Risk
6/27/2011
05:54 PM
Connect Directly
RSS
E-Mail
50%
50%

Passwords: Tips For Better Security

You can make your passwords more secure if you follow a few simple rules: Don't reuse passwords, make them long and random, and don't be afraid to write them down, say security experts.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
How safe are your passwords?

The LulzSec hacking group may have ceased its 50-day hacking spree, meaning that users of InfraGard, the U.S. Senate, and Sony websites, among others, can sleep more soundly at night. But people shouldn't let the apparent cessation of the latest laugh-seeking hacking campaign lull them into a false sense of security.

There's a growing body of evidence--based on numerous LulzSec exploits, last year's hack of Gawker, even a 10-year-old study of the password-picking habits of Unix users--that people prefer short, non-random, and therefore unsafe passwords. They also tend to reuse those same passwords across multiple sites. The underlying rationale is clear: it makes passwords easier to use.

Unfortunately, it also makes for poor security. For example, look at one of LulzSec's attacks against the Atlanta branch of FBI affiliate InfraGard, in which the hackers stole members' username and password combinations. Those credentials then allowed LulzSec to gain access to Atlanta InfraGard member Karim Hijazi's business and personal Gmail accounts. Hijazi is a somewhat controversial security consultant who is CEO and president of botnet monitoring startup firm Unveillance. But even he reused his passwords.

Password reuse, however, isn't the only issue. Another threat is that attackers will gain access to a website's password database and steal a copy. At that point, even if the database is encrypted, attackers can hammer away at it offline, using a tool such as Password Recovery Toolkit from AccessData to crack it in relatively little time. Processing power is no object. Indeed, researchers at Georgia Tech have tapped the graphics cards built into PCs to crack even hashed passwords with fewer than 12 characters, in short order.

Not coincidentally, the Georgia Tech researchers recommend using passwords that are at least 12 characters long, and which mix letters, numbers, and symbols. But who's going to remember a unique, randomized (aka highly entropic) 12-character password for every semi-critical website they use?

Thankfully, options abound for creating long and strong passwords. For example, people can use pass phrases--sentences, really--instead of passwords. Another option, meanwhile, is to build passwords using some kind of predetermined logic. The password "mniE," for example, would be short for "my name is Earl." (Ideally, of course, the password would be much longer.) Proponents of this approach often recommend using a variation that builds in the name of the website, so that one password can be altered to address various other websites. For Amazon.com, for example, the variation could be "mAMAniE."

Despite the potential security improvement, according to Jesper M. Johansson, formerly the security program manager at Microsoft, and now the principal security architect at Amazon.com, it's unclear if many people bother to use pass phrases. Furthermore, based on some rough estimates, he said that it's likely that a person would need to use a six-word pass phrase--which is starting to get clunky--to attain the same level of entropy as a nine-character password. Finally, reusing parts of passwords across different websites means that attackers who steal username and password combinations might be able to reverse-engineer the logic.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant