The use of traditional passwords is a slippery slope for companies these days. A much more reasonable approach is to safeguard proprietary data via things like multifactor authentication, single sign-on services or biometrics. According to security researchers' recent findings, the majority of data breaches that occurred in 2017 revolved around stolen or weak access credentials.
\r\nLet's dissect the most common password cracking methods that online perpetrators leverage to hack companies and individuals.
\r\nWhen cybercriminals obtain an organization's passwords, it's most likely because they were able to steal the password file. There are companies that keep password lists in plaintext form. A more secure tactic is to store password files in hashed form. However, neither technique does the trick reliably enough nowadays.
\r\nIn a nutshell, password hashing denotes a mechanism of one-way transformation of a password that cannot be reversed to obtain the original string. When an employee tries to log in with their regular password, the authentication module automatically transforms it to hashed form and compares the string against the value stored in the database. If these values match, the login is successful.
\r\nThreat actors who gain access to a hashed password file can leverage so-called \"rainbow tables\" to reverse the hash functions. Since this type of activity requires significant computation power, hackers can use specially crafted password cracking hardware, engage a botnet or rent space from cloud providers.
\r\nFurthermore, there are services on the dark web that allow perpetrators to outsource the data processing task. In this case, they can rent the service for a specified amount of time and even get tech support.
\r\nUltimately, any password can be cracked as long as the attackers have time and sufficient resources on their hands. The only question is how long it takes. It's usually a matter of days or even hours, not years as it used to be.
\r\nThis applies to virtually any password created by a human. Computer-generated passwords tend to be more difficult to crack this way, but they are still less secure to use than multifactor authentication.
\r\nA particularly disconcerting element in a scenario with stolen password hashes is that the whole processing and cracking routine is performed on the malefactor's machine. The attacker doesn't need to interact with the target company's infrastructure along the way; therefore, no red flags will be raised. Thousands of passwords can be cracked in hours as long as the crook's computer has enough processing power.
\r\nCybercriminals can employ botnets to compromise big online services. This technique allows them to try numerous different combinations of common usernames and passwords or ones obtained from dumps of credentials that occur regularly. These lists can be purchased on the dark web at a low cost. They usually originate from database breaches, such as the notorious Yahoo email hack that compromised billions of accounts.
\r\nLet's imagine a scenario where a threat actor wants to access email accounts. Attempts to log into the same account multiple times will generate alerts. To circumvent these security measures, the attacker starts with a list of leaked email addresses and a list of the most frequently used passwords. Then they try to get into each one of those email accounts with one of the most common passwords, generating only one failure per account. A few days later, they try another common password for every email address. By using a botnet for this purpose, the crooks make it look like the login attempts come from different sources.
\r\nA good response to this attack vector is two-factor authentication, where you receive a secret code that you need to enter every time you try to log in. Sophisticated technologies like facial recognition and behavioral biometrics are tasked with addressing the issue as well. The use of third-party authentication services like Google or Facebook is another good practice that additionally minimizes the number of passwords you have to remember.
\r\nWhen cybercrooks zero in on a person, their starting point is to check whether that individual's login credentials have already been stolen from other services. If so, chances are the same password is used for the account being targeted.
\r\nMost users have tens or even hundreds of different online accounts. It is too hard to remember passwords for all those accounts; therefore, people tend to use only a couple of passwords, with some minor variations.
\r\nSome people think they are completely secure if they have one very complex password and use it for all their accounts. That's a delusion. In case hackers get that password, all of your information is at risk. It doesn't matter how strong the password is if you reuse it. By the way, there are online resources that allow you to learn whether any of your password-protected accounts have been breached in the past.
\r\nIncidents in which hackers use malware and steal the password for one's email account are particularly detrimental. This way, the black hats can log in and reset passwords for other services the victim uses. Also, if a website or in-house enterprise service has no limitation regarding login attempts, they can brute-force the password via a dictionary attack or cracking solutions like Hashcat, Mimikatz, or John the Ripper. When going after a high-profile target, the crooks can conduct some OSINT (open source intelligence) to figure out the likely answers to security questions accompanying password recovery.
\r\nPasswords created by humans, regardless of their complexity, happen to be low-hanging fruit for hackers. The technologies for cracking them have advanced significantly over time, whereas people remain predictable enough to generate crackable passwords. That's a paradigm where attackers win and users lose.
\r\nUnfortunately, most online services follow password strength practices that are way out of date. Their requirements usually boil down to the length of eight characters or more and a mandatory combination of symbols, numbers, and uppercase and lowercase letters. It may take a computer minutes or even seconds to crack a password that meets these criteria alone.
