Attacks/Breaches
12/22/2010
09:40 AM
50%
50%

Schwartz On Security: Don't Get Hacked For the Holidays

The Gawker data breach highlights how few companies employ passwords for security, and how many Web site users treat them as little more than a nuisance.

But what's also fascinating, he said, is that when it comes to poor password selection, "the problem has changed very little over the past 20 years."

In fact, a 1990 study of Unix password selection found quite similar results to Imperva’s study. Of course, the equation since then has changed, as Shulman noted. Get your Gawker password hacked, and if it's the same as your Gmail, Amazon and Facebook passwords, you could be in for embarrassment, if not trouble.

The frequency with which people do reuse passwords was further highlighted, indirectly, by the Gawker attackers. Notably, they publicized their attack by finding Gawker passwords that also allowed them to log into people's Twitter and Facebook accounts, because they’d recycled the same password. Furthermore, Twitter traced at least one spam attack to the stolen Gawker credentials.

Perhaps unrelated Web sites can't force users to choose different passwords, but why don't they at least force users or customers to choose stronger ones?

Well, as the ninth most popular Gawker password highlights, Web site users are first and foremost consumers, and corporate password requirements reflect this. Namely, Web sites don't want to scare away users -- who generate advertising revenue -- or customers.

In fact, passwords are often a marketing Trojan horse, or maybe not even that subtle. According to a paper delivered at the ninth annual Workshop on the Economics of Information Security at Harvard University, passwords are often employed "primarily for psychological reasons, both as a justification for collecting marketing data, and as a way to build trusted relationships with customers." Note that the word "security" is lacking from that equation.

This commercial reality was also highlighted during the Gawker debacle, in internal company communications leaked by attackers. Notably, after Gawker employees determined that their Web site and systems had been exploited and monitored for at least a month, they thought the breach was confined solely to the names of people who'd commented on content. "Just the peasants?" asked Gawker's Richard Lawson. Yes, came the answer. Only, no.

Ironically, one of the best guides to using strong passwords was published four years ago by Lifehacker. The first piece of advice? "Don't use the same password for everything." Perhaps the second should have been: Don't be a peasant.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.