Passwords

[brian]

Ouch - looks like Wordpress got a bit glib with their passwords:
http://www.platinax.co.uk/directory/dir/1/106.php

Some basic pointers on passwords here:
http://www.platinax.co.uk/4-security-begins-with-you/

Also, Clook just sent out some basic tips on password protection as well:

- DO NOT use a dictionary word
- DO NOT use family, friend or common names
- DO NOT use sequential letters or numbers (eg abc, 123)
- DO NOT use the same password for multiple logins
- DO use random strings of letters and numbers
- DO use different passwords for different logins
- DO include upper and lower case letters at random

Further info can be seen here: http://www.clook.info/forum/showthread.php?t=266

Another tip is NOT to write passwords down on pieces of paper. If you need to store your passwords somewhere (which is likely if using a different password for many logins) there are many programs available which can store passwords in an encrypted form. See here for resources on this: http://www.download.com/Security-Encryption/3150-2092_4-0.html?tag=nav_dir

[ninikins]

Thankyou for the tips. always handy. I'm fairly bad with passwords...I'm aware of that and really need to change it.

[triumph]

I can't avoid using duplicate passwords. I probably have hundreds or if not thousands of things I have passwords for.. If I had a unique one for everything my brain would explode.

I will vary the level of security depending on how important it is. I have some passwords that are so long and convuluted that even when staring at a piece of paper with them written on it, I can take 20 attempts to enter it correctly.

[ninikins]

do not use a dictionary word? ok it all depends on your dictionary but I would have to have a loooooooooooooong hard think to come up with something that was not in there.

[monaghan]

Originally Posted by ninikins

do not use a dictionary word? ok it all depends on your dictionary but I would have to have a loooooooooooooong hard think to come up with something that was not in there.

Not that difficult, take a random word from your post "think"

To use this as a password, simply "tweak" it a bit to become

th!nk1144

Simple substitution and addition of a numeric string (current time in GMT).

Buy a gardening book and use the same technique on some of the Latin flower names and you'll have a fairly strong password with little effort.

[TWD_Tony]

Just to give you an idea of what a "dictionary attack" looks like... Here is one of the nightly logs from one of our servers...
This is just ONE days worth and it is totally normal (infact this is one of the quiet days! ) Sorry for the long post to follow

