Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?

Question

This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are executed via cracking (dictionary, brute force or various hybrid methods) vs some sort of keylogger or packet sniffer system?

In other words, should you be more concerned about your password entropy or the path that the password must travel from your brain to the auth server? Obviously, both. But in today's security climate, what is the weakest link? This ratio presumably differs between desktop passwords, ssh/server passwords and various online service passwords but since I use all three on a daily basis, I'm interested in them all.

I would imagine that the bad passwords will be hacked quickly and often while even moderately good ones will last until another chink appears in the armor. But does anybody have reputable sources for what sort of ratios we're talking about here?

Answer 1

The likely answer is that neither scenario is the most common, if we measure commonness by the number of affected users. The all-too-often reported issue is someone gaining access to a machine that has the user/password list in clear text (or encryption so trivial as to be plain text), which breaches the accounts of thousands of users in a single blow. This is what happened with Sony, Gawker, and Twitter for example.

Answer 2

It would be extremely difficult to answer that question with any authority without setting boundaries. You can view security reports by vendors (i.e. RSA, FireEye, Symantec, Verizon, Websense, Mandiant, Trustwave, Microsoft, etc) to review their sampling methodology, sample size, and conclusion to get a feel for the overall pulse of the industry regarding this topic. I wouldn't recommend relying on any single vendor report because of the strict boundaries each vendor places.

With that said, there are tools like sslstrip that makes it really easy for an adversary with network connectivity to logically place themselves in-line to traffic. sslstrip is smart enough to render https useless (do a search for "sslstrip" on security.stackexchange for another post re: internals).

Consider open wifi access points at coffee shops, airports, cities, etc. It's really easy for anyone to setup a malicious AP and "sniff" credentials. Much easier than obtaining a hashed password file and running dictionary attacks against the hashed password list.

At the same time, consider how widely deployed malware has become. The vendor reports above often conclude that malware is becoming more advanced as the "bad guys" organize. The bad guys are also in their business to make money so they'll make any investments necessary to earn a good payback. So, malware is becoming advanced and once infected, the bad guys can sniff traffic, redirect traffic, steal password, or even pop the CD tray open (good ol' backorifice from CDC in the late 90s).

Another way to look at the threat landscape is by following monetizable information. CC numbers, SSN, etc. Password becomes the gatekeeper for bad guys to access money. If the password authentication can be bypassed, the bad guys won't bother launching dictionary/bf/keylogger attacks because there's no reason to. So the question really becomes how bad guys get access to data that can be turned into money. The answer to "how" becomes the easiest way possible. Even with widespread adoption of EMV in the US or larger and strong cryptographic methods, the bad guys will find the easiest way to make money (how to get the best payback for their investment).