In a report likely to make IT administrators tear out their hair, most users still rely on easy passwords, some as simple as “123456,” to access their accounts.
A report released Thursday by database security vendor Imperva serves as another reminder of why IT administrators need to enforce strong password policies on enterprise applications and systems.
Imperva’s report is based on an analysis of 32 million passwords that were exposed in a recent database intrusion at RockYou, a developer of several popular Facebook applications. The passwords belonged to users who had registered with RockYou and had been stored by the company in clear text on the compromised database. The hacker responsible for the intrusion later posted the entire list of 32 million passwords on the Internet.
An analysis of that list provides the latest confirmation that a majority of users still don’t care about the strength of their passwords if they are left to choose on their own.
According to Imperva, about 30 percent of the passwords in the hacked list were six characters or smaller, while 60 percent were passwords created from a limited set of alpha-numeric characters. Nearly 50 percent of the users had used easily guessable names, common slang words, adjacent keyboard keys and consecutive digits as their passwords.
In fact the most common password among RockYou users was “123456” followed by “12345” and “123456789.” The other passwords rounding out the top five were “password” and “iloveyou.”
Many of the top 5,000 passwords in the list were identical to those found in password dictionaries, which are used by hackers to brute force their way into accounts, said Amichai Shulman, chief technology officer at Imperva. On average, a malicious attacker using such a password dictionary would have been able to break into a RockYou account at the rate of roughly one every second using an automated password guessing tool, he said.
Imperva’s report is by far not the first to highlight the tendency by many to use easily hackable passwords for online accounts. What sets it apart, however, is the sheer size of the sample that was analyzed for the report. Though the passwords in this case only controlled access to a relatively low-value user account, previous studies have shown that users tend to use the same password for multiple accounts, including corporate and financial accounts.
The Imperva report comes at a time when malicious attackers are increasingly going after user credentials to break into enterprise networks.
Last November, for instance, the FBI’s Internet Crime Complaint Center noted that cybercrooks had attempted to steal approximately $100 million from U.S. banks using stolen log-in credentials. On average, the FBI is seeing several new cases opened each week, the complaint center said. In most instances, the crooks used sophisticated keystroke-logging Trojan horse programs to steal login credentials from company employees authorized to initiate funds transfers on behalf of the business, the FBI noted.
Such attacks are highlighting the need for stronger access control and user authentication measures. For IT administrators, the main takeaway is the need for them to enforce a strong password policy over applications that they own, Shulman said. “If you let the user choose at their convenience, they will choose weak passwords,” he said.
Companies should also consider implementing controls for slowing down brute-force attacks, in which attackers try breaking into an account by trying to guess the password using an automated tool. Putting obstacles such as CAPTCHAs (Completely Automated Public Turing Test to Tell Computers and Humans Apart) in the way of a brute-force attacker are a good way to slow them down, the Imperva report noted.
Administrators also need to enforce a periodic password change policy and encourage users to create harder-to-crack passphrases instead of passwords, the report said.