Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Sony Breach Reveals Users Lax With Password Security

Analysis of recent hacks finds that people commonly reuse logins and choose easy-to-crack passwords.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Who's got the better security, you or Sony?

Based on an analysis of SonyPictures.com users, half of passwords use fewer than eight characters, only 4% of passwords use more than three character types (uppercase, lowercase, numbers), and fewer than 1% of passwords use non-alphanumeric characters. Furthermore, two-thirds of people reuse their passwords on other websites.

Those findings come by way of software architect Troy Hunt, who analyzed the SonyPictures.com user account information recently released by the LulzSec hacking group. Based on that analysis "users continue to apply lousy password practices," he said in a blog post. "Sony's breach is Sony's fault, no doubt, but a whole bunch of people have made the situation far worse than it needs to be through reuse."

Indeed, while 17 different Sony websites may have been hacked in the past two months-- making the company, in the words of one security industry watcher, "a laughing stock amongst the hacking community," most Sony website users don't have anything to laugh at.

How prevalent is password reuse? To find out, Hunt looked at two of the Sony databases released by LulzSec, and found that they contained over 2,000 identical email addresses, meaning that "someone has registered on both databases," he said. But had they used different passwords? In fact, 92% of people used the same password. Perhaps, however, they were just reusing the same password on multiple Sony websites?

To find out, Hunt compared the 37,608 Sony passwords released by LulzSec, to data from last year's hack of Gawker by the Gnosis group, which led to 188,000 Gawker users' credentials being publicly disclosed.

"Although there were only 88 email addresses found in common with Sony (I had thought it might be a bit higher but then again, they're pretty independent fields), the results are still very interesting," said Hunt. Namely, 67% of people with accounts at both Sony and Gawker used the same password in both places. In other words, password reuse continues to be a problem.

Thankfully, people did at least choose relatively unique passwords. "There weren't a whole lot of instances of multiple people choosing the same password," said Hunt. In addition, the top 25 passwords seen--including "seinfeld," "password," and "123456"--only accounted for 2.5% of all passwords, while "80% of passwords actually only occurred once." Some choices, however, are better than others. For example, 36% of passwords that people chose are simply a word that appears in the dictionary, meaning that it would be easily susceptible to a dictionary attack.

Poor password practices, and people selecting relatively simple and thus easy-to-crack passwords, are nothing new. But security researchers say another significant problem is that too many websites don't properly enforce strong passwords, or properly secure stored passwords. As a result, thanks to rampant reuse of passwords, an attacker can compromise a poorly secured website, harvest user credentials, then use them to access more secure websites.

Of course, then there's Sony, which simply failed to encrypt passwords stored on a publicly accessible Web server, for example by using a cryptographic hash function such as MD5. "Sony has clearly screwed up big time here, no doubt," said Hunt. "The usual process with these exploits is to berate the responsible organization for only using MD5 or because they didn't salt the password before hashing, but to not even attempt to obfuscate passwords and simply store them in the clear? Wow."

In this special retrospective of recent news coverage, Dark Reading offers a look at the lessons learned from the most common database security mistakes and big-time breaches, as well as tips for how to avoid them. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5421
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-8225
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
CVE-2020-8237
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
CVE-2020-8245
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
CVE-2020-8246
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...