Attacks/Breaches
12/22/2010
09:40 AM
50%
50%

Schwartz On Security: Don't Get Hacked For the Holidays

The Gawker data breach highlights how few companies employ passwords for security, and how many Web site users treat them as little more than a nuisance.

But what's also fascinating, he said, is that when it comes to poor password selection, "the problem has changed very little over the past 20 years."

In fact, a 1990 study of Unix password selection found quite similar results to Imperva’s study. Of course, the equation since then has changed, as Shulman noted. Get your Gawker password hacked, and if it's the same as your Gmail, Amazon and Facebook passwords, you could be in for embarrassment, if not trouble.

The frequency with which people do reuse passwords was further highlighted, indirectly, by the Gawker attackers. Notably, they publicized their attack by finding Gawker passwords that also allowed them to log into people's Twitter and Facebook accounts, because they’d recycled the same password. Furthermore, Twitter traced at least one spam attack to the stolen Gawker credentials.

Perhaps unrelated Web sites can't force users to choose different passwords, but why don't they at least force users or customers to choose stronger ones?

Well, as the ninth most popular Gawker password highlights, Web site users are first and foremost consumers, and corporate password requirements reflect this. Namely, Web sites don't want to scare away users -- who generate advertising revenue -- or customers.

In fact, passwords are often a marketing Trojan horse, or maybe not even that subtle. According to a paper delivered at the ninth annual Workshop on the Economics of Information Security at Harvard University, passwords are often employed "primarily for psychological reasons, both as a justification for collecting marketing data, and as a way to build trusted relationships with customers." Note that the word "security" is lacking from that equation.

This commercial reality was also highlighted during the Gawker debacle, in internal company communications leaked by attackers. Notably, after Gawker employees determined that their Web site and systems had been exploited and monitored for at least a month, they thought the breach was confined solely to the names of people who'd commented on content. "Just the peasants?" asked Gawker's Richard Lawson. Yes, came the answer. Only, no.

Ironically, one of the best guides to using strong passwords was published four years ago by Lifehacker. The first piece of advice? "Don't use the same password for everything." Perhaps the second should have been: Don't be a peasant.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!