Failed logins from these:
aaron/password from 71.147.14.161: 5 Time(s)
abdul/password from 71.147.14.161: 5 Time(s)
abel/password from 71.147.14.161: 5 Time(s)
abigail/password from 71.147.14.161: 5 Time(s)
abraham/password from 71.147.14.161: 5 Time(s)
abram/password from 71.147.14.161: 5 Time(s)
adam/password from 202.121.240.49: 1 Time(s)
adam/password from 71.147.14.161: 5 Time(s)
adan/password from 71.147.14.161: 5 Time(s)
adm/password from 202.121.240.49: 1 Time(s)
admin/password from 202.121.240.49: 16 Time(s)
adolfo/password from 71.147.14.161: 5 Time(s)
adrain/password from 71.147.14.161: 5 Time(s)
adrian/password from 71.147.14.161: 5 Time(s)
adriana/password from 71.147.14.161: 5 Time(s)
adrienne/password from 71.147.14.161: 5 Time(s)
agustin/password from 71.147.14.161: 5 Time(s)
ahmad/password from 71.147.14.161: 5 Time(s)
aimee/password from 71.147.14.161: 5 Time(s)
aisha/password from 71.147.14.161: 5 Time(s)
al/password from 71.147.14.161: 5 Time(s)
alan/password from 202.121.240.49: 1 Time(s)
alan/password from 71.147.14.161: 5 Time(s)
albert/password from 71.147.14.161: 5 Time(s)
alberto/password from 71.147.14.161: 5 Time(s)
aldo/password from 71.147.14.161: 5 Time(s)
alec/password from 71.147.14.161: 5 Time(s)
alejandro/password from 71.147.14.161: 5 Time(s)
alex/password from 202.121.240.49: 1 Time(s)
alex/password from 71.147.14.161: 5 Time(s)
alexander/password from 71.147.14.161: 5 Time(s)
alexandra/password from 71.147.14.161: 5 Time(s)
alexis/password from 71.147.14.161: 5 Time(s)
alfonso/password from 71.147.14.161: 5 Time(s)
alfonzo/password from 71.147.14.161: 5 Time(s)
alfred/password from 71.147.14.161: 5 Time(s)
alfredo/password from 71.147.14.161: 5 Time(s)
ali/password from 71.147.14.161: 5 Time(s)
alice/password from 71.147.14.161: 5 Time(s)
alicia/password from 71.147.14.161: 5 Time(s)
alisa/password from 71.147.14.161: 5 Time(s)
alisha/password from 71.147.14.161: 5 Time(s)
alison/password from 71.147.14.161: 4 Time(s)
alissa/password from 71.147.14.161: 4 Time(s)
allan/password from 71.147.14.161: 4 Time(s)
allen/password from 71.147.14.161: 4 Time(s)
allison/password from 71.147.14.161: 4 Time(s)
allyson/password from 71.147.14.161: 4 Time(s)
alma/password from 71.147.14.161: 4 Time(s)
alonzo/password from 71.147.14.161: 4 Time(s)
alphonso/password from 71.147.14.161: 4 Time(s)
alton/password from 71.147.14.161: 4 Time(s)
alvaro/password from 71.147.14.161: 4 Time(s)
alvin/password from 71.147.14.161: 4 Time(s)
amanda/password from 71.147.14.161: 4 Time(s)
amber/password from 71.147.14.161: 4 Time(s)
amelia/password from 71.147.14.161: 4 Time(s)
amie/password from 71.147.14.161: 4 Time(s)
amos/password from 71.147.14.161: 4 Time(s)
amy/password from 71.147.14.161: 4 Time(s)
ana/password from 71.147.14.161: 4 Time(s)
anderson/password from 71.147.14.161: 4 Time(s)
andra/password from 71.147.14.161: 4 Time(s)
andre/password from 71.147.14.161: 4 Time(s)
andrea/password from 71.147.14.161: 4 Time(s)
andreas/password from 71.147.14.161: 4 Time(s)
andres/password from 71.147.14.161: 4 Time(s)
andrew/password from 71.147.14.161: 4 Time(s)
andy/password from 71.147.14.161: 4 Time(s)
angel/password from 202.121.240.49: 1 Time(s)
angel/password from 71.147.14.161: 4 Time(s)
angela/password from 71.147.14.161: 4 Time(s)
angelia/password from 71.147.14.161: 4 Time(s)
angelica/password from 71.147.14.161: 4 Time(s)
angelina/password from 71.147.14.161: 4 Time(s)
angelique/password from 71.147.14.161: 3 Time(s)
angelo/password from 71.147.14.161: 3 Time(s)
angie/password from 71.147.14.161: 3 Time(s)
