Hackers steal easily guessed passwords

Hackers steal easily guessed passwords

Summary: Users remain the weakest link when it comes to IT security, according to a survey

SHARE:
TOPICS: Security
4
Hackers are increasingly resorting to social engineering techniques to obtain confidential passwords, as businesses become better at locking down and patching their computer networks.

And the bad news is that users are still very much the weak link when it comes to choosing and protecting their passwords, according to the results of a survey of IT security experts.

It found that 15 percent of those asked in an online questionnaire to give their network passwords in order to be entered into a prize draw happily clicked through to the page ready to divulge the information.

Paul Vlissidis, head of risk services at technology consultancy NCC Group, which carried out the survey, told silicon.com that the problem of staff -- and especially those in IT who should know better -- being lazy with passwords is leaving companies at risk.

"It is laziness and ignorance causing network security problems. Passwords are of greater importance now that remote access has increased from laptops and PCs with broadband at home," he said.

He said that social-engineering techniques used by hackers to glean passwords that will give them access to corporate networks are on the increase, as IT departments get better at protecting their systems.

"It is increasing as people wake up to other kinds of network vulnerabilities, such as patching systems, and as they narrow down areas of attack, hackers are going to run out of places to exploit and so will go for passwords."

Common bad practice includes shared passwords for departments and obvious popular passwords such as football clubs -- and Vlissidis said those in the boardroom are often the main culprits.

The advice for users is to avoid using for passwords dictionary words that can be cracked by programs, and to use a mixture of numbers and letters. One method is to choose a favourite song or poem and take the first letter from each line of the first verse along with a couple of numbers. When it comes round to change the password, just move on to the next verse.

"As long as you know what that song is, you will never forget the password," said Vlissidis.

Topic: Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

4 comments
Log in or register to join the discussion
  • I would "happily" click through to the page too, but I would give a fake password. This survey assumes that people always fill out online surveys with accurate information. I often give a fake email address, home address, phone number or other information if I deem that it's none of their business but they "require" it for me to finish the form.
    anonymous
  • It is very obvious that IT Security Professionals who fought NSA for so long on encryption have not learned their lesson. Maybe it is time for everyone to read the old book called the Codebreakers. Hackers seem to have read it.
    anonymous
  • i want to be a hacker ,may you can help me i am an electronic engeenering
    anonymous
  • hi
    anonymous