{"id":33522,"date":"2019-03-14T12:00:36","date_gmt":"2019-03-14T19:00:36","guid":{"rendered":"https:\/\/www.enxmag.com\/twii\/?p=33522"},"modified":"2019-03-14T12:00:36","modified_gmt":"2019-03-14T19:00:36","slug":"passwords-and-their-encryption-are-easy-prey-for-cybercriminals-in-account-takeover-attacks","status":"publish","type":"post","link":"https:\/\/www.enxmag.com\/twii\/the-week-in-imaging-twii\/editors-blog\/2019\/03\/passwords-and-their-encryption-are-easy-prey-for-cybercriminals-in-account-takeover-attacks\/","title":{"rendered":"Passwords and their Encryption Are Easy Prey for Cybercriminals in Account Takeover Attacks"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"size-full wp-image-29347 alignleft\" src=\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2018\/05\/creating_strong_passwords.png\" alt=\"\" width=\"247\" height=\"247\" srcset=\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2018\/05\/creating_strong_passwords.png 247w, https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2018\/05\/creating_strong_passwords-150x150.png 150w, https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2018\/05\/creating_strong_passwords-200x200.png 200w, https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2018\/05\/creating_strong_passwords-380x380.png 380w\" sizes=\"(max-width: 247px) 100vw, 247px\" \/>Passwords serve as the foundation for most security today. But security vendor SpyCloud has recovered over 3.5 billion credentials, demonstrating just how insecure they really are.<\/p>\n<p>We\u2019d like to think that in this day and age, users are aware that they need to use secure passwords. Putting aside cyber attacks focused on tricking users into providing credentials, the passwords themselves should be complex enough that they\u2019re not easy to break.<\/p>\n<p>But, according to SpyCloud\u2019s <a href=\"https:\/\/spycloud.com\/2018-annual-credential-exposure-report\/\" rel=\"noopener\">Annual Credential Exposure Report<\/a>, released last month, passwords (and their encryption) are anything but secure.<\/p>\n<p>SpyCloud was able to recover over 3.5 billion credentials from over 2800 breached sources. They decrypted nearly <strong>90% of all the passwords collected<\/strong>, yielding 2.3 billion plaintext passwords. According to the report, the cracking of the passwords was easy. The encryption methods used aren\u2019t a challenge for the sophisticated software used by cybercriminals.<\/p>\n<p>And to boot, the passwords themselves weren\u2019t very secure \u2013 adding to the ease of decryption. Passwords like \u201c12345\u201d, \u201cpassword\u201d, \u201ciloveyou\u201d, and \u201cqwerty\u201d continue to top the list of the most commonly used.<\/p>\n<p><em>So, what\u2019s to blame when it comes to exposed credentials?<\/em><\/p>\n<p>There are a few factors:<\/p>\n<ul>\n<li><strong>Encryption<\/strong> \u2013 organizations hosting credentials for cloud-based applications need to be using the highest possible levels of encryption.<\/li>\n<li><strong>Policy<\/strong> \u2013 organizations should require secure passwords with minimum length, complexity, and change frequency requirements.<\/li>\n<li><strong>Awareness<\/strong> \u2013 users themselves aren\u2019t the slightest bit concerned about the security of their passwords. Organizations should use <a href=\"https:\/\/www.knowbe4.com\/products\/enterprise-security-awareness-training\/\">Security Awareness Training<\/a> to continually update users on security best practices, details on attack methods used, and how users can be vigilant at work and home to not become a victim.<\/li>\n<\/ul>\n<p><strong>Are your user\u2019s passwords\u2026P@ssw0rd?<\/strong><\/p>\n<p><span id=\"hs_cos_wrapper_post_body\" class=\"hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_rich_text\" data-hs-cos-general-type=\"meta_field\" data-hs-cos-type=\"rich_text\"><img class=\"alignright\" src=\"https:\/\/blog.knowbe4.com\/hs-fs\/hubfs\/wpt02.png?width=200&amp;name=wpt02.png\" alt=\"wpt02\" width=\"200\" \/><\/span>Employees are the weakest link in network security, using weak passwords and falling for phishing and social engineering attacks.\u00a0KnowBe4\u2019s complimentary <a href=\"https:\/\/www.knowbe4.com\/weak-password-test\">Weak Password Test<\/a> (WPT) checks your Active Directory for several different types of weak password related threats. Here&#8217;s how it works:<\/p>\n<ul>\n<li>Reports on the accounts that are affected<\/li>\n<li>Tests against 10 types of weak password related threats<\/li>\n<li>Does not show\/report on the actual passwords of accounts<\/li>\n<li>Just download the install and run it<\/li>\n<li>Results in a few minutes!<\/li>\n<\/ul>\n<p><em>This blog originally appeared on the KnowBe4 <a href=\"https:\/\/blog.knowbe4.com\/\">website<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Passwords serve as the foundation for most security today. But security vendor SpyCloud has recovered over 3.5 billion credentials, demonstrating just how insecure they really are. We\u2019d like to think that in this day and age, users are aware that they need to use secure passwords. Putting aside cyber attacks focused on tricking users into providing credentials, the passwords themselves should be complex enough that they\u2019re not easy to break. But, according to SpyCloud\u2019s Annual Credential Exposure Report, released last month, passwords (and their encryption) are anything but secure. SpyCloud was able to recover over 3.5 billion credentials from over 2800 breached sources. They decrypted nearly 90% of all the passwords collected, yielding 2.3 billion plaintext passwords. According to the report, the cracking of the passwords was easy. The encryption methods used aren\u2019t a challenge for the sophisticated software used by cybercriminals. And to boot, the passwords themselves weren\u2019t very secure \u2013 adding to the ease of decryption. Passwords like \u201c12345\u201d, \u201cpassword\u201d, \u201ciloveyou\u201d, and \u201cqwerty\u201d continue to top the list of the most commonly used. So, what\u2019s to blame when it comes to exposed credentials? There are a few factors: Encryption \u2013 organizations hosting credentials for cloud-based applications need to be using the highest possible levels of encryption. Policy \u2013 organizations should require secure passwords with minimum length, complexity, and change frequency requirements. Awareness \u2013 users themselves aren\u2019t the slightest bit concerned about the security of their passwords. Organizations should use Security Awareness Training to continually update users on security best practices, details on attack methods used, and how users can be vigilant at work and home to not become a victim. Are your user\u2019s passwords\u2026P@ssw0rd? Employees are the weakest link in network security, using weak passwords and falling for phishing and social engineering attacks.\u00a0KnowBe4\u2019s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats. Here&#8217;s how it works: Reports on the accounts that are affected Tests against 10 types of weak password related threats Does not show\/report on the actual passwords of accounts Just download the install and run it Results in a few minutes! This blog originally appeared on the KnowBe4 website.<\/p>\n","protected":false},"author":178,"featured_media":29347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[80,1650,82,88,1638],"tags":[3590],"_links":{"self":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/33522"}],"collection":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/users\/178"}],"replies":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/comments?post=33522"}],"version-history":[{"count":3,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/33522\/revisions"}],"predecessor-version":[{"id":33525,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/33522\/revisions\/33525"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/media\/29347"}],"wp:attachment":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/media?parent=33522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/categories?post=33522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/tags?post=33522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}