If you invited me to try and crack your password, you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?
Let’s see… here is my top 10 list. I can obtain most of this information much easier than you think, then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I’ll probably get into all of them.
- Your partner, child, or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?)
- The last 4 digits of your social security number.
- 123 or 1234 or 123456.
- “password”
- Your city, or college, football team name.
- Date of birth – yours, your partner’s or your child’s.
- “god”
- “letmein”
- “money”
- “love”
Statistically speaking that should probably cover about 20% of you. But don’t worry. If I didn’t get it yet it will probably only take a few more minutes before I do…
Hackers, and I’m not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)
One of the simplest ways to gain access to your information is through the use of a Brute Force Attack. This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here.
So, how would one use this process to actually breach your personal security? Simple. Follow my logic:
- You probably use the same password for lots of stuff right?
- Some sites you access such as your Bank or work VPN probably have pretty decent security, so I’m not going to attack them.
- However, other sites like the Hallmark e-mail greeting cards site, an online forum you frequent, or an e-commerce site you’ve shopped at might not be as well prepared. So those are the ones I’d work on.
- So, all we have to do now is unleash Brutus, wwwhack, or THC Hydra on their server with instructions to try say 10,000 (or 100,000 – whatever makes you happy) different usernames and passwords as fast as possible.
- Once we’ve got several login+password pairings we can then go back and test them on targeted sites.
- But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)
And how fast could this be done? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker’s computer, and the speed of the hacker’s Internet connection.
Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities – or gets shut down trying.
Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.
| Password Length | All Characters | Only Lowercase |
|---|---|---|
| 3 characters 4 characters 5 characters 6 characters 7 characters 8 characters 9 characters 10 characters 11 characters 12 characters 13 characters 14 characters | 0.86 seconds 1.36 minutes 2.15 hours 8.51 days 2.21 years 2.10 centuries 20 millennia 1,899 millennia 180,365 millennia 17,184,705 millennia 1,627,797,068 millennia 154,640,721,434 millennia | 0.02 seconds .046 seconds 11.9 seconds 5.15 minutes 2.23 hours 2.42 days 2.07 months 4.48 years 1.16 centuries 3.03 millennia 78.7 millennia 2,046 millennia |
Remember, these are just for an average computer, and these assume you aren’t using any word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.
Via One Mans Blog
image: Passwordsafepro
The Indian government said Tuesday that new rules allowing it to access personal information available with Internet companies have inherent checks and balances against misuse.
A research carried out by the Katholieke Universiteit Leuven in Belgium and France’s Institute Eurecom reveals that the private files stored on cloud sites are extremely vulnerable to attakers. After examining 100 file hosting services, the researchers concluded that the unique URIs(Uniform Resource Identifiers) were too predictable and easy to crack.
With the exponential rise in internet usage online transactions are also increasing; and so is the number of online frauds increasing. Thus the companies not only have to prevent online frauds, but also they have to protect the customer privacy.
The catching bug gets downloaded from the external sources such as internet connectivity through hidden files together with downloads; email attachments, instant messaging services and via external drives that are used to carry data.
To protect your computer that makes money over your business is the key focus for one to afford protection. Ecommerce sounds to be the one we choose for comfortable environment that saves times, money and distance to make your business happen with good contacts over people. Dangers that attack one’s computer system starts when we use the same computer for both personal as well as for online business options. As it is found that more number of Home PC’s gets affected with virus attacks.
A majority of internet users use the online banking facility. Accessing accounts to spot fraudulent transactions is now easy, or so it seems. According to a research most of the bank sites have inbuilt flaws which could potentially put valuable customer data into the wrong hands. Though it is the sole decision of the financial institution to determine the level of firewalls employed to safeguard customer information, there are some basic rules which any online bank user should use to protect personal information and finances. Some of these general rules are mentioned as under: Websites starting with URLs such as “https://” are more secure than website URLs starting with “http://”. Especially when using passwords and PIN numbers one should look out for the extra ’s’ in the URL. If the URL is followed by the name of your bank or financial institution, it is a feature that authenticates the genuineness of the site. URLs followed by a ‘host’ name should be considered unsafe. Security indicators such as padlock and lock icons do not guarantee complete security and scammers now-a-days are able to duplicate such icons. Passwords and user Ids should be a combination of upper and lower case letters, numbers and symbols. Also the length of passwords should be more than adequate (8 or more is sufficient). Using common sense and not replying to any email claiming to be from the bank to provide passwords or information to update the accounts. Last but not the least, as far as possible avoid accessing bank accounts through internet cafe, or terminals at airports or railway stations.
Most Web browser software comes pre-installed on your PC’s operating system. The common Web browsers are Internet Explorer, Apple Safari, and Mozilla Firefox. The fact that there are three popular types make it easier for hackers to focus on vulnerabilities and then exploit them with malicious software attacks.
What information is collected?