Passwords

I just completed a security audit for a client. All employees are notified when hired and reminded monthly that audits

* may occur at any time
* passwords must be secure
* the computers are to be used for business purposes only
* all files are subject to inspection, etc.

These are college educated, computer savvy professionals. One assumes they are of at least average intelligence. Never the less, all kinds of verboten activities were found.

However, the worst security failure, and my reason for posting this message, is that of 23 workstations, only one of the passwords took more than 2 minutes to crack! 22 passwords were plain English words that a dictionary attack decrypted usually within a few seconds.

Never ever use a real word as a password. Throw in a few numbers. Use special characters if allowed. The best method I know of to generate fairly random passwords that you can remember is to use the first letter of each word in a familiar phrase. "These are the times that try men's souls" = tattttms, for example.

...know how it feels... came by a user yesterday (MBA and all the works)... last Windows update (which shows the big AN UPDATE IS AVAILABLE in the systemtray) was done in late 2002 (!)...

...but it gets better, the AV was the version that everyone (with a very simple to follow instruction) was to replace last summer, since it expired... so no updates/patches/fixes/AV protection...

...and today he loudly exclaimed that all was good before I touched his PC...

...well, that's why you have regular maintenance on your car and a physical for yourself... or am I missing something ???
:rolleyes:

Thanks for the reminder and tip Jerry. Like the one about using an acronym of sorts, never occurred to me. Makes it easy to remember ;)

Brings up a question a friend posed to me. She designed a very "intricate" password and she uses it in multiple places (i.e. ISP log on and Ebay, I think). She asked me if that was safe, using it in multiple places. I always assign a unique password in each instance (hence the need to keep an ever growing list in a safe place lest I forget :D ) What's your opinion on her method?

I'm very curious, the password that took over 2 minutes to crack, was it all letters or did it contain numbers as well? -Kat

Quote:

---

She designed a very "intricate" password and she uses it in multiple places...I always assign a unique password in each instance (hence the need to keep an ever growing list in a safe place

---

There's no right answer. For very important data (eg, access to a bank account) use a unique password. Less critical purposes (game sites, for example) can share a password.

Many of the "experts" disagree but I'm in favor of keeping a list of passwords especially for rarely accessed sites and files. Far more passwords are forgotton than are cracked. BUT, don't keep the list near the computer.

Quote:

---

the password that took over 2 minutes to crack, was it all letters or did it contain numbers as well?

---

It was well formed with random numbers and letters. However, it was only five characters long and a brute force attack (trying every possible combination of characters) found it in 2 minutes and 26 seconds. Had it been 8 characters, it almost certainly would have passed the audit (I would have given up long before it was cracked).

Thanks, greatly appreciate the input, and will pass it along! :)

Your thoughts on one more issue, if I may? The use of Social Security #s for passwords. The local University requires students to use SS#'s as student IDs, and as an example, in order to get grades a student must log onto the Univ. web site via SS#. PIN is date of birth. I'm no security expert, but that seems like such an easy target because it's so obvious. I cringe at the thought of it, but that's their policy and they're sticking to is. So if you can crack a password that's all letters, wouldn't a password that's all numbers, such as S.S., be just as easy to crack?

The SSN has 999,999,999 possible combinations (assuming all zeros is not a valid SSN), not a trivial number even for a computer, but far less than the (36 to the 9th power) values possible if alphabetics were also used.

However, the University is using the SSN as an account identifier. The DOB is the password (sort of). This is hardly secure but it may not be quite as bad as it seems at first glance.

With most computer passwords (including the OS logon I was testing), the user is first presented with a list of IDs that clearly identify the authorized users (often only one user). Select an ID and enter the password. In other words, the password is the only protection.

I'm sure the University system does not display a list of SSNs. If both the SSN and DOB have to be typed in, a crack becomes much more difficult. A six digit DOB increases the combinations less than 999,999 times (the year will usually be in the range of 18 to 22 years ago, the month has only 12 possibilities and day has 31) but a brute force attack is probably too time consuming if the only payoff is a student's grades.

The real problem is that SSN and DOB can be obtained by other means.

Quote:

---

Originally posted by KatMac
Brings up a question a friend posed to me. She designed a very "intricate" password and she uses it in multiple places (i.e. ISP log on and Ebay, I think). She asked me if that was safe, using it in multiple places. I always assign a unique password in each instance (hence the need to keep an ever growing list in a safe place lest I forget :D ) What's your opinion on her method?

---

IMO it depends on how much you trust the sites you have passwords for. How do you know that Big John and the server admins can't go into an admin page and view the password you've used here at VirtualDr?* Although many systems these days store passwords in such a way that you can't generate the original password from the stored copy, there are still a lot that store them in plaintext or using reversible encryption.

* I'm not suggesting this is the case; it's just a convenient example.

Thanks Jerry, very educational, as always :) I was concerned about the SS# issue, because the same scenario is played out in the Federal Student loan site, except that they issue the PIN, rather than it being D.O.B. Info at that site is much more personal than grades, as it essentially contains one's entire financial profile.

Tuttle, I'll pass along these comments to my friend. I imagine some of the sites she doubles up on with passwords are less than discreet/secure, so as Jerry mentioned, I'll suggest to her she not use those same passwords at sites with more confidential type info, especially if funds are involved, etc.

Quote:

---

How do you know that Big John ... can't go into an admin page and view the password you've used here at VirtualDr?

---

And he knows if you've been naughty or nice, so be good for goodness sake.:D

Bit of a tangent, and I've never tried it, but can't Windows be forced to require a complex password via GPO? There's a setting for "Passwords must meet complexity requirements" (at least in Win2K, I assume NT and XP as well), from my understanding it forces users to choose a password with a mix of numeric, upper and lower-case characters...

Just a thought...?

KV

It doesn't matter.

They'll share their passwords with their secretaries/EAs and with people when they are going off on vacation etc.

Quote:

---

And he knows if you've been naughty or nice, so be good for goodness sake.

---

Yeah, bet the Eye In the Sky knows a lot more than he lets on :D

I totally agree with the last statement of jerryctx.

Social Engineering is usually how passwords get broken these days mind it helps if you dont use you wifes name,daughters name,dogs name,Social security number,Licence plate etc as a password or leave it on a piece of paper in the desk drawer.
Wasnt there a recent report of hackers merely mumbling on the phone when asked for a password only to eventually get logged on the system because the operator got fed up of trying to understand them.

'Social engineering'....A friend of mine (who used to work in Security for Microsoft) was treated rudely by a lady at the Dept. of Motor Vehicles. He noticed a 'sticky' note on her monitor, and wrote down the info.
A few days later, at the public library, he booted with a KnoppixSTD disk, hopped through 3 servers and landed in the DMV's server - courtesy of a full-access password. He snooped around and left everything untouched, but what if he wasn't such a nice guy?
Moral - be nice to security-types. And keep your passwords elsewhere.

Quote:

---

A hacker, nicknamed hakrobatik, explained the trick to Wired.

I kept calling and pretending I just had jaw surgery and mumbling gibberish. At first I had no info except the screen name, then I called and got the first name and last name by saying, 'Could you repeat what I just said?' Then each time that I got information I called back making the real information understandable, and everything else I just mumbled.

Eventually service reps got so fed up, that they reset a user's password. In this way, hakrobatik plausibly claims, a cracker could gain access to any AOL member's account - using only a screen name - by phoning up overseas call centres.

---

http://www.theregister.co.uk/content/archive/29433.html