In what may have been an exhaustive ordeal, security researchers have dug deep into the dark web, forums, social networks, chat channels and website that are hidden from regular web browsers where stolen data such as credentials are commonly traded between cybercrimanls.
The researchers have stated that there are more than 21 million credentials that belong to Fortune 500 companies with 95 per cent of these included in plaintext passwords that were either stored unencrypted or cracked by cybercriminals.
The ImmuniWeb researchers analysed nearly 20 million passwords and claim that only 4.9 million were unique.
Out of the remaining, some of the passwords were commonly used than others.
As per a related report by Forbes, Davey Winder states, “the research also revealed some interesting facts on an industry by industry basis. Retail was by far and away the industry with the weakest passwords, being those under eight characters, dictionary words, or system defaults.
The following four sectors were much more closely grouped and were as follows: telecommunications, industrials, transportation, and financials.”
The industries with the highest number of stolen credentials were quite alarming. Technology was at the highest with 5 million exposed passwords. This was followed by financials with 4.9 million passwords. After this, healthcare at 1.9 million, industrials at 1.8 million and energy at 1.7 million.
The report adds that about 42 per cent of all the stolen passwords were linked in one way or the other to the company name concerned or the breached resource. It comes as no surprise then that attackers were able to “brute-force” these passwords “which means they could have a computer program try every dictionary word and common variations using numerical or special character replacements until the password was found.”
Ilia Kolochenko, CEO and founder of ImmuniWeb states, “The disastrous situation with weak passwords may first appear to be easily addressable by standard technical means. however, in light of the wide and dynamic spectrum of corporate and third-party systems handling confidential or sensitive data, this task becomes virtually unfeasible."
To this effect Winder states that this is true as several organisations have no concrete means to authorize password policies of their IT providers and partners which in turn exposes the corporate accounts to weak passwords which eventually leads to compromises.
Kolochenko says, “Two-factor authentication (2FA) is no panacea. worse, as some researches have recently demonstrated, may undermine security if incorrectly implemented." He recommends, “Holistic visibility of your digital assets and data, coherent identity and access management (IAM) program covering third-parties and third-party risk mitigation strategy are essential to protect your organization.”
Here is a look at the 32 passwords you should never use:
000000
111111
112233
123456
12345678
123456789
1qaz2wsx
3154061
456a33
66936455
789_234
aaaaaa
abc123
career121
carrier
comdy
cheer!
cheezy
Exigent
old123ma
opensesame
pass1
passer
passw0rd
password
password1
penispenis
snowman
soccer1
student
welcome
!qaz1qaz
