Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

Worst Password Blunders of 2018 Hit Organizations East and West

Good password practices remain elusive as Dashlane's latest list of the worst password blunders can attest.

When it comes to security, there are many things humans do badly. A new end-of-the-year list provides a new batch of evidence that passwords are among the worst.

The "Worst Password Offenders of 2018," assembled by password management vendor Dashlane, goes from the ridiculous to the horrifying.

The No. 1 offender on the list is the former, Kanye West, who shared his password — 000000 — on television as he unlocked his iPhone to show the screen to President Trump during an Oval Office meeting.

The remainder of the top 10 offenders lean heavily toward government or quasi-government agencies, with the second offender one of the most worrying: the Pentagon. A Government Accountability Office (GAO) audit found that many system admin passwords could be guessed in as few as nine seconds, and " ... software for multiple weapons systems was protected by default passwords," according to Dashlane. Those passwords, the GAO noted, could be found by anyone with a knowledge of the systems' manufacturers and a working understanding of how Google works.

"Unfortunately, changing the default password wouldn't make a huge difference," says Emmanuel Schalit, CEO of Dashlane. He notes that the most significant issue is a limitation of the human brain. "The most important thing you can do as an individual is to never reuse passwords," he says. "Always have a different password for every different service."

That reuse becomes challenging, Schalit explains, because "the average consumer has 200 passwords, and it's impossible to manage them all without technology to help manage the digital identity."

Other offenders on the list include Cambridge University, for exposing records of thousands of experimental subjects because a password was left in a Github repository, and Nutella, for suggesting that its Twitter followers use the word "Nutella" as their passwords as a "helpful" suggestion on National Password Day.

Some have promoted the use of two-factor authentication (2FA) as a way to reduce the impact of poor password hygiene. Schalit, too, says two factors should be used wherever possible, though its overall effectiveness is limited by two major factors. The first is that 2FA isn't available for many services, he points out.

Second, even where it is available, 2FA frequently uses SMS as part of the second factor, and " ... it only costs a few dollars to buy the text messages of an individual," Schalit says.

It's important that individuals work to improve their digital practices, he adds, because the issues with secure digital identities go beyond personal finance. "It's not an individual issue anymore — it's a global issue," he says. "Whenever one of us is breached or compromised, that doesn't just impact the individual. It starts to erode the very fabric of the Internet when it becomes too dangerous, too risky."

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
12/13/2018 | 4:18:28 PM
Interesting article, but I am not so sure the information he provided is correct
I wanted to address some of the statements listed:

→ "Always have a different password for every different service."...and it's impossible to manage them all without technology to help manage the digital identity."

Yes, he is right about that but we don't have to remember passwords for every service. We can integrate the solution with AD/LD and AD Federated services. We can associate 2FA/MFA (as mentioned in the article) as a way to centralize our password management scheme and we can use IdM (Identity Management) tools that will encrypt the data traffic from the source to the destination while the password management solution manages all of the back and forth requests.

→ The first is that 2FA isn't available for many services, he points out.

Most if not all o the providers provide 2FA/MFA, the problem is the consumer does not utilize this service when it is brought to their attention, they bypass the security mechanisms to make things easier. So in retrospect, it is not the vendor but the user who does not utilize the services. I think it would be better if we did not give them a choice but provide different mechanisms of how to enable 2FA/MFA authentication (AWS, Google, F5, MS provide the ability to do just this).

→ "it only costs a few dollars to buy the text messages of an individual," Schalit says."

I am not so sure it is that easy to purchase text messages of individuals, for one, the person has to impersonate that person, they have to know most if not everything about them. Secondly, they have to know which vendor they use (phone company) and third the assailant has to be to know something very specific about the account in order to identify and extract this information. Now if the person on the other end (member of the phone company) was selling this information, then we have bigger problems because now someone on the inside is making it very easy for this information to be obtained. If the phone company has numerous layers of security in place, then it will be only a matter of time to remove and prosecute that person for acting in such a fraudulent manner.

As a side note, I am curious from the conversations of Ed Snowden, are those text messages being sold to the highest bidder from NSA to third-parties. This is not surprising (not to say that they are) since from the time of Bush to now (Obama included) they are still using technology to extract information from the web (US Citizen Surveillance program) to keep an eye on the US public. Hopefully is not easy to get text messages but you never know.

T

Todd
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
12/13/2018 | 9:50:28 PM
Is It Really The Password's Fault?
I think this says it all: linkedin.com/pulse/watch-mark-sitkowski/
markoer
50%
50%
markoer,
User Rank: Strategist
12/18/2018 | 3:57:10 AM
Nutella is not a company
It is a brand. The company is named Ferrero.  Guys, do your homework :-)

 
JasmineJack
50%
50%
JasmineJack,
User Rank: Apprentice
12/19/2018 | 5:54:12 AM
rg
thanks

 
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
1/4/2019 | 2:24:07 AM
Honestly
Honestly, a lot of people don't try hard enough to make sure that their tech devices are properly protected. Unless the system is forcing you to choose a complicated password, seems like all your data in storage is fair game. If you don't value your information and private details, by all means! I personally would want to make sure that I do my utmost to make sure that all my private information isn't too easily accessed!
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
1/9/2019 | 12:15:57 AM
People could get complacent
It is hilarious to learn of password blunders even when we are far off into the 21st century already. People could get really complacent about their digital activities that they decided to be less than concerned about the first tier of security measures which is a good password. The level of vulnerability that they expose themselves to just makes it impossible to lecture them because a high percentage of such users are usually bad at heeding advices.
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Hunny, I looked every where for the dorritos. 
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8567
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
CVE-2020-8568
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that conta...
CVE-2020-8569
PUBLISHED: 2021-01-21
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, ...
CVE-2020-8570
PUBLISHED: 2021-01-21
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executi...
CVE-2020-8554
PUBLISHED: 2021-01-21
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typicall...