What to Do About Password Attacks

Password Attacks is the classic way to gain access to a computer system is to find out the password and log in. The growth of the Internet has created unlimited opportunity for these intruders to steal secrets, tinker with Web sites, abscond with credit card information, or just generally make mischief. A Password hackers approach their craft from a number of motivations. Their goals might differ, but they all have the goal of gaining power and control of a computer system or network. Many of their intermediate steps are therefore the same.

Methods for getting passwords

An intruder who gains interactive entry to a system can employ other techniques to build system privileges. Therefore, finding a password is often the first step in cracking a network. Some common password attack methods include:

Looking Outside the Box

A major source of password compromise is the inattentiveness of users. The earliest hackers often obtained passwords by looking for clues in discarded computer printouts. Since that time, operating system vendors thankfully have become more sophisticated about protecting password information. However, a significant percentage of password-compromise cases still results from offline detection. Users tell their passwords to other users or write down their passwords in some easily accessible place.

Trojan Horses

A common tool of computer intruders is the so-called Trojan horse. In general, a Trojan horse is a computer program that purports to do one thing but actually takes other unseen and malicious actions behind the scenes. One early form of the Trojan horse was a fake login screen. The screen looks just like the login screen used for the system, but when the user attempts to log in, the user name and password are captured and stored in some secret location accessible to the intruder.

Dictionary Attack or Guessing

A dictionary attack is an attempt to identify your password by using common words, names of loved ones, pets, birth dates, addresses, and phone numbers. A dictionary attack begins with the dictionary, essentially a database of commonly used words to which the attacker can add custom words or conduct a forensic analysis, in which software scans text documents and adds all words to the dictionary. Some passwords are so simple or poorly formed that the intruder can easily guess them. You would be surprised how many users use a password that is the same as their user name. Some users use a street name, a maiden name, or the name of a child for a password, and some use easily guessable character combinations, such as 123456, abcde, or zzzzzz.

Intercepting

Packet sniffers and other tools that monitor network traffic can easily capture passwords transmitted over the network in clear text (unencrypted) form. Many classic TCP/IP utilities such as Telnet and the Remote Access Utilities or SNMP and Network Management Protocols were designed to transmit passwords in clear text form. Some later versions of these utilities offer password encryption or operate through secure channels. In their basic form, however, the clear text password security of these applications makes them hopelessly ill suited for an open and hostile environment such as the Internet.

Social Engineering Attack

In a social engineering attack, someone attempts to obtain your password, while masquerading as a support technician or other authorized individual who needs your login information, relying on social engineering.

Keyboard Attack

In a keyboard attack, the perpetrator installs keystroke capture software or hardware on the victim's computer.

What to Do About Password Attacks

The best defense against password attacks is eternal vigilance. Networks have employed a number of strategies for reducing the incidence of password compromise. A few of the more obvious guidelines are as follows:

Provide a good, clear password policy for the users in your organization. Warn them about the danger of telling their password to other users, writing their password down on paper, or even storing their password in a file.

Configure all computer systems to support mandatory password policies. Change your passwords at some regular interval. Set a minimum length for passwords (usually 6-8 characters). Don't use the name of your dog or the name your child as a password. In fact, passwords should not consist of any standard word, phrase, or name. All passwords should contain a combination of letters and numbers and at least one non-alphanumeric character that is not the first or last character. To prevent password-guessing attacks, make sure the computer is configured to disable the account after a predefined number of failed logon attempts. Make sure that passwords are never transmitted over public lines in clear text form. If possible, it is better not to transmit clear text passwords on your internal network either, especially on large networks.

Some systems have methods for controlling the number of passwords that each user must remember. Microsoft networks feature a passwords cache and a unified network logon through the domain security system. Unix systems offer Kerberos authentication. These methods are very useful for controlling password proliferation in some environments. The downside of these unified logon methods is that, once an intruder gets one password, he has unlocked access to all the user's resources.

No matter how secure your system is, you won't be safe unless protect your passwords.