Attacks/Breaches
12/22/2010
09:40 AM
50%
50%

Schwartz On Security: Don't Get Hacked For the Holidays

The Gawker data breach highlights how few companies employ passwords for security, and how many Web site users treat them as little more than a nuisance.

But what's also fascinating, he said, is that when it comes to poor password selection, "the problem has changed very little over the past 20 years."

In fact, a 1990 study of Unix password selection found quite similar results to Imperva’s study. Of course, the equation since then has changed, as Shulman noted. Get your Gawker password hacked, and if it's the same as your Gmail, Amazon and Facebook passwords, you could be in for embarrassment, if not trouble.

The frequency with which people do reuse passwords was further highlighted, indirectly, by the Gawker attackers. Notably, they publicized their attack by finding Gawker passwords that also allowed them to log into people's Twitter and Facebook accounts, because they’d recycled the same password. Furthermore, Twitter traced at least one spam attack to the stolen Gawker credentials.

Perhaps unrelated Web sites can't force users to choose different passwords, but why don't they at least force users or customers to choose stronger ones?

Well, as the ninth most popular Gawker password highlights, Web site users are first and foremost consumers, and corporate password requirements reflect this. Namely, Web sites don't want to scare away users -- who generate advertising revenue -- or customers.

In fact, passwords are often a marketing Trojan horse, or maybe not even that subtle. According to a paper delivered at the ninth annual Workshop on the Economics of Information Security at Harvard University, passwords are often employed "primarily for psychological reasons, both as a justification for collecting marketing data, and as a way to build trusted relationships with customers." Note that the word "security" is lacking from that equation.

This commercial reality was also highlighted during the Gawker debacle, in internal company communications leaked by attackers. Notably, after Gawker employees determined that their Web site and systems had been exploited and monitored for at least a month, they thought the breach was confined solely to the names of people who'd commented on content. "Just the peasants?" asked Gawker's Richard Lawson. Yes, came the answer. Only, no.

Ironically, one of the best guides to using strong passwords was published four years ago by Lifehacker. The first piece of advice? "Don't use the same password for everything." Perhaps the second should have been: Don't be a peasant.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1235
Published: 2015-04-19
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVE-2015-1236
Published: 2015-04-19
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a cr...

CVE-2015-1237
Published: 2015-04-19
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages ...

CVE-2015-1238
Published: 2015-04-19
Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVE-2015-1240
Published: 2015-04-19
gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.