\r\nAll of this poses a serious challenge to end users and service providers. It's too hard for the average person to create dozens of unique, long passwords for websites they use, change them regularly and remember all of them.
\r\nIt is recommended to use the longest possible passwords that online services allow and leverage a reputable password management solution to store them. Furthermore, you should safeguard the vault with a master passphrase that's about 30 characters long. Make sure it's not a quote from a novel or anything that can be found on the internet. Importantly, all of your passwords should be generated randomly and make little sense, or no sense at all. If you can remember it and tell it to someone, it's not a good password.
\n","docType":"article","guid":"articles_a4910f76a1486aa4f46b9705a06a9141","lastModified":"2018-01-31T08:00:00.000Z","published":"2018-01-31T08:00:00.000Z","structuredData":null,"subtitle":"The use of traditional passwords is a slippery slope for companies these days.","template":"legacy","title":"How Crooks Hack Passwords and How You Can Protect Your Business","type":"article","author":{"avatar":null,"bio":"David Balaban is a computer security researcher with over 10 years of experience in malware analysis and antivirus software evaluation. David runs the http://privacy-pc.com project which presents expert opinions on the contemporary information security matters, including social engineering, penetration testing, threat intelligence, online privacy and white hat hacking. As part of his work at Privacy-PC, Mr. Balaban has interviewed such security celebrities as Dave Kennedy, Jay Jacobs and Robert David Steele to get firsthand perspectives on hot InfoSec issues. David has a strong malware troubleshooting background, with the recent focus on ransomware countermeasures.","name":"David Balaban","image":null,"slug":null,"social":{"facebook":"https://www.facebook.com/PrivacyPC","linkedin":"","twitter":"https://twitter.com/privacypc","website":"http://privacy-pc.com/"},"status":"enabled","title":null,"type":"Old BDC Member","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"Business On Market St","jobTitle":"CEO","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Business Basics","slug":"business-basics"},"sub":{"name":"Entrepreneurship","slug":"entrepreneurship"}},"meta":{"robots":"index, follow","description":"Don't be a sitting duck for cyberthieves. Follow these steps to create strong passwords and thwart potential attacks.","title":"How Crooks Hack Passwords - business.com"},"parsedContent":{"toc":[{"id":"compromising-hashed-password-files","title":"Compromising hashed password files"},{"id":"large-scale-attacks-using-botnets","title":"Large-scale attacks using botnets"},{"id":"do-criminals-already-have-your-password","title":"Do criminals already have your password?"},{"id":"is-your-password-strong-enough","title":"Is your password strong enough?"}],"json":[{"component":"p","children":["The use of traditional passwords is a slippery slope for companies these days. A much more reasonable approach is to safeguard proprietary data via things like multifactor authentication, single sign-on services or biometrics. According to security researchers' ",{"component":"a","props":{"href":"http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/","rel":"nofollow"},"children":["recent findings"]},", the majority of data breaches that occurred in 2017 revolved around stolen or weak access credentials."]},{"component":"p","children":["Let's dissect the most common password cracking methods that online perpetrators leverage to hack companies and individuals."]},{"component":"h2","props":{"id":"compromising-hashed-password-files"},"children":["Compromising hashed password files"]},{"component":"p","children":["When cybercriminals obtain an organization's passwords, it's most likely because they were able to steal the password file. There are companies that keep password lists in plaintext form. A more secure tactic is to store password files in hashed form. However, neither technique does the trick reliably enough nowadays."]},{"component":"p","children":["In a nutshell, password hashing denotes a mechanism of one-way transformation of a password that cannot be reversed to obtain the original string. When an employee tries to log in with their regular password, the authentication module automatically transforms it to hashed form and compares the string against the value stored in the database. If these values match, the login is successful."]},{"component":"p","children":["Threat actors who gain access to a hashed password file can leverage so-called \"rainbow tables\" to reverse the hash functions. Since this type of activity requires significant computation power, hackers can use specially crafted password cracking hardware, engage a botnet or rent space from cloud providers."]},{"component":"p","children":["Furthermore, there are services on the dark web that allow perpetrators to outsource the data processing task. In this case, they can rent the service for a specified amount of time and even get tech support."]},{"component":"p","children":["Ultimately, any password can be cracked as long as the attackers have time and sufficient resources on their hands. The only question is how long it takes. It's usually a matter of days or even hours, not years as it used to be."]},{"component":"p","children":["This applies to virtually any password created by a human. Computer-generated passwords tend to be more difficult to crack this way, but they are still less secure to use than multifactor authentication."]