anita/password from 71.147.14.161: 3 Time(s)
ann/password from 71.147.14.161: 3 Time(s)
anna/password from 71.147.14.161: 3 Time(s)
anne/password from 71.147.14.161: 3 Time(s)
annette/password from 71.147.14.161: 3 Time(s)
annie/password from 71.147.14.161: 3 Time(s)
anthony/password from 71.147.14.161: 3 Time(s)
antione/password from 71.147.14.161: 3 Time(s)
antoine/password from 71.147.14.161: 3 Time(s)
antoinette/password from 71.147.14.161: 3 Time(s)
anton/password from 71.147.14.161: 3 Time(s)
antonia/password from 71.147.14.161: 3 Time(s)
antonio/password from 71.147.14.161: 3 Time(s)
antony/password from 71.147.14.161: 3 Time(s)
antwan/password from 71.147.14.161: 3 Time(s)
antwon/password from 71.147.14.161: 3 Time(s)
apache/password from 202.121.240.49: 2 Time(s)
april/password from 71.147.14.161: 3 Time(s)
archie/password from 71.147.14.161: 3 Time(s)
ari/password from 71.147.14.161: 3 Time(s)
aric/password from 71.147.14.161: 3 Time(s)
ariel/password from 71.147.14.161: 3 Time(s)
arlene/password from 71.147.14.161: 3 Time(s)
armando/password from 71.147.14.161: 3 Time(s)
arnold/password from 71.147.14.161: 3 Time(s)
arnulfo/password from 71.147.14.161: 3 Time(s)
aron/password from 202.121.240.49: 1 Time(s)
aron/password from 71.147.14.161: 3 Time(s)
arron/password from 71.147.14.161: 3 Time(s)
arthur/password from 71.147.14.161: 3 Time(s)
arturo/password from 71.147.14.161: 3 Time(s)
ashley/password from 71.147.14.161: 3 Time(s)
aubrey/password from 71.147.14.161: 3 Time(s)
audra/password from 71.147.14.161: 3 Time(s)
audrey/password from 71.147.14.161: 3 Time(s)
august/password from 71.147.14.161: 3 Time(s)
augustine/password from 71.147.14.161: 3 Time(s)
aurelio/password from 71.147.14.161: 3 Time(s)
austin/password from 71.147.14.161: 3 Time(s)
autumn/password from 71.147.14.161: 3 Time(s)
avery/password from 71.147.14.161: 3 Time(s)
backup/password from 202.121.240.49: 1 Time(s)
barbara/password from 71.147.14.161: 3 Time(s)
barney/password from 71.147.14.161: 3 Time(s)
baron/password from 71.147.14.161: 3 Time(s)
barrett/password from 71.147.14.161: 3 Time(s)
barry/password from 71.147.14.161: 3 Time(s)
bart/password from 71.147.14.161: 3 Time(s)
barton/password from 71.147.14.161: 3 Time(s)
beau/password from 71.147.14.161: 3 Time(s)
becky/password from 71.147.14.161: 3 Time(s)
belinda/password from 71.147.14.161: 3 Time(s)
ben/password from 71.147.14.161: 3 Time(s)
benito/password from 71.147.14.161: 3 Time(s)
benjamin/password from 71.147.14.161: 3 Time(s)
bennett/password from 71.147.14.161: 3 Time(s)
bennie/password from 71.147.14.161: 3 Time(s)
benny/password from 71.147.14.161: 3 Time(s)
bernadette/password from 71.147.14.161: 3 Time(s)
bernard/password from 71.147.14.161: 3 Time(s)
bernardo/password from 71.147.14.161: 3 Time(s)
bert/password from 71.147.14.161: 3 Time(s)
beth/password from 71.147.14.161: 3 Time(s)
bethany/password from 71.147.14.161: 3 Time(s)
betsy/password from 71.147.14.161: 3 Time(s)
betty/password from 71.147.14.161: 3 Time(s)
beverly/password from 71.147.14.161: 3 Time(s)
bill/password from 71.147.14.161: 3 Time(s)
billie/password from 71.147.14.161: 3 Time(s)
billy/password from 71.147.14.161: 3 Time(s)
blaine/password from 71.147.14.161: 3 Time(s)
blair/password from 71.147.14.161: 3 Time(s)
blake/password from 71.147.14.161: 3 Time(s)
blanca/password from 71.147.14.161: 3 Time(s)
bob/password from 71.147.14.161: 3 Time(s)
bobbi/password from 71.147.14.161: 3 Time(s)
bobbie/password from 71.147.14.161: 3 Time(s)
bobby/password from 71.147.14.161: 3 Time(s)

