Attacks/Breaches
12/22/2010
09:40 AM
Connect Directly
RSS
E-Mail
50%
50%

Schwartz On Security: Don't Get Hacked For the Holidays

The Gawker data breach highlights how few companies employ passwords for security, and how many Web site users treat them as little more than a nuisance.

But what's also fascinating, he said, is that when it comes to poor password selection, "the problem has changed very little over the past 20 years."

In fact, a 1990 study of Unix password selection found quite similar results to Imperva’s study. Of course, the equation since then has changed, as Shulman noted. Get your Gawker password hacked, and if it's the same as your Gmail, Amazon and Facebook passwords, you could be in for embarrassment, if not trouble.

The frequency with which people do reuse passwords was further highlighted, indirectly, by the Gawker attackers. Notably, they publicized their attack by finding Gawker passwords that also allowed them to log into people's Twitter and Facebook accounts, because they’d recycled the same password. Furthermore, Twitter traced at least one spam attack to the stolen Gawker credentials.

Perhaps unrelated Web sites can't force users to choose different passwords, but why don't they at least force users or customers to choose stronger ones?

Well, as the ninth most popular Gawker password highlights, Web site users are first and foremost consumers, and corporate password requirements reflect this. Namely, Web sites don't want to scare away users -- who generate advertising revenue -- or customers.

In fact, passwords are often a marketing Trojan horse, or maybe not even that subtle. According to a paper delivered at the ninth annual Workshop on the Economics of Information Security at Harvard University, passwords are often employed "primarily for psychological reasons, both as a justification for collecting marketing data, and as a way to build trusted relationships with customers." Note that the word "security" is lacking from that equation.

This commercial reality was also highlighted during the Gawker debacle, in internal company communications leaked by attackers. Notably, after Gawker employees determined that their Web site and systems had been exploited and monitored for at least a month, they thought the breach was confined solely to the names of people who'd commented on content. "Just the peasants?" asked Gawker's Richard Lawson. Yes, came the answer. Only, no.

Ironically, one of the best guides to using strong passwords was published four years ago by Lifehacker. The first piece of advice? "Don't use the same password for everything." Perhaps the second should have been: Don't be a peasant.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3562
Published: 2014-08-21
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

CVE-2014-3577
Published: 2014-08-21
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-...

CVE-2014-5158
Published: 2014-08-21
The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.

CVE-2014-5159
Published: 2014-08-21
SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.

CVE-2014-5210
Published: 2014-08-21
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.