},{"component":"p","children":["A particularly disconcerting element in a scenario with stolen password hashes is that the whole processing and cracking routine is performed on the malefactor's machine. The attacker doesn't need to interact with the target company's infrastructure along the way; therefore, no red flags will be raised. Thousands of passwords can be cracked in hours as long as the crook's computer has enough processing power."]},{"component":"h2","props":{"id":"large-scale-attacks-using-botnets"},"children":["Large-scale attacks using botnets"]},{"component":"p","children":["Cybercriminals can employ botnets to compromise big online services. This technique allows them to try numerous different combinations of common usernames and passwords or ones obtained from dumps of credentials that occur regularly. These lists can be purchased on the dark web at a low cost. They usually originate from database breaches, such as the notorious Yahoo email hack that compromised billions of accounts."]},{"component":"p","children":["Let's imagine a scenario where a threat actor wants to access email accounts. Attempts to log into the same account multiple times will generate alerts. To circumvent these security measures, the attacker starts with a list of leaked email addresses and a list of the most frequently used passwords. Then they try to get into each one of those email accounts with one of the most common passwords, generating only one failure per account. A few days later, they try another common password for every email address. By using a botnet for this purpose, the crooks make it look like the login attempts come from different sources."]},{"component":"p","children":["A good response to this attack vector is two-factor authentication, where you receive a secret code that you need to enter every time you try to log in. Sophisticated technologies like facial recognition and behavioral biometrics are tasked with addressing the issue as well. The use of third-party authentication services like Google or Facebook is another good practice that additionally minimizes the number of passwords you have to remember."]},{"component":"h2","props":{"id":"do-criminals-already-have-your-password"},"children":["Do criminals already have your password?"]},{"component":"p","children":["When cybercrooks zero in on a person, their starting point is to check whether that individual's login credentials have already been stolen from other services. If so, chances are the same password is used for the account being targeted."]},{"component":"p","children":["Most users have tens or even hundreds of different online accounts. It is too hard to remember passwords for all those accounts; therefore, people tend to use only a couple of passwords, with some minor variations."]},{"component":"p","children":["Some people think they are completely secure if they have one very complex password and use it for all their accounts. That's a delusion. In case hackers get that password, all of your information is at risk. It doesn't matter how strong the password is if you reuse it. By the way, there are online resources that allow you to learn whether any of your password-protected accounts have been breached in the past."]},{"component":"p","children":["Incidents in which hackers use malware and steal the password for one's email account are particularly detrimental. This way, the black hats can log in and reset passwords for other services the victim uses. Also, if a website or in-house enterprise service has no limitation regarding login attempts, they can brute-force the password via a dictionary attack or cracking solutions like Hashcat, Mimikatz, or John the Ripper. When going after a high-profile target, the crooks can conduct some OSINT (open source intelligence) to figure out the likely answers to security questions accompanying password recovery."]},{"component":"p","children":["Passwords created by humans, regardless of their complexity, happen to be low-hanging fruit for hackers. The technologies for cracking them have advanced significantly over time, whereas people remain predictable enough to generate crackable passwords. That's a paradigm where attackers win and users lose."]},{"component":"h2","props":{"id":"is-your-password-strong-enough"},"children":["Is your password strong enough?"]},{"component":"p","children":["Unfortunately, most online services follow password strength practices that are way out of date. Their requirements usually boil down to the length of eight characters or more and a mandatory combination of symbols, numbers, and uppercase and lowercase letters. It may take a computer minutes or even seconds to crack a password that meets these criteria alone."]},{"component":"p","children":["All of this poses a serious challenge to end users and service providers. It's too hard for the average person to create dozens of unique, long passwords for websites they use, change them regularly and remember all of them."]},{"component":"p","children":["It is recommended to use the longest possible passwords that online services allow and leverage a reputable password management solution to store them. Furthermore, you should safeguard the vault with a master passphrase that's about 30 characters long. Make sure it's not a quote from a novel or anything that can be found on the internet. Importantly, all of your passwords should be generated randomly and make little sense, or no sense at all. If you can remember it and tell it to someone, it's not a good password."