Password Security Attacks

Sticky notes are a wonderful invention. They have lots of useful uses in the office, from quick lists to task descriptions on Kanban boards for agile development teams. Like all ideas, they can also be used for things that are not so good. Such as a convenient way to store passwords for IT systems. The message that you shouldn’t have a sticky note with passwords on your monitor has mostly made it into popular culture, but most Information Security and IT professionals will know at least one staff member who has the note under their keyboard or stuck on the inside of a desk drawer. The fight for better password security continues on that front.

Sadly that is not the only front on which the battle for better password security needs to be fought. Poor password choice, unenforced password rules, phishing and other social engineering attacks to steal passwords, brute force and dictionary attacks, and more are used continuously by malicious attackers to try to gain unauthorised access to IT systems.

Here are some of the common attack types, and what you can do to guard against them.

 

Dictionary Attack - This uses a list of words, such as commonly found in a dictionary, to try and guess a password protecting access to a user or system account. The words on the list are all tried in sequence until the password is found.

This type of attack is straightforward to guard against:

1. Never allow unlimited attempts to enter a password. Set a failure attempts limit, and if possible, have an increasing time delay between attempts as the failure count increases.
2. Have a password policy in place that doesn’t allow passwords that are simple words to be created and used. Force the use of multiple characters, numbers, and symbols. Also make sure the password is at least ten characters long, for the reasons outlined in the next section.

 

Brute Force Attack - Similar to a dictionary attack but rather than using a predefined list of words the attacker uses a password generator to try all the possible passwords that can be made using the standard character sets available on PCs and mobile devices. The two ways to guard against Dictionary attacks listed above are equally applicable to Brute Force Attacks.

Using the full 80 characters (numbers, letters, and symbols) typically available on a modern IT system means that there are a possible 80^8 combinations available if eight character passwords are in use. This is a huge number, and you would think that would provide security from a brute force attack. It doesn’t. Research has shown that a modern supercomputer or botnet network of hijacked PC’s could work through them all in about 4 hours. Increasing the password length to 10 characters also increases the time it takes to try all the combinations to about three years. Longer passwords are better!

of course, this is moot if you enable a limited number of allowed attempts. It would be best if you also prevented the reuse of previously used passwords.

Key Logger Attack - Malware can be used to install a Key Logger on a PC. The Key Logger takes every key entered on the machine and stores or sends it to attackers. This includes passwords entered on the keyboard.

Guard against this type of attack by ensuring anti-malware checking software is installed and up to date, and by checking outgoing traffic at the network boundary to ensure data isn’t leaving your organisation to unexpected destinations on the Internet.

Browser Password Stealers - common feature in all modern browsers is the ability to store passwords for all the sites and applications that a user visits. This is very useful as it allows users to use very complex passwords and not have to remember and type them — a win when it comes to enforcing password complexity. However, there are malware programs that can read this browser password cache and send the details to attackers.

Again, ensure that anti-malware protection is in place and up to date, and check outgoing traffic to guard against this attack.  Another option to consider is the deployment of a third party Password management system that will randomly generate, store, and enter passwords without the user even knowing what they are. All they need to remember is a single master password. Doing this means that every site a user accesses has its own separate, unique password that is not shared with any other site.

 

Phishing for Passwords - The common phishing approach is often still a way that attackers try to get access to passwords and systems. A phishing email, or another social engineering approach, is used to trick users into entering their real passwords on dummy web pages.

Protect against this by:

1. Training users to spot phishing emails and web sites that look suspicious. Encourage organisations you do business with to implement Enterprise Verified (EV) SSL Certificates on their websites so that the Trusted Name is shown in Browser address bars. Train users to look for this.
2. Enforce a strong but sensible password policy that includes frequent password changes for all systems.
3. Use multi-factor authentication for systems so that not just a password is required to get access. Renaissance has several partners who can provide solutions to deliver multi-factor or simpler two-factor authentication. They are Entrust DataCard and Censornet for multi-factor, and Secure Envoy for two-factor. Different organisations and systems within have different needs, but something suitable will be available from one of the Renaissance partners.

 

Conclusion

Passwords are still a necessary evil. However, they can be augmented, and management of them simplified with the addition of a few additional tools. Contact Renaissance today to discuss your options.