.ph</td><td>37,512</td><td>The Philippines</td></tr><tr><td>50</td><td>k12.sd.us</td><td>36,330</td><td>Commercial / United States</td></tr><tr><td>51</td><td>aim.com</td><td>35,887</td><td>Commercial / United States</td></tr><tr><td>52</td><td>live.cvesd.org</td><td>32,078</td><td>Organization</td></tr><tr><td>53</td><td>live.co.uk</td><td>31,892</td><td>United Kingdom</td></tr><tr><td>54</td><td>yahoo.ca</td><td>31,633</td><td>Canada</td></tr><tr><td>55</td><td>student.gccisd.net</td><td>30,538</td><td>Network Infrastructure</td></tr><tr><td>56</td><td>YAHOO.COM</td><td>29,713</td><td>Commercial / United States</td></tr><tr><td>57</td><td>gmai.com</td><td>29,407</td><td>Commercial / United States</td></tr><tr><td>58</td><td>hotmail.ca</td><td>25,543</td><td>Canada</td></tr><tr><td>59</td><td>pgcps.org</td><td>25,477</td><td>Organization</td></tr><tr><td>60</td><td>cvusd.us</td><td>25,378</td><td>Commercial / United States</td></tr><tr><td>61</td><td>bigpond.com</td><td>24,727</td><td>Commercial / United States</td></tr><tr><td>62</td><td>yahoo.com.br</td><td>24,202</td><td>Brazil</td></tr><tr><td>63</td><td>hotmail.co.th</td><td>22,346</td><td>Thailand</td></tr><tr><td>64</td><td>live.com.ar</td><td>22,157</td><td>Argentina</td></tr><tr><td>65</td><td>yahoo.it</td><td>21,547</td><td>Italy</td></tr><tr><td>66</td><td>live.ca</td><td>21,369</td><td>Canada</td></tr><tr><td>67</td><td>live.it</td><td>20,323</td><td>Italy</td></tr><tr><td>68</td><td>alice.it</td><td>20,319</td><td>Italy</td></tr><tr><td>69</td><td>yahoo.com.sg</td><td>20,162</td><td>Singapore</td></tr><tr><td>70</td><td>yahoo.com.au</td><td>19,954</td><td>Australia</td></tr><tr><td>71</td><td>yahoo.fr</td><td>19,088</td><td>France</td></tr><tr><td>72</td><td>richland2.org</td><td>19,001</td><td>Organization</td></tr><tr><td>73</td><td>gmail.co</td><td>18,945</td><td>None, probably misspelled</td></tr><tr><td>74</td><td>charter.net</td><td>18,842</td><td>Network Infrastructure</td></tr><tr><td>75</td><td>s.dcsdk12.org</td><td>18,648</td><td>Organization</td></tr><tr><td>76</td><td>btinternet.com</td><td>18,368</td><td>Commercial / United States</td></tr><tr><td>77</td><td>163.com</td><td>17,876</td><td>Commercial / United States</td></tr><tr><td>78</td><td>googlemail.com</td><td>17,738</td><td>Commercial / United States</td></tr><tr><td>79</td><td>windowslive.com</td><td>17,725</td><td>Commercial / United States</td></tr><tr><td>80</td><td>live.com.au</td><td>17,706</td><td>Australia</td></tr><tr><td>81</td><td>sinadep.org.mx</td><td>17,229</td><td>Mexico</td></tr><tr><td>82</td><td>hotmai.com</td><td>16,772</td><td>Commercial / United States</td></tr><tr><td>83</td><td>edumail.vic.gov.au</td><td>16,616</td><td>Government</td></tr><tr><td>84</td><td>interact.ccsd.net</td><td>15,439</td><td>Network Infrastructure</td></tr><tr><td>85</td><td>Hotmail.com</td><td>15,261</td><td>Commercial / United States</td></tr><tr><td>86</td><td>yahoo.com.tw</td><td>15,007</td><td>Taiwan</td></tr><tr><td>87</td><td>yahoo.com.hk</td><td>14,548</td><td>Hong Kong</td></tr><tr><td>88</td><td>Yahoo.com</td><td>14,247</td><td>Commercial / United States</td></tr><tr><td>89</td><td>gmil.com</td><td>14,160</td><td>Commercial / United States</td></tr><tr><td>90</td><td>wcpss.net</td><td>13,899</td><td>Network Infrastructure</td></tr><tr><td>91</td><td>optonline.net</td><td>13,891</td><td>Network Infrastructure</td></tr><tr><td>92</td><td>dadeschools.net</td><td>13,809</td><td>Network Infrastructure</td></tr><tr><td>93</td><td>virgilio.it</td><td>13,650</td><td>Italy</td></tr><tr><td>94</td><td>rogers.com</td><td>13,640</td><td>Commercial / United States</td></tr><tr><td>95</td><td>gmail.con</td><td>13,425</td><td>None, probably misspelled</td></tr><tr><td>96</td><td>bluevalleyk12.net</td><td>13,273</td><td>Network Infrastructure</td></tr><tr><td>97</td><td>class.lps.org</td><td>13,004</td><td>Organization</td></tr><tr><td>98</td><td>gaggle.net</td><td>12,778</td><td>Network Infrastructure</td></tr><tr><td>99</td><td>ocps.net</td><td>12,722</td><td>Network Infrastructure</td></tr><tr><td>100</td><td>tiscali.it</td><td>12,399</td><td>Italy</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>If we would sum up the users with associated countries, we would see that:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>There were <strong>32,545,063</strong> users who registered from domains that were associated either with <strong>commercial things or the United States</strong> - they would consume approximately <strong>42.39%</strong> of the entire user base;</li><li>There were <strong>416,907</strong> users who registered from domains that were associated with <strong>Indonesia</strong> - they would consume approximately <strong>0.54%</strong> of the entire user base;</li><li>There were <strong>369,898</strong> users who registered from domains