Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

New Year, New Data, Same Mistakes: Passwords

Like a late-arriving Christmas, one of the gifts of the new year is the release of SpiderLabs' annual white paper, the Global Security Report. As a supplement to this year's report, we're going to share some highlights of the corporate password study section. This section is always near and dear to our hearts as passwords play vital roles in just about every aspect of security, not to mention are a fascinating insight into the human mind.

"Why do this study year after year?", you might ask. "Aren't passwords dead? I totally read that in some magazine article!"

If the reader remembers nothing else from the GSR password study, remember this: we can discuss passwords until the end of time (or the next password cracking job finishes), but nothing is a substitute for proper system design. Your super fancy complex 128 character password is meaningless when your app stores it in (for example) plaintext/base64/etc, and that is never going to change. Leaving this important consideration out and blaming security breaches on passwords alone (as opposed to poor password reset procedure, aggressive social engineering, absentee security monitoring, etc) is quite simply misleading and possibly dishonest to the reader.

Even with a properly designed system, it's also important to remember that security will forever be a moving target. For example, as flawed as LanMan hash computation is, it still would have taken you a while to recover a password in 1993 with the hardware of the time. Now? That same hash can be recovered in 30 seconds on a standard issue desktop with rainbow tables. Even today's NT hashes can be picked off in a relatively short amount of time, length depending. It's even conceivable that someone might discover how to factor insanely large primes in record time, thus turning RSA on its head. Nobody knows what the future brings, which is why the underlying crypto that protects systems (and the passwords within) must be improved as well...

...but wait, we were here to bring you some password study results, weren't we? Ahem…

The good:

  • More source data! For this year's study we were able to utilize over 3 million Active Directory passwords across multiple users and services as well as histories.
  • The underlying crypto has improved a bit – more NT and fewer LM passwords across the data as a whole. This is likely more due to AD upgrades to 2k8, though it's hopeful that folks are making the switch to store passwords as NT-only.

And…that's about it. A bit sparse, huh?

The Bad:

  • Unfortunately, when comparing this year's study to last year's, it looks shockingly similar in terms of the "faults" we see with user password selection. Even though we often assume that users will consider stronger password selections than say a password for their social media account, we're finding that it simply isn't the case.
  • We're also finding that users are still adhering to the "minimum amount of flair" when it comes to their password selection. Meaning, if administrators are enforcing password complexity policies, often times users are basing their password sections based on the absolute bare minimum requirements.

The Ugly:

  • Last year's winner of "most common password" of Password1 has been dethroned. Who is the new champion? The answer will depress you! Download the report!
  • Special characters are becoming more and more scarce in password use. Granted this won't matter nearly as much as length, but would it kill you to throw in a #, !, or ^ in there?
  • If you work for the sprocket company and you make widgets, putting "widget" as part of your password is a terrible idea. Yes, even if it's the default for new users.

The takeaway

Provided you don't fall for one of the many traps (password incrementing, keyword use), password length is still your single best defense. We're going to keep repeating this until we're blue in the face. Maybe one day you (or your users) will listen.


Latest SpiderLabs Blogs

Welcome to Adventures in Cybersecurity: The Defender Series

I’m happy to say I’m done chasing Microsoft certifications (AZ104/AZ500/SC100), and as a result, I’ve had the time to put some effort into a blog series that hopefully will entertain and inform you...

Read More

Trustwave SpiderLabs: Insights and Solutions to Defend Educational Institutions Against Cyber Threats

Security teams responsible for defending educational institutions at higher education and primary school levels often find themselves facing harsh lessons from threat actors who exploit the numerous...

Read More

Breakdown of Tycoon Phishing-as-a-Service System

Just weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) framework, SpiderLabs’ Email Security team is tracking another PaaS called Tycoon Group.

Read More