2

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several hundred password resets happen on a predictable schedule. My intuition tells me that this is tactically valuable information to an attacker (I am an infosec noob).

An attacker could enhance the standard "reply to this with your password" phish with a "reply to this with your password because it is time to change your password" phish. The latter seems less suspicious because the person who wrote the message knows about the password reset policy.

Are there any other attacks enhanced or made possible by a predictable password reset schedule?

I realize that (by the pigeonhole principle) every sufficiently large enterprise with a forced password change policy will have a lot of same-day password changes.

2 Answers 2

3

The reason why recommendations for years is to stop passwords from expiring is to prevent people from doing what they normally do: mypasswordJune.

If you know that a large section of the user population is changing their password on June 1, then you can start creating password databases based on common patterns and adding:

  • summer
  • june
  • etc.

So the big threat here is credential stuffing.

Please inform the company about the recommendations to cease this practice.

The other issue will be load on the Help Desk systems. There is normally an increased number of calls when people need to reset. If there is a large block all changing their passwords at the same time, it then becomes easier for attackers to social engineer the Help Desk to gain access to an account:

Yeah, it's that time again. Look, I forgot to change it in time. Yeah, I know. Can you reset it for me and tell me the password over the phone? I'm not at a computer right now and I need that super-critical email, etc. etc.

Because the call is "expected" the Help Desk's ability to suspect a problem is lower.

0

People come back to things they know, so if you force the employees to change passwords periodically, most likely, they will start to generate patterns and/or rotate their passwords.

A plausible attack may start by using social engineering to impersonate both end-users and help-desk personnel to obtain information regarding procedures, recommendations, deadlines and relevant data to orchestrate an attack.

If there is some kind of pattern for the new passwords (maybe based on help-desk recommendations for selecting new passwords?), these patterns can be used to generate stronger dictionaries to be used against some exposed login page.

There are a couple of interesting articles regarding passwords, both are rather old, but still relevant, after all... aren't passwords the same authentication factor as 40 years ago?:

https://danielmiessler.com/blog/it-appears-required-password-changes-reduce-security/ This one talks about how can a user may select easier passwords each time, reducing the password entropy, this scenario may ease some attack scenario

https://arstechnica.com/information-technology/2012/08/passwords-under-assault/ The article explains extensively the methods and tools used by crackers not only to crack passwords, but to understand how people build their passwords and use that information to build better dictionaries and strategies for cracking passwords.

Worth reading.

1
  • So, basically, what I said?
    – schroeder
    Jun 26, 2020 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .