Using the password 'admin123' wasn't as bad as sharing it on Slack

Welcome back to PWNED, the column where we celebrate the people who’ve taught us how not to secure a server. If you’ve ever tied your own shoelaces together, then tripped over them, or attempted to dive into a swimming pool but hit your head on the diving board, we’ll be talking about your cyber equivalent. This week’s …

[DJV]

I'm surprised...

...they didn't use 12345!

[Anonymous Coward]

Re: I'm surprised...

According to Shein, this change reduced unauthorized access attempts by a full 60 percent in a period of just three months.

75% of statistics are made up, and then there's meaningless drivel like this. Internal procedural changes don't have any bearing on the number of unauthorized access attempts made. If you were misquoted, contact the author, otherwise, you should probably resign and go to work for McDonalds as a cashier.

[EnviableOne]

Re: I'm surprised...

thought it was 88.62% of all statistics. They are still one of Benjamin Disraeli's or Mark Twain's three classes: Lies, Damned Lies, and Statistics.

As a trained number wrangler (aka statistician) I can take any set of numbers, and with the correct sample and test, make it say anything you want

[The Travelling Dangleberries]

Re: I'm surprised...

I use a version ending with a fourth option ", and Diplomatic statements".

[Pete Sdev]

Re: I'm surprised...

Ha, beat me to it!

[KarMann]

Re: I'm surprised...

True story: It recently came to my attention that there is a Spaceballs sequel on its way (disappointingly not actually subtitled The Search for More Money). I went to check for a release date, and saw 23 April. Went looking for UK release date, didn't see anything specifically UK; went to cinema sites, didn't see any listings of it for this week. Was starting to worry (for a few days even!) that it might not be getting a UK release. Finally went back to the original source, and this time, finally noticed where it says '2027' right after the '23 April' bit. Boy, was my face red!

[Jamesit]

Re: I'm surprised...

It's coming out next April. https://en.wikipedia.org/wiki/Spaceballs:_The_New_One

[Bill Gray]

Re: I'm surprised...

At the very least, they should have remembered that each extra character adds about six bits of entropy (depending on how restrictive the system is about what characters it will accept.)

Had they gone with 123456789, they'd have been fine.

[Claptrap314]

Re: I'm surprised...

That's #4 on this list.

[Throg]

Re: I'm surprised...

…except of course dictionary attacks are often the first choice for bad actors as they’re quicker and often effective. Hence you should never use “correcthorsebatterystaple”.

[David Newall]

Re: I'm surprised...

Nonsense. NSA recommends using phrases. They are easy to communicate and remember, thus there's no motivation to pin them to a slack board.

With 170,000 English words in common use, correcthorsebatterystaple is one password out of 8.3521E20, and that's before considering spaces, punctuation and capitalisation.

It's much better than Vu+}?8wV?5TPy2cLBqc= which absolutely will be written on a post-it note and stuck to a screen, as well as be sent by email because you'll never be able to verbally communicate it.

[Throg]

Re: I'm surprised...

Phrases that aren’t so common that they’re likely to be found in cracking dictionaries.

(FTFY)

[Christoph]

Re: I'm surprised...

It's much better than Vu+}?8wV?5TPy2cLBqc= which absolutely will be written on a post-it note and stuck to a screen, as well as be sent by email because you'll never be able to verbally communicate it.

You don't write it, send it, or verbally communicate it. You paste it in from your password manager program.

[Sudosu]

Re: I'm surprised...

My password goes to 11.

[Yet Another Anonymous coward]

Re: I'm surprised...

>..they didn't use 12345!

Pretty secure, but a bit inconvenient. It's approx 45650 digits long so will take a while to enter

[Anonymous Coward]

I've seen admin as null more than a few times.

I've seen large corporation with very expensive firewalls set to allow all inbound.

I've seen internet connected machines missing patches for the last 5yr

Really I've been reading about the lastest security measure that everyone ahould have in place but we're still having to ask IT 'pros' not to do the most stupid things. Or to ask execs not to force IT pros to do stupid things.

I wonder when we're just going to accept humans are not secure and built the system around that? I doubt I'll ever see it and I'm 20yr from retiring.

[AtomicDog]

It all boils down to the lack of engineering principles.in technology, once again... Poorly qualified people who don't know what they don't know half of the time, no oversight, no need for CPD, no legal leg to stand on if a beancounter tries to overrule you, no certifying body to hold your feet to the flames if you screw up, and tech bros shovelling new flavours of shit in your general direction on a daily basis.

The stable door's still open, the horse has long bolted, and now corporations can make massive screw-ups that seriously affects people's lives, and at best get hit with a slap on the wrist level of fine, with no true individual accountability at either a technical or board level.

[Bebu sa Ware]

"new flavours of shit"

Having successfully managed to avoid any experience of the old flavours the idea that anyone is able to discern the existence of new flavours strikes me as rather… unsavoury err… perhaps unsanitary.