[TWD_Tony]

Part 2...

bonnie/password from 71.147.14.161: 3 Time(s)
boyd/password from 71.147.14.161: 3 Time(s)
brad/password from 71.147.14.161: 3 Time(s)
braden/password from 71.147.14.161: 3 Time(s)
bradford/password from 71.147.14.161: 3 Time(s)
bradley/password from 71.147.14.161: 3 Time(s)
bradly/password from 71.147.14.161: 3 Time(s)
brady/password from 71.147.14.161: 3 Time(s)
brain/password from 71.147.14.161: 3 Time(s)
branden/password from 71.147.14.161: 3 Time(s)
brandi/password from 71.147.14.161: 3 Time(s)
brandie/password from 71.147.14.161: 3 Time(s)
brandon/password from 71.147.14.161: 3 Time(s)
brandy/password from 71.147.14.161: 3 Time(s)
brannon/password from 71.147.14.161: 3 Time(s)
brant/password from 71.147.14.161: 3 Time(s)
brenda/password from 71.147.14.161: 3 Time(s)
brendan/password from 71.147.14.161: 3 Time(s)
brendon/password from 71.147.14.161: 3 Time(s)
brennan/password from 71.147.14.161: 3 Time(s)
brent/password from 71.147.14.161: 3 Time(s)
brenton/password from 71.147.14.161: 3 Time(s)
bret/password from 71.147.14.161: 3 Time(s)
brett/password from 202.121.240.49: 1 Time(s)
brett/password from 71.147.14.161: 3 Time(s)
brian/password from 71.147.14.161: 3 Time(s)
brice/password from 71.147.14.161: 3 Time(s)
bridget/password from 71.147.14.161: 3 Time(s)
bridgette/password from 71.147.14.161: 3 Time(s)
brien/password from 71.147.14.161: 3 Time(s)
britt/password from 71.147.14.161: 2 Time(s)
brock/password from 71.147.14.161: 2 Time(s)
broderick/password from 71.147.14.161: 2 Time(s)
bronson/password from 71.147.14.161: 2 Time(s)
brook/password from 71.147.14.161: 2 Time(s)
brooke/password from 71.147.14.161: 2 Time(s)
brooks/password from 71.147.14.161: 2 Time(s)
bruce/password from 71.147.14.161: 2 Time(s)
bryan/password from 71.147.14.161: 2 Time(s)
bryant/password from 71.147.14.161: 2 Time(s)
bryce/password from 71.147.14.161: 2 Time(s)
bryon/password from 71.147.14.161: 2 Time(s)
buck/password from 71.147.14.161: 2 Time(s)
buddy/password from 71.147.14.161: 2 Time(s)
burton/password from 71.147.14.161: 2 Time(s)
byron/password from 71.147.14.161: 2 Time(s)
cale/password from 71.147.14.161: 2 Time(s)
caleb/password from 71.147.14.161: 2 Time(s)
calvin/password from 71.147.14.161: 2 Time(s)
cameron/password from 71.147.14.161: 2 Time(s)
camille/password from 71.147.14.161: 2 Time(s)
candace/password from 71.147.14.161: 2 Time(s)
candice/password from 71.147.14.161: 2 Time(s)
candy/password from 71.147.14.161: 2 Time(s)
cara/password from 71.147.14.161: 2 Time(s)
carey/password from 71.147.14.161: 2 Time(s)
cari/password from 71.147.14.161: 2 Time(s)
carl/password from 71.147.14.161: 2 Time(s)
carla/password from 71.147.14.161: 2 Time(s)
carlo/password from 71.147.14.161: 2 Time(s)
carlos/password from 71.147.14.161: 2 Time(s)
carlton/password from 71.147.14.161: 2 Time(s)
carmelo/password from 71.147.14.161: 2 Time(s)
carmen/password from 71.147.14.161: 2 Time(s)
carol/password from 71.147.14.161: 2 Time(s)
caroline/password from 71.147.14.161: 2 Time(s)
carolyn/password from 71.147.14.161: 2 Time(s)
carrie/password from 71.147.14.161: 2 Time(s)
carroll/password from 71.147.14.161: 2 Time(s)
carson/password from 71.147.14.161: 2 Time(s)
carter/password from 71.147.14.161: 2 Time(s)
cary/password from 71.147.14.161: 2 Time(s)
casey/password from 71.147.14.161: 2 Time(s)
cassandra/password from 71.147.14.161: 2 Time(s)
cassie/password from 71.147.14.161: 2 Time(s)
catherine/password from 71.147.14.161: 2 Time(s)
cathy/password from 71.147.14.161: 2 Time(s)
cecil/password from 71.147.14.161: 2 Time(s)
cecilia/password from 71.147.14.161: 2 Time(s)
cedric/password from 71.147.14.161: 2 Time(s)
cedrick/password from 71.147.14.161: 2 Time(s)
celeste/password from 71.147.14.161: 2 Time(s)
cesar/password from 71.147.14.161: 2 Time(s)
chad/password from 71.147.14.161: 2 Time(s)
chadd/password from 71.147.14.161: 2 Time(s)
chadrick/password from 71.147.14.161: 2 Time(s)
chadwick/password from 71.147.14.161: 2 Time(s)
chaim/password from 71.147.14.161: 2 Time(s)
chance/password from 71.147.14.161: 2 Time(s)
chandra/password from 71.147.14.161: 2 Time(s)
charity/password from 71.147.14.161: 2 Time(s)
charlene/password from 71.147.14.161: 2 Time(s)
charles/password from 71.147.14.161: 2 Time(s)
charley/password from 71.147.14.161: 2 Time(s)
