Password “brett1” would take 54 milliseconds’ to crack, “brett123” a minute and “brett2016” only 42 minutes.
Every IT technician gets the call at some time...
A good friend of 10 years called me after his wife had been victim to a telephone scam. A Telstra user, she received a call from "Telstra" to say their PC was infected - a pretty standard scam for those of us involved with digital security.
The result was that the scammer had locked the PC using Window's own SYSKEY security program.
My friend dropped off his PC and install disks, the scammers had cleared his restore points, so there was no way of restoring the PC back to its original state before the social engineering attack.
I found a program designed to crack passwords - a legitimate program designed to help people who had forgotten their passwords or had been scammed.The password utility was free up to 5 or 6 characters in length. A few seconds later, the password 4123 was cracked. Actually, it was probably less than 2 seconds.
I immediately thought of how easy some of the passwords I'd seen used in the workplace could be cracked by even the most unskilled hacker with this program.
Passwords are one of the biggest problems in digital security at the moment. Several companies are making moves to reduce or eliminate them, but until other methods are simple, reliable and easy enough for widespread implementation we are stuck with the old passwords.
In the past few years I've seen some terribly concerning passwords - a three letter word (all lower case), simple names, Password1 etc. Some of the worst offenders have been company directors, financial managers, and therefore putting their entire business at risk.
Whenever somebody wants access to your bank account, personal information, identity etc... they will start with your less secure accounts. The jackpot for them is the account that your other accounts use for verification, such as an email account...
Brute force attacks start with "rainbow tables" - passwords organised by popularity from lists stolen from other sources. Often these passwords include "Password1", "qwerty", "asdfjkl;", "Sarah", "abc123" and even common phrases such as "let me in".
The trick is to find methods that provide enough complexity to make your password too hard to bother for a brute-force attack, without making it too hard to live with.
An example of this I saw several years ago was the line from Gone with the Wind - "Frankly my dear I don't give a damn" was turned into the password "Fmdidgad". "How secure is my password" site at http://howsecureismypassword.net gives it 22 minutes to survive a brute force attack.
By adding numbers and characters - "Fmdidgad12#%" will take 34 thousand years!
CNET suggest the same method is very effective when more complex and longer. A password of 15 characters can take 16 billion years to crack. However, the Holy Grail in passwords is to find something simple to remember, something you can increment a few times before starting a new password model, and of course something terribly difficult to guess/brute force.
For more help on password security, visit the websites below or have a chat to us today!
Simply contact us on 1300 307 907 or complete the form below.