I am of course keeping my tongue firmly in cheek behind my own teeth and certainly not between anyone else's cheeks.

I just recalled that decade or so ago when the world (re)discovered the gut biome some nutcase influencers and fellow travellers were swallowing shit smoothies in order to revitalise their gut flora. Stupidity is unbounded.

[tiggity]

Re: "new flavours of shit"

@Bebu sa Ware

Faecal transplants have been useful occasionally e.g.

Auto Brewery treatment

[doublelayer]

"I wonder when we're just going to accept humans are not secure and built the system around that?"

Probably as soon as one of the people who say things like this explains how you can do that. The suggestion, if interpreted literally, means that you build a computer such that a person, no matter how stupid, cannot possibly do anything dangerous but can still do the things they need done. A person with a little experience of basically anything will notice this as the way that nothing works.

We can implement layer after layer of safeguards. We can make it possible for admins to limit what users can execute. We can implement detailed authentication mechanisms where everyone logs in to a separate account with multiple factors and the accounts are limited very specifically to the activities they are granted. None of that helps if the people who are supposed to set those requirements deliberately choose to not configure the former and create one account with all privileges within the latter. They still sometimes choose to do this because properly setting very granular roles for a user takes more time and causes delays when a user first finds another one they need but don't have, so the insecure option is the easier and faster one. If you can do it better, please do so. If you can tell us how to do it better, I'm eager to hear, but expect that I'm going to question the approach heavily because most suggestions along this line I've seen so far are simplistic and weak if they work at all.

[Excused Boots]

I’m sure I have mentioned this before, but an ex-client of mine asked that we disable all Windows updates, because they sometimes broke their SAP installation. To be fair SAP can break if you look at it wrongly, but still. Despite telling them this is not a good policy (in fact I think I literally said to their head of IT that this is a fucking stupid idea); but they insisted, so....!

Now a little later, they decided to move to another IT support company, and that’s fine, no hard feelings, you win some and lose some. Two months later they were hit with a massive ransomware attack - using an exploit that had been mitigated six months before by a Windows update, which, of course hadn’t been applied*

I found out afterwards from a friend that worked there, that the company was that close to going out of business. Anyhow being a nice person, I advised them what to do, and even helped with recovery - for a fee of course.

And then the legal threats started, how was this allowed to happen....etc? I did point out that at the time, we weren’t doing their IT support, and eventually dug out the old emails from them instructing us to do it, my replies telling them that this is not a good idea because it leaves you vulnerable, and their response from senior management saying ‘yes we know, but just do it’! Copies of which I sent to them, along with a final message of ‘fine, see you in Court’! Never heard anything further.

Although it shouldn’t be necessary, when a client is doing something and/or insisting on an action which you know is really fucking stupid, then CYA applies!

* Yes, yes, I promise you I know; stage the update rollout, test it with a small subset of users, get sign-off that the update has not broken anything, and then proceed with a wider roll-out. Which costs money and time, but is the only way to reduce issues and downtime.

Meanwhile, back in the real world.......

[Bebu sa Ware]

they didn't use 12345!

12345! (factorial) would have over 45 thousand digits

The calculator at https://www.calculatorsoup.com/calculators/discretemathematics/factorials.php didn't chicken out :)

Pretty safe - try entering that.

Oddly no one ever uses 1,2,3,4,5 or even counting from 0.

Even the evil of multiple uid==0 accounts with distinct passwords would be a lesser evil than sharing a single root password.

I think, although from ignorance, Windows always permitted Administrator privileges to be assigned to multiple user accounts.

[KarMann]

Re: they didn't use 12345!

Oddly no one ever uses 1,2,3,4,5 or even counting from 0.

Well, crap. Now I have to go change my account passwords. At least my luggage doesn't have commas available.

[David Hicklin]

Re: they didn't use 12345!

> Oddly no one ever uses 1,2,3,4,5 or even counting from 0.

It probably breaks some arcane rule about repeating every other character.

[An_Old_Dog]

Security Measures

"role-based access": Hell, yeah!

"credential rotation": I've never seen a logical explanation of why (other than after a potential credential exposure) this is done.

If you have a good, complex passPHRASE, the likelihood of that being brute-forced is the same as the likelihood of an equally-good passPHRASE being brute-forced. Or rainbow-tabled, or whatever.

[John Robson]

Re: Security Measures

There is no good reason to do this without at least some evidence of attempted intrusion (or access from "unlikely" networks).

And if you have a decent password along with a sane second factor (not sms) then it really should only be "attempted intrusion" which flags a cycle.

[Claptrap314]

Re: Security Measures

As NIST recommends starting 2017.

[Number6]

Re: Security Measures

Rotation is annoying but there is some justification. Correct security paranoia is to assume that every password is compromised even if it hasn't been (ab)used yet. By changing them out you lessen the window of opportunity for any given password to cause problems. Of course, the quick "fix" for users is to keep the same password and add 1 to the number on the end.

