Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Passwords: Tips For Better Security

You can make your passwords more secure if you follow a few simple rules: Don't reuse passwords, make them long and random, and don't be afraid to write them down, say security experts.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
How safe are your passwords?

The LulzSec hacking group may have ceased its 50-day hacking spree, meaning that users of InfraGard, the U.S. Senate, and Sony websites, among others, can sleep more soundly at night. But people shouldn't let the apparent cessation of the latest laugh-seeking hacking campaign lull them into a false sense of security.

There's a growing body of evidence--based on numerous LulzSec exploits, last year's hack of Gawker, even a 10-year-old study of the password-picking habits of Unix users--that people prefer short, non-random, and therefore unsafe passwords. They also tend to reuse those same passwords across multiple sites. The underlying rationale is clear: it makes passwords easier to use.

Unfortunately, it also makes for poor security. For example, look at one of LulzSec's attacks against the Atlanta branch of FBI affiliate InfraGard, in which the hackers stole members' username and password combinations. Those credentials then allowed LulzSec to gain access to Atlanta InfraGard member Karim Hijazi's business and personal Gmail accounts. Hijazi is a somewhat controversial security consultant who is CEO and president of botnet monitoring startup firm Unveillance. But even he reused his passwords.

Password reuse, however, isn't the only issue. Another threat is that attackers will gain access to a website's password database and steal a copy. At that point, even if the database is encrypted, attackers can hammer away at it offline, using a tool such as Password Recovery Toolkit from AccessData to crack it in relatively little time. Processing power is no object. Indeed, researchers at Georgia Tech have tapped the graphics cards built into PCs to crack even hashed passwords with fewer than 12 characters, in short order.

Not coincidentally, the Georgia Tech researchers recommend using passwords that are at least 12 characters long, and which mix letters, numbers, and symbols. But who's going to remember a unique, randomized (aka highly entropic) 12-character password for every semi-critical website they use?

Thankfully, options abound for creating long and strong passwords. For example, people can use pass phrases--sentences, really--instead of passwords. Another option, meanwhile, is to build passwords using some kind of predetermined logic. The password "mniE," for example, would be short for "my name is Earl." (Ideally, of course, the password would be much longer.) Proponents of this approach often recommend using a variation that builds in the name of the website, so that one password can be altered to address various other websites. For Amazon.com, for example, the variation could be "mAMAniE."

Despite the potential security improvement, according to Jesper M. Johansson, formerly the security program manager at Microsoft, and now the principal security architect at Amazon.com, it's unclear if many people bother to use pass phrases. Furthermore, based on some rough estimates, he said that it's likely that a person would need to use a six-word pass phrase--which is starting to get clunky--to attain the same level of entropy as a nine-character password. Finally, reusing parts of passwords across different websites means that attackers who steal username and password combinations might be able to reverse-engineer the logic.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I feel safe, but I can't understand a word he's saying."
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7599
PUBLISHED: 2020-03-30
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly ...
CVE-2020-7610
PUBLISHED: 2020-03-30
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
CVE-2019-17560
PUBLISHED: 2020-03-30
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" version...
CVE-2019-17561
PUBLISHED: 2020-03-30
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
CVE-2020-8509
PUBLISHED: 2020-03-30
Zoho ManageEngine Desktop Central allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.