Security threats Toolkit

Hackers steal easily guessed passwords

Tags:
Hackers,
,
Break In,
Guess

Andy McCue silicon.com

Published: 23 Oct 2003 13:05 BST

Hackers are increasingly resorting to social engineering techniques to obtain confidential passwords, as businesses become better at locking down and patching their computer networks.

And the bad news is that users are still very much the weak link when it comes to choosing and protecting their passwords, according to the results of a survey of IT security experts.

It found that 15 percent of those asked in an online questionnaire to give their network passwords in order to be entered into a prize draw happily clicked through to the page ready to divulge the information.

Paul Vlissidis, head of risk services at technology consultancy NCC Group, which carried out the survey, told silicon.com that the problem of staff -- and especially those in IT who should know better -- being lazy with passwords is leaving companies at risk.

"It is laziness and ignorance causing network security problems. Passwords are of greater importance now that remote access has increased from laptops and PCs with broadband at home," he said.

He said that social-engineering techniques used by hackers to glean passwords that will give them access to corporate networks are on the increase, as IT departments get better at protecting their systems.

"It is increasing as people wake up to other kinds of network vulnerabilities, such as patching systems, and as they narrow down areas of attack, hackers are going to run out of places to exploit and so will go for passwords."

Common bad practice includes shared passwords for departments and obvious popular passwords such as football clubs -- and Vlissidis said those in the boardroom are often the main culprits.

The advice for users is to avoid using for passwords dictionary words that can be cracked by programs, and to use a mixture of numbers and letters. One method is to choose a favourite song or poem and take the first letter from each line of the first verse along with a couple of numbers. When it comes round to change the password, just move on to the next verse.

"As long as you know what that song is, you will never forget the password," said Vlissidis.