Lateral random thought on the brute-force approach. Given that the usual password authentication method is that you type in the password and at some point it gets converted into a cryptographic hash which is then compared to the stored value, what happens if you happen to have managed to generate a 20-character random string that just happens to have a hash collision with "123456"? Apart from recommending purchase of a lottery ticket. Probably not likely with modern hash functions, but there is always the chance.

[MiguelC]

“Vu+}?8wV?5TPy2cLBqc=,”?

Why, that's my luggage combination!

[John Robson]

Re: “Vu+}?8wV?5TPy2cLBqc=,”?

Mine starts with correct horse :p

[Excused Boots]

Re: “Vu+}?8wV?5TPy2cLBqc=,”?

I see that 'Correct Horse Battery Staple’ with or without spaces, doesn’t make the top 200. I do wonder how many systems worldwide are secured by it!

[Throg]

Re: “Vu+}?8wV?5TPy2cLBqc=,”?

Correcthorsebatterystaple is now found in most cracking dictionaries…

[James Wilson]

Re: “Vu+}?8wV?5TPy2cLBqc=,”?

I have an account somewhere (I forget where, PasswordSafe will remind me) where the password is something along the lines of RightDonkeyArtilleryPaperclip.

[B33Dub]

Really?

That wasn't a terrible ad for Nordic, but maybe next time we try to write a story for the advanced IT crowd, we do a something that isn't so insultingly basic. Like really? A weak password lecture mate? That's your story interesting story this week?

[Excused Boots]

Re: Really?

I do get what you are saying and I strongly suspect that all of us on here need no lectures on password security. But the issue is end users, the clients we deal with.

As a former colleague of mine used to say, many companies seem to have a motto of ‘give me convenience, or give me death’. My particular favourite are the companies that I have managed to persuade to enforce 2FA and longer (not necessarily complex) passwords. This tends to last about three days, until we are instructed to remove this requirement from the C-suite brigade as they are far too important, no sorry, busy to have to deal with this inconvenience. So who will the potential hackers target, will it be the CEO or the car-park attendant, whose account is forced to be MFA’d up the wazoo?

At least this gives an example, that we can quote when asked, ‘why should we....’, and provide the links to the story. Even though this company spent £$x,000 on tech, the thieves simply entered through the open window! It’s the same old story of companies trying to impose a tech solution on what is actually an HR one!

[johnB]

Convieence or death ?

Outfit I used to work for (large UK government department, handling sensitive personal information) had a very locked down system: access to individual "customer" records only from nominated terminal in specified location & only to staff authorised to use said terminal. Repayments had additional layers added.

Then "efficiency" & "flexibility" took over. Now any staff, anywhere, can see anybodys record. And staff are now being sacked by the score for unauthorised accesses.

[Claptrap314]

WHAT DECADE IS THIS?

"Forced credential rotation"? REALLY? Read NISTs 2017 recommendation before telling us what best practice is.

[IGotOut]

Re: WHAT DECADE IS THIS?

Yeah, it it means it becomes

Password1

Password2

Password3

Etc

[Throg]

Re: WHAT DECADE IS THIS?

…or even worse, people writing their passwords down on post-it notes under their desks.

[ITS Retired]

Re: WHAT DECADE IS THIS?

Do you mean, Under the Keyboard?

I once knew a person that wrote all her passwords on the bezel of her tan CRT monitor in pencil so she could change them as necessary.

[James O'Shea]

Re: WHAT DECADE IS THIS?

No. It becomes Pass#00$Word, Pass#01$Word, Pass#03$Word, as certain people require not merely changing passwords on a regular basis (every 90 days is one example I'm thinking of) but also require 'complexity', as in at least two capital letters, at least two symbols (which at the site I'm thinking of must be selected from an 'approved' list, limited to @, #, $, and *. I wish I were making this up.) and at least two numbers, and must be a minimum of 12 characters in length. I told the boys running the site that they were inviting passwords as noted above. They replied that they knew, that they use similar passwords, and that their hands are tied, this is a Directive From Above. Someone senior once read a short article on security and now has fixed ideas on the subject and cannot be moved.

[Anonymous Coward]

Doesn't anyone audit passwords anymore?

This incident also reflects very poorly on IT.

That shit password should have been flagged in an audit long before it was shared.

[Throg]

Re: Doesn't anyone audit passwords anymore?

If your password repository can be audited I think you probably have a bigger problem?

Although I suppose you could try a dictionary attack on it. The cost / benefit depends how many users you have and how big your dictionary is though.

[Anonymous Coward]

Re: Doesn't anyone audit passwords anymore?

Admins always have access to the hashes. If we can crack them, then so can a threat actor following a cybersecurity incident.

Many applications did and still do store unsalted, non-hardened hashes. Audit efforts on those scale basically without regard to total number.

[Anonymous Coward]

I have survived so far with 123457

[David Newall]

You've been forced to change your password 8 times?