charlie/password from 71.147.14.161: 2 Time(s)
charlotte/password from 71.147.14.161: 2 Time(s)
chase/password from 71.147.14.161: 2 Time(s)
chasity/password from 71.147.14.161: 2 Time(s)
chastity/password from 71.147.14.161: 2 Time(s)
chauncey/password from 71.147.14.161: 2 Time(s)
che/password from 71.147.14.161: 2 Time(s)
cheri/password from 71.147.14.161: 2 Time(s)
cherie/password from 71.147.14.161: 2 Time(s)
cheryl/password from 71.147.14.161: 2 Time(s)
chester/password from 71.147.14.161: 2 Time(s)
chet/password from 71.147.14.161: 2 Time(s)
chris/password from 71.147.14.161: 2 Time(s)
christa/password from 71.147.14.161: 2 Time(s)
christi/password from 71.147.14.161: 2 Time(s)
christian/password from 71.147.14.161: 2 Time(s)
christina/password from 71.147.14.161: 2 Time(s)
christine/password from 71.147.14.161: 2 Time(s)
christoper/password from 71.147.14.161: 2 Time(s)
christopher/password from 71.147.14.161: 2 Time(s)
christy/password from 71.147.14.161: 2 Time(s)
chrystal/password from 71.147.14.161: 1 Time(s)
chuck/password from 71.147.14.161: 1 Time(s)
cindy/password from 71.147.14.161: 1 Time(s)
claire/password from 71.147.14.161: 1 Time(s)
clarence/password from 71.147.14.161: 1 Time(s)
clark/password from 71.147.14.161: 1 Time(s)
claude/password from 71.147.14.161: 1 Time(s)
claudia/password from 71.147.14.161: 1 Time(s)
clay/password from 71.147.14.161: 1 Time(s)
clayton/password from 71.147.14.161: 1 Time(s)
cleveland/password from 71.147.14.161: 1 Time(s)
cliff/password from 71.147.14.161: 1 Time(s)
clifford/password from 71.147.14.161: 1 Time(s)
clifton/password from 71.147.14.161: 1 Time(s)
clint/password from 71.147.14.161: 1 Time(s)
clinton/password from 71.147.14.161: 1 Time(s)
clyde/password from 71.147.14.161: 1 Time(s)
coby/password from 71.147.14.161: 1 Time(s)
cody/password from 71.147.14.161: 1 Time(s)
colby/password from 71.147.14.161: 1 Time(s)
cole/password from 71.147.14.161: 1 Time(s)
colin/password from 71.147.14.161: 1 Time(s)
colleen/password from 71.147.14.161: 1 Time(s)
collin/password from 71.147.14.161: 1 Time(s)
connie/password from 71.147.14.161: 1 Time(s)
conrad/password from 71.147.14.161: 1 Time(s)
danny/password from 202.121.240.49: 1 Time(s)
data/password from 202.121.240.49: 1 Time(s)
david/password from 202.121.240.49: 1 Time(s)
ftp/password from 202.121.240.49: 2 Time(s)
games/password from 202.121.240.49: 1 Time(s)
george/password from 202.121.240.49: 1 Time(s)
guest/password from 202.121.240.49: 6 Time(s)
guset/password from 218.26.32.246: 5 Time(s)
http/password from 202.121.240.49: 1 Time(s)
httpd/password from 202.121.240.49: 1 Time(s)
ident/password from 202.121.240.49: 1 Time(s)
info/password from 202.121.240.49: 4 Time(s)
john/password from 202.121.240.49: 1 Time(s)
library/password from 202.121.240.49: 3 Time(s)
linux/password from 202.121.240.49: 3 Time(s)
mail/password from 202.121.240.49: 1 Time(s)
master/password from 202.121.240.49: 2 Time(s)
michael/password from 202.121.240.49: 1 Time(s)
mike/password from 202.121.240.49: 1 Time(s)
mysql/password from 202.121.240.49: 4 Time(s)
news/password from 202.121.240.49: 1 Time(s)
nobody/password from 202.121.240.49: 1 Time(s)
oracle/password from 202.121.240.49: 3 Time(s)
paul/password from 202.121.240.49: 1 Time(s)
pgsql/password from 202.121.240.49: 2 Time(s)
resin/password from 202.121.240.49: 1 Time(s)
richard/password from 202.121.240.49: 1 Time(s)
root/password from 202.121.240.49: 37 Time(s)
root/password from 210.21.24.13: 4 Time(s)
root/password from 218.26.32.246: 439 Time(s)
sales/password from 202.121.240.49: 1 Time(s)
sharon/password from 202.121.240.49: 1 Time(s)
shell/password from 202.121.240.49: 3 Time(s)
shop/password from 202.121.240.49: 1 Time(s)
stephen/password from 202.121.240.49: 1 Time(s)
test/password from 202.121.240.49: 11 Time(s)
test/password from 220.193.2.37: 5 Time(s)
unix/password from 202.121.240.49: 3 Time(s)
user/password from 202.121.240.49: 2 Time(s)
username/password from 202.121.240.49: 2 Time(s)
web/password from 202.121.240.49: 1 Time(s)
webadmin/password from 202.121.240.49: 2 Time(s)
webmaster/password from 202.121.240.49: 5 Time(s)
www-data/password from 202.121.240.49: 1 Time(s)
www/password from 202.121.240.49: 1 Time(s)
wwwrun/password from 202.121.240.49: 1 Time(s)

