Risk
1/22/2010
02:53 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Weak Passwords Pervasive, Despite Security Risks

Data from a breach affecting 32 million online accounts reveals the persistent popularity of weak passwords, despite obvious risks.

Five years ago, Microsoft Chairman Bill Gates predicted the end of passwords because they failed to keep information secure. The real problem turns out to be people, who just can't pick passwords that offer enough protection.

This point has been hammered home in a study of some 32 million passwords that were posted on the Internet after a hacker obtained them from social entertainment site RockYou last year.

In a report released on Thursday, Imperva, a security firm, analyzed the strength of the passwords people used and found that the frequent choice of short, simple passwords almost guarantees the success of brute force password attacks.

A brute force attack involves automated password guessing, using a dictionary or set of common passwords.

According to the report, "the combination of poor passwords and automated attacks means that in just 110 attempts, a hacker will typically gain access to one new account on every second or a mere 17 minutes to break into 1000 accounts."

The report reveals that 50% of users rely on slang words, dictionary words, or common arrangements of numbers and letters, like "qwerty," for their passwords.

Among users of RockYou, the most common password was "123456."

Sadly, this isn't a new problem. Previous password studies, using far smaller data sets, have shown similar findings. Imperva's CTO Amichai Shulman observes that a 1990 Unix password study reveals the same password selection problems.

A recent review of Hotmail passwords exposed in a breach also showed that "123456" is the most common password. Even though "123456" occurred only 64 times out of 10,000 passwords, that suggests that a brute force attacker could compromise one account per 157 attacked using a dictionary with only a single entry.

Jon Brody, VP at TriCipher, another security vendor, confirms that this isn't a new problem. He puts part of the blame on technology innovators for not recognizing that password policies are doomed to fail if they go against human nature. That is to say, forcing people to change their passwords every month will force them to choose weak passwords every month because that's what they can remember. Brody argues that technology companies need to create security systems that take real world behavior into account.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.