Risk
1/22/2010
02:53 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Weak Passwords Pervasive, Despite Security Risks

Data from a breach affecting 32 million online accounts reveals the persistent popularity of weak passwords, despite obvious risks.

Five years ago, Microsoft Chairman Bill Gates predicted the end of passwords because they failed to keep information secure. The real problem turns out to be people, who just can't pick passwords that offer enough protection.

This point has been hammered home in a study of some 32 million passwords that were posted on the Internet after a hacker obtained them from social entertainment site RockYou last year.

In a report released on Thursday, Imperva, a security firm, analyzed the strength of the passwords people used and found that the frequent choice of short, simple passwords almost guarantees the success of brute force password attacks.

A brute force attack involves automated password guessing, using a dictionary or set of common passwords.

According to the report, "the combination of poor passwords and automated attacks means that in just 110 attempts, a hacker will typically gain access to one new account on every second or a mere 17 minutes to break into 1000 accounts."

The report reveals that 50% of users rely on slang words, dictionary words, or common arrangements of numbers and letters, like "qwerty," for their passwords.

Among users of RockYou, the most common password was "123456."

Sadly, this isn't a new problem. Previous password studies, using far smaller data sets, have shown similar findings. Imperva's CTO Amichai Shulman observes that a 1990 Unix password study reveals the same password selection problems.

A recent review of Hotmail passwords exposed in a breach also showed that "123456" is the most common password. Even though "123456" occurred only 64 times out of 10,000 passwords, that suggests that a brute force attacker could compromise one account per 157 attacked using a dictionary with only a single entry.

Jon Brody, VP at TriCipher, another security vendor, confirms that this isn't a new problem. He puts part of the blame on technology innovators for not recognizing that password policies are doomed to fail if they go against human nature. That is to say, forcing people to change their passwords every month will force them to choose weak passwords every month because that's what they can remember. Brody argues that technology companies need to create security systems that take real world behavior into account.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio