8

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords?

I am just wondering because in case of multiple wrong password attempts; many websites and devices nowadays are using lock out system which either locks you out permanently until recovery options are followed OR locks you out for specific period of time...Moreover some websites use captcha to ensure that there is a human being on the other side and not just a tool or script....

If anyone can elaborate on this please....how is it practical (or even possible) for hackers to guess a password with these security measures that are in place....I know it happens because it happened to me. I had a Yahoo email account with a 6 character password (letters and numbers but no special characters or caps) and a hacker managed to gain access to it and started spamming my address book contacts. And I am sure my password was not captured through phishing, social engineering or keylogger.

I am not looking for the exact tools or scripts, I am just looking for what is the idea behind a successful password guess in spite of security measures in place that do not entertain guessing. So for example, even if my password was only letters and was only six characters, how can someone guess my gmail password?

Improve this question
6
  • 1
    So there's online and offline attacks. Offline attacks are very fast and do not have any lockouts, online attacks are much slower (as they have to transit the internet and allow the server to reply) and do indeed have lockouts. If you use the password on multiple websites, then another website could have had their password files downloaded and cracked offline, and your password simply tried. Check out this article from Sophos about Yahoo: nakedsecurity.sophos.com/2014/01/31/…
    – user53693
    Sep 19, 2014 at 20:46
  • 2
    Another option which is common and you don't mention, is if you used the same password on another site, if that site is compromised, your Yahoo account could be compromised. Try putting the e-mail address associated with the account into haveibeenpwned.com
    – Rory McCune
    Jun 10, 2015 at 15:04
  • Well the intelligent attackers never guess something, if they do something they are well aware about what they are doing and trying to achieve. In the field of IT security, guessing is not an option. An attacker could have a great luck(not a skill) if he/she just types some random password and gets logged into the system and finally discovered(guessed) the password. So, in your case there could be a possibility that the attacker guessed your password, but I doubt that. The attacker should definitely have used some other IT skills. :)
    – ρss
    Jun 10, 2015 at 15:09
  • Also in case of guessing the attacker would try to use the information related to you. for eg: He/she might try using your girl friend's/boy friend's/wife's/husband's name, last name, date of birth, living place, pets name, mother last name, your last name.... list goes on. The attacker shall try to use something that you can remember easily. And if your password was one of these, then it can get guessed by the attacker. This is exactly how password guessing works, nothing special. PS: In order to get information related to you the attacker can use social engineering or other attacks..!!
    – ρss
    Jun 10, 2015 at 15:13
  • Poor server security leading to stolen password info (either a hack or an inside job); poor client security (saved passwords, installing software that includes a keylogger, forgetting to purge shell history if a password ends up on the command line, post-it taped to keyboard).
    – Phil Lello
    Mar 21, 2016 at 20:12

4 Answers 4

Reset to default
6

Account lockout is an effective rate limiting measure against brute forcing logins when the attacker is targeting one particular account. It is not effective against a bulk attack across many accounts. One could, for example, try all possible usernames whilst trying the same common password for all, and recover some proportion of the accounts.

Even CAPTCHA is only really a rate-limiting feature in the face of cracking and CAPTCHA-farmers.

I know it happens because it happened to me.

It's not certain it happened due to brute force against the login interface. Apart from the mentioned phishing and trojan attacks, plus possible other web vulnerabilities like XSRF, Yahoo's database has definitely been compromised in the past (probably leaking hashes which are likely reversible for common and short password); plus if you used the password anywhere else then the other site could have been compromised. Yahoo have historically had a particularly poor reputation for account compromises which is likely a mixture of all these things.

Improve this answer
1

In this case they would have to somehow get their hands on the hash of your password. Run a tool against it, that would compare possible resulting hashes to your real hash. If the hash matches, then they know what password it took to generate that hash. Now it only takes one try to login to your Yahoo account.

Improve this answer
4
  • 1
    I understand where you are coming from....but this applies to some websites....because how on earth would they get their hands on password hashes of email services giants like Yahoo or Gmail....Very unlikely...Actually as far as we know, no one has ever managed to do it...Because it would mean compromising most of the accounts created in these websites....... And please note I never use password saving options on websites or web browser...
    – Identicon
    Sep 19, 2014 at 20:45
  • 2
    I beg to differ: haveibeenpwned.com, half a million Yahoo accounts compromised.
    – RoraΖ
    Sep 19, 2014 at 20:46
  • 1
    Beg to differ or not...I beg an answer for my original question....How can hackers guess passwords despite "lock out" and despite "capatcha"?
    – Identicon
    Sep 19, 2014 at 20:51
  • 2
    Because of password re-use, one website might be compromised and their password list stolen. Then it's simply a matter of trying the cracked passwords against known users. I wrote a blog post about this very thing: xiphosresearch.com/2014/01/28/…
    – user53693
    Sep 19, 2014 at 20:55
1

Having lock out or CAPTCHA mechanism, prevents the online attacker from doing the brute force search. If the lock out time is 10 min, then to brute force a dictionary of 1 million (2^20) words, the attacker requires 6944 days or nearly 20 years. Calculation is shown below:

i. With 10 min lock out time, the attacker can try 6 words/hour from the dictionary. ii. In one day 24*6 = 144 words. iii. Number of days required to exhaust the dictionary = 2^20 / 144 = 6944 days.

Therefore, if you set your password from the dictionary, within 20 years using the online attack your password is definitely broken. On an average it will take 10 years to do so.

However, the more threat comes from the offline attack. If the attacker has the hash of your dictionary password, he can break it within a second.

Improve this answer
1

Most brute force attacks now a days use combo lists rather than a password or dictionary attack. A combo list is a users username and their password in this format username:password. They get them through hacking databases with SQL injection, phishing pages, key loggers and even using Google dorks to find website dumps on the net.

Take the scenario that you have just registered at a website or forum, and this website keeps your login username and password on its database that is vulnerable to SQL Injection. A hacker hacks the database and pulls all the usernames and passwords from it. Most people use the same username and password for everything so by running this combo list of usernames and passwords against different websites, you usually always get a few hits. Another way is by leeching forum members lists. By doing this you already have the login usernames in most cases. One of the most common mistakes people do is either have their password the same as their username, or have 123456 or even the word password as their password. So what you do is create a list where all the usernames have the same password. You always get someone who has used 123456, password or their username as password.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .