Risk
1/22/2010
02:53 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Weak Passwords Pervasive, Despite Security Risks

Data from a breach affecting 32 million online accounts reveals the persistent popularity of weak passwords, despite obvious risks.

Five years ago, Microsoft Chairman Bill Gates predicted the end of passwords because they failed to keep information secure. The real problem turns out to be people, who just can't pick passwords that offer enough protection.

This point has been hammered home in a study of some 32 million passwords that were posted on the Internet after a hacker obtained them from social entertainment site RockYou last year.

In a report released on Thursday, Imperva, a security firm, analyzed the strength of the passwords people used and found that the frequent choice of short, simple passwords almost guarantees the success of brute force password attacks.

A brute force attack involves automated password guessing, using a dictionary or set of common passwords.

According to the report, "the combination of poor passwords and automated attacks means that in just 110 attempts, a hacker will typically gain access to one new account on every second or a mere 17 minutes to break into 1000 accounts."

The report reveals that 50% of users rely on slang words, dictionary words, or common arrangements of numbers and letters, like "qwerty," for their passwords.

Among users of RockYou, the most common password was "123456."

Sadly, this isn't a new problem. Previous password studies, using far smaller data sets, have shown similar findings. Imperva's CTO Amichai Shulman observes that a 1990 Unix password study reveals the same password selection problems.

A recent review of Hotmail passwords exposed in a breach also showed that "123456" is the most common password. Even though "123456" occurred only 64 times out of 10,000 passwords, that suggests that a brute force attacker could compromise one account per 157 attacked using a dictionary with only a single entry.

Jon Brody, VP at TriCipher, another security vendor, confirms that this isn't a new problem. He puts part of the blame on technology innovators for not recognizing that password policies are doomed to fail if they go against human nature. That is to say, forcing people to change their passwords every month will force them to choose weak passwords every month because that's what they can remember. Brody argues that technology companies need to create security systems that take real world behavior into account.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?