that were associated with <strong>Spain</strong> - they would consume approximately <strong>0.48%</strong> of the entire user base;</li><li>There were <strong>230,599</strong> users who registered from domains that were associated with the <strong>United Kingdom</strong> - they would consume approximately <strong>0.30%</strong> of the entire user base;</li><li>There were <strong>215,663</strong> users who registered from domains that were associated with <strong>Italy</strong> - they would consume approximately <strong>0.28%</strong> of the entire user base;</li><li>There were <strong>105,784</strong> users who registered from domains that were associated with <strong>Argentina</strong> - they would consume approximately <strong>0.14%</strong> of the entire user base;</li><li>There were <strong>78,545</strong> users who registered from domains that were associated with <strong>Canada</strong> - they would consume approximately <strong>0.10%</strong> of the entire user base;</li><li>There were <strong>37,660</strong> users who users who registered from domains that were associated with <strong>Australia</strong> - they would consume approximately <strong>0.05%</strong> of the entire user base;</li><li>There were <strong>24,202</strong> users who users who registered from domains that were associated with <strong>Brazil</strong> - they would consume approximately <strong>0.03%</strong> of the entire user base;</li><li>There were <strong>22,346</strong> users who users who registered from domains that were associated with <strong>Thailand</strong> - they would also consume approximately <strong>0.03%</strong> of the entire user base.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>We can take a look at email addresses that begin with letters:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>The letter that an email address begins with</th><th>User count</th></tr><tr><td>1</td><td>a</td><td>4,177,039</td></tr><tr><td>2</td><td>b</td><td>1,617,909</td></tr><tr><td>3</td><td>c</td><td>2,440,735</td></tr><tr><td>4</td><td>d</td><td>2,158,671</td></tr><tr><td>5</td><td>e</td><td>1,508,873</td></tr><tr><td>6</td><td>f</td><td>1,022,878</td></tr><tr><td>7</td><td>g</td><td>1,190,749</td></tr><tr><td>8</td><td>h</td><td>1,004,437</td></tr><tr><td>9</td><td>i</td><td>813,638</td></tr><tr><td>10</td><td>j</td><td>3,034,518</td></tr><tr><td>11</td><td>k</td><td>1,807,369</td></tr><tr><td>12</td><td>l</td><td>2,053,627</td></tr><tr><td>13</td><td>m</td><td>3,716,961</td></tr><tr><td>14</td><td>n</td><td>1,448,014</td></tr><tr><td>15</td><td>o</td><td>407,113</td></tr><tr><td>16</td><td>p</td><td>1,278,578</td></tr><tr><td>17</td><td>q</td><td>90,056</td></tr><tr><td>18</td><td>r</td><td>1,898,765</td></tr><tr><td>19</td><td>s</td><td>3,051,807</td></tr><tr><td>20</td><td>t</td><td>1,544,602</td></tr><tr><td>21</td><td>u</td><td>137,093</td></tr><tr><td>22</td><td>v</td><td>675,295</td></tr><tr><td>23</td><td>w</td><td>580,737</td></tr><tr><td>24</td><td>x</td><td>130,296</td></tr><tr><td>25</td><td>y</td><td>585,655</td></tr><tr><td>26</td><td>z</td><td>335,051</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can see that:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>The most prevalent letter is <strong>a</strong> followed by the letter <strong>m</strong>;</li><li>The letter <strong>m</strong> is followed by the letter <strong>s</strong>;</li><li>The letter <strong>s</strong> is followed by the letter <strong>j</strong>;</li><li>The letter <strong>j</strong> is followed by the letter <strong>c</strong>;</li><li>The least prevalent letter is <strong>q</strong>.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>We can also take a look at email addresses that begin with numbers:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>The number that an email address begins with</th><th>User count</th></tr><tr><td>0</td><td>90,119</td></tr><tr><td>1</td><td>612,044</td></tr><tr><td>2</td><td>256,276</td></tr><tr><td>3</td><td>129,773</td></tr><tr><td>4</td><td>181,148</td></tr><tr><td>5</td><td>51,321</td></tr><tr><td>6</td><td>46,337</td></tr><tr><td>7</td><td>49,532</td></tr><tr><td>8</td><td>43,364</td></tr><tr><td>9</td><td>51,916</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Here the most prevalent number is <strong>1</strong>, the least prevalent number is <strong>8</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Summary</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The Edmodo data breach, while pretty worrying at first, was not that bad after all - even though more than 77 million people were put at risk, Edmodo had hashed their passwords with a <strong>very</strong> strong BCrypt password hashing algorithm and they also salted their customers' passwords making bulk password cracking not worth the time for potential attackers.</p>
<!-- /wp:paragraph -->