Attacks/Breaches
12/22/2010
09:40 AM
50%
50%

Schwartz On Security: Don't Get Hacked For the Holidays

The Gawker data breach highlights how few companies employ passwords for security, and how many Web site users treat them as little more than a nuisance.

But what's also fascinating, he said, is that when it comes to poor password selection, "the problem has changed very little over the past 20 years."

In fact, a 1990 study of Unix password selection found quite similar results to Imperva’s study. Of course, the equation since then has changed, as Shulman noted. Get your Gawker password hacked, and if it's the same as your Gmail, Amazon and Facebook passwords, you could be in for embarrassment, if not trouble.

The frequency with which people do reuse passwords was further highlighted, indirectly, by the Gawker attackers. Notably, they publicized their attack by finding Gawker passwords that also allowed them to log into people's Twitter and Facebook accounts, because they’d recycled the same password. Furthermore, Twitter traced at least one spam attack to the stolen Gawker credentials.

Perhaps unrelated Web sites can't force users to choose different passwords, but why don't they at least force users or customers to choose stronger ones?

Well, as the ninth most popular Gawker password highlights, Web site users are first and foremost consumers, and corporate password requirements reflect this. Namely, Web sites don't want to scare away users -- who generate advertising revenue -- or customers.

In fact, passwords are often a marketing Trojan horse, or maybe not even that subtle. According to a paper delivered at the ninth annual Workshop on the Economics of Information Security at Harvard University, passwords are often employed "primarily for psychological reasons, both as a justification for collecting marketing data, and as a way to build trusted relationships with customers." Note that the word "security" is lacking from that equation.

This commercial reality was also highlighted during the Gawker debacle, in internal company communications leaked by attackers. Notably, after Gawker employees determined that their Web site and systems had been exploited and monitored for at least a month, they thought the breach was confined solely to the names of people who'd commented on content. "Just the peasants?" asked Gawker's Richard Lawson. Yes, came the answer. Only, no.

Ironically, one of the best guides to using strong passwords was published four years ago by Lifehacker. The first piece of advice? "Don't use the same password for everything." Perhaps the second should have been: Don't be a peasant.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.