Category Archives: Online password

Password complexity, does it really matter?

Posted on by

  SplashData recently has released their annual list of the 25 most widely used bad passwords. The blog noted, quote:

    “In SplashData’s fifth annual report, compiled from more than 2 million leaked passwords during the year, some new and longer passwords made their debut – perhaps showing an effort by both websites and web users to be more secure. However, the longer passwords are so simple as to make their extra length virtually worthless as a security measure.”

  The number of leaked passwords in 2015 had been much more than two million. Chances are that the actual number is a lot larger. Just the Ashley Madison security breach in 2015 netted the hacker(s) 34 million passwords. While I don’t doubt the authenticity of SplashData and the top 25 list based on their number, the chances are that the analysis is somewhat skewed.

SplashData does provide some advice on password protection via simple tips like this one, quote:

    “Use passwords or passphrases of twelve characters or more with mixed types of characters”

   Wait… Weren’t most, if not all, leaked passwords related to websites’ security breaches? If they were, what is the difference between the “123456” and the “3pHj1P38JVF4” password? In reality, the difference is nothing. Other than the obvious that the end user will have a hard time remembering the twelve character randomly generated password. Let’s face it, as long as the hacker(s) can download the password database, it does not matter if password complexity is in place or not.

  Information Technology (IT) people can go ahead and ridicule the end users for their choice of passwords. Doing so will result in couple of funny stories, but the jokes are on them. Here’s 2016 and IT people still cannot secure the password databases.

  Despite all of this, it will not stop IT people from requiring the end users to use long and complex passwords, use special characters, include upper and lower case letters, have numerals, different passwords for each account, to not write them down, and to change them frequently. Doing any combination of the aforementioned will not likely matter. No wonder the end users cringe when the IT guys/gals shows up…

  None of the top lists would be possible by simply guessing the password or via social engineering. The number of passwords obtained by these means would not be sufficient for statistical purposes. Let’s not throw the end users under the bus and do what needs to be done. Secure the password databases IT people…

Capturing online passwords and Antivirus…

Posted on by

The “traditional means” of capturing online passwords had been provided by “key-loggers” for decades, that capture every key-strokes by the local users. As of late, Antivirus companies have added additional protection for preventing key-loggers from collecting passwords. This security protection has various names and dependent on the Antivirus company, such as safepay, password manager, etc. Almost all of these protections integrate virtual keyboard, that require clicking on the password and/or using a touchscreen for entering the password, instead of the traditional key-board strokes.

Do they actually work?

The short answer is yes, they could prevent key-loggers collecting the password since the keyboard is not used for entering account information. The problem is that, if the end user computer has a key-logger, the machine also has a root-kit (a requirement to install the key-logger) that has full access to the system, including the Antivirus. As such, the root-kit can routinely exempt itself from Antivirus protection and in theory, it could capture the virtual keystroke as well.

Hackers always seem to be ahead of Antivirus solutions and that certainly seems to be the case for capturing online passwords. Instead of using a key-logger, they have developed a solution that capture the user account credentials by grabbing them with an HTML form grabber. The form grabber “grabs” the authentication credentials from within the browser, where the login credentials are entered. It does not matter, if these credentials entered by keyboard, virtual keyboard, or auto-filled, the form grabber captures it. The malicious package had been released in May, 2013, pretty much around the time when Antivirus companies starting to advertise/claim to secure the end user’s passwords. Coincidence, you might say? It could be… The HTML form grabber also requires a root-kit for its operation, similarly to the key-loggers above.

In both cases, the common need for capturing the end user’s authentication credentials is the root-kit, without it, neither of them can capture the password. The Antivirus solutions would be better off preventing the root-kit getting on the computers, instead of rolling out additional features with dubious claims.

The Antivirus solution, while it is still necessary, requires additional security measures to augment protection against root-kits. Friends, don’t let friends rely on Antivirus protection only…