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5a7/2321651ee47ea618b4568/1500-0-","caption":"Portrait Images Asia by Nonwarit/Shutterstock","isBlurred":true},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"The Ultimate Small Business Guide to Credit Card Processing Fees","canonical":"https://www.business.com/articles/credit-card-processing-fees/","slug":"credit-card-processing-fees","thumbnail":"https://www.business.com/images/content/5d2/346547b437454698b4577/1500-0-","dek":"Learn about credit card processing fees and how to negotiate for lower costs.","lastModified":"2020-06-16T10:08:00Z","published":"2017-12-07T08:00:00Z","sponsored":false},{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"Microsoft Azure vs. Amazon Web Services: Cloud Comparison","canonical":"https://www.business.com/articles/azure-vs-aws-cloud-comparison/","slug":"azure-vs-aws-cloud-comparison","thumbnail":"https://www.business.com/images/content/5cf/ff3445a215ed86a8b459d/1500-0-","dek":"Which one is right for your business?","lastModified":"2018-05-25T07:00:00Z","published":"2018-05-25T07:00:00Z","sponsored":false},{"title":"Your Guide to Creating a Small Business Marketing Plan","canonical":"https://www.business.com/articles/sample-marketing-plan-outline-and-template/","slug":"sample-marketing-plan-outline-and-template","thumbnail":"https://www.business.com/images/content/5f3/3e1765a215eb62d8b4567/1500-0-","dek":"Follow these templates and guidelines to get started on creating your business's marketing plan.","lastModified":"2020-08-12T12:28:00Z","published":"2018-03-02T13:00:00Z","sponsored":false},{"title":"What to Do if ICE Serves Your Business With a Form I-9 Audit","canonical":"https://www.business.com/articles/ice-serves-i-9-audit/","slug":"ice-serves-i-9-audit","thumbnail":"https://www.business.com/images/content/5e6/64def7b43740a2a8b456e/1500-0-","dek":"Make sure you're prepared should Immigration and Customs Enforcement come knocking.","lastModified":"2020-03-10T15:00:00Z","published":"2018-09-17T18:00:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay","canonical":"https://www.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://www.business.com/images/content/5c5/e0a269c658a457c8b4591/1500-0-","dek":"You no longer need to carry a bulky wallet filled with numerous credit cards or cash.","lastModified":"2018-06-21T16:06:00Z","published":"2018-06-21T16:05:00Z","sponsored":false},{"title":"Resources for Veteran-Owned Businesses","canonical":"https://www.business.com/articles/resources-veteran-owned-business/","slug":"resources-veteran-owned-business","thumbnail":"https://www.business.com/images/content/5b7/425da51ee47e7568b458a/1500-0-","dek":"How to start a business, find funding and gain customers as a veteran business owner.","lastModified":"2018-08-15T12:01:00Z","published":"2018-08-15T12:01:00Z","sponsored":false},{"title":"What Is the Triple Bottom Line?","canonical":"https://www.business.com/articles/triple-bottom-line-defined/","slug":"triple-bottom-line-defined","thumbnail":"https://www.business.com/images/content/5e8/c6d029c658a03718b456a/1500-0-","dek":"The triple bottom line is a sustainability-based accounting method that focuses on people, profit and planet. Here's how it works for businesses.","lastModified":"2020-04-10T12:17:00Z","published":"2018-07-26T17:00:00Z","sponsored":false},{"title":"How to Choose the Best Business Loan","canonical":"https://www.business.com/articles/how-to-choose-a-business-loan/","slug":"how-to-choose-a-business-loan","thumbnail":"https://www.business.com/images/content/5db/c5c175a215e47798b456f/1500-0-","dek":"Small businesses have a lot of funding options, but choose wisely.","lastModified":"2020-02-04T14:25:00Z","published":"2020-02-04T14:25:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5db752e25a215e277d8b4588/Invoicing_AndreyPopov_BDC.png","canonical":"https://staging.business.com/categories/best-collections-agency-services/","title":"The Best Collection Agency Services of 2021","dek":"We've reviewed the best collection agency services for 2021. See up-to-date comparisons on features and the best prices for the top-rated agencies.","slug":"best-collections-agency-services","lastModified":"2021-03-17T16:34:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e4edd837b437442548b456d/cash_Dutko_getty.jpg","canonical":"https://staging.business.com/categories/small-business-loans-and-financing-options/","title":"The Best Business Loan and Financing Options of 2021","dek":"Many small businesses need funding to get started. Learn about the different financing options to decide which would work best for your small business.","slug":"small-business-loans-and-financing-options","lastModified":"2021-03-11T17:24:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5d4c65367b43741a258b4572/Laptop_Sfio_Cracho.png","canonical":"https://staging.business.com/categories/crm-software/","title":"The Best CRM Software of 2021","dek":"Looking for the best CRM software? We have easy-to-read, expert unbiased reviews and feature comparisons of the best and cheapest programs.","slug":"crm-software","lastModified":"2021-02-24T14:09:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2018-01-31T08:00:00.000Z","template":"legacy","title":"How Crooks Hack Passwords and How You Can Protect Your Business","meta":{"robots":"index, follow"},"docType":"articles","slug":"how-crooks-hack-passwords","canonical":"https://staging.business.com/articles/how-crooks-hack-passwords/","skipTOC":false}},"staticQueryHashes":[]}