This is just a small attack using common names - sometimes we get reports 10 times the size of this one!

[monaghan]

Tony,

I presume you've tried a tool like bfd ?

We found that although it didn't stop everything, it did kick in and ban the IP part way through the attack.

[TWD_Tony]

Yes - we run BFD on the majority of our servers - this one though is a dedicated box and the client wanted BFD disabled as it conflicted with a custom script they were running.

[monaghan]

Guessed you would run BFD (or a similiar type of tool).

Hope they are paying well for the increased admin time taken to read the logs

[triumph]

Tony are they just trying all those names with the generic password password? That is what it looks like.. I wonder what percentage of people use that for their password.

[monaghan]

It's probably 1 of many off-the-shelf script kiddie tools which was built from password lists from hacked servers. Nothing new, the place I worked at about 15 years ago did exactly the same thing on their internal systems to enforce security. Anything that could be guessed was disabled until the user rang the helpdesk

[ninikins]

Wow, just seen that list and it's pretty impressively thorough. I see the importance of covering all your bases with passwords now.

[Hoosierhunter]

I already do a lot of the things recommended, but I had been looking for a list like this for a family member who is not internet savvy.

[webme]

They must have used some hacking software. Have you used Roboform for your passwords?

[penguinmama]

What was that first link supposed to link to? I just got a placeholder page.

[JohnR]

So, in moral, you basically want to use a word of "gibberish" if you will to prevent crackers from getting your passwords.

[mtajim]

I do prefer using password that i can remember and since my main langauage is not english so i choose words from my main langauage which is hard for crackers to guess

[aquariancore]

Invent the words have a little fun.