New Year, New Data, Same Mistakes: Passwords

Like a late-arriving Christmas, one of the gifts of the new year is the release of SpiderLabs' annual white paper, the Global Security Report. As a supplement to this year's report, we're going to share some highlights of the corporate password study section. This section is always near and dear to our hearts as passwords play vital roles in just about every aspect of security, not to mention are a fascinating insight into the human mind.

"Why do this study year after year?", you might ask. "Aren't passwords dead? I totally read that in some magazine article!"

If the reader remembers nothing else from the GSR password study, remember this: we can discuss passwords until the end of time (or the next password cracking job finishes), but nothing is a substitute for proper system design. Your super fancy complex 128 character password is meaningless when your app stores it in (for example) plaintext/base64/etc, and that is never going to change. Leaving this important consideration out and blaming security breaches on passwords alone (as opposed to poor password reset procedure, aggressive social engineering, absentee security monitoring, etc) is quite simply misleading and possibly dishonest to the reader.

Even with a properly designed system, it's also important to remember that security will forever be a moving target. For example, as flawed as LanMan hash computation is, it still would have taken you a while to recover a password in 1993 with the hardware of the time. Now? That same hash can be recovered in 30 seconds on a standard issue desktop with rainbow tables. Even today's NT hashes can be picked off in a relatively short amount of time, length depending. It's even conceivable that someone might discover how to factor insanely large primes in record time, thus turning RSA on its head. Nobody knows what the future brings, which is why the underlying crypto that protects systems (and the passwords within) must be improved as well...

...but wait, we were here to bring you some password study results, weren't we? Ahem…

The good:

• More source data! For this year's study we were able to utilize over 3 million Active Directory passwords across multiple users and services as well as histories.

• The underlying crypto has improved a bit – more NT and fewer LM passwords across the data as a whole. This is likely more due to AD upgrades to 2k8, though it's hopeful that folks are making the switch to store passwords as NT-only.

And…that's about it. A bit sparse, huh?

The Bad:

• Unfortunately, when comparing this year's study to last year's, it looks shockingly similar in terms of the "faults" we see with user password selection. Even though we often assume that users will consider stronger password selections than say a password for their social media account, we're finding that it simply isn't the case.

• We're also finding that users are still adhering to the "minimum amount of flair" when it comes to their password selection. Meaning, if administrators are enforcing password complexity policies, often times users are basing their password sections based on the absolute bare minimum requirements.

The Ugly:

• Last year's winner of "most common password" of Password1 has been dethroned. Who is the new champion? The answer will depress you! Download the report!
• Special characters are becoming more and more scarce in password use. Granted this won't matter nearly as much as length, but would it kill you to throw in a #, !, or ^ in there?
• If you work for the sprocket company and you make widgets, putting "widget" as part of your password is a terrible idea. Yes, even if it's the default for new users.

The takeaway

Provided you don't fall for one of the many traps (password incrementing, keyword use), password length is still your single best defense. We're going to keep repeating this until we're blue in the face. Maybe one day you (or your users) will listen.