SECURE IT - August 2024

A monthly Information Security publication for the WPI community.

This month let's focus on PASSWORD HYGIENE. It's a set of best practices that reduces the likelihood of your account being compromised.

In this issue:

• Password Cracking Techniques & AI
• Password Managers 
• How to Make a Strong Password
• Learning with Laughter
  
• From WPI's CISTO: If a Vendor Is Breached...
  
• Where to Find Information Security?
  
• Meet Jim MacDonald!
  
• Featured Videos & By the Numbers 
• Do You Reuse Passwords?
• Passwords in the News
• Expired Password Phishing Scam at WPI
  
• Diversity in Cybersecurity
• Additional WPI Password Resources

Password Cracking Techniques

Because hackers have advanced methods to make many password attempts in just a few seconds, creating strong and varied passwords or passphrases is more important than ever. People who don’t use password managers often use the same passwords for all their accounts, leaving them vulnerable to credential compromise.

Hackers often use algorithms to repeatedly guess the password, including making common number and symbol replacements for letters. So you can't trick them by changing your password from mypassword to mypa55word!   

• Brute force attacks try combinations of characters of a predetermined length.
• Dictionary searches run through known words; password dictionaries even exist for a variety of topics, including politics, movies, and music groups.
  
• Phishing attacks lure you into clicking on an email attachment or link that collects your password or installs malware. The malware might track keystrokes or take screenshots to nab the password. 
  
• Rainbow attacks use different words from the original password in order to generate other possible passwords. Malicious actors keep a list of leaked and previously cracked passwords, which will make the overall password cracking method more effective.
  
• Guessing! An attacker may be able to guess a password without the use of tools. With enough information about the victim or use of a common password, they may be able to come up with the correct characters.
  

These definitions came from TechTarget.com, and the article below offers more details.

AI Is Utilized in Password Cracking

According to PowerDMARC, "AI-powered password-cracking tools utilize artificial intelligence and machine learning algorithms to efficiently guess or crack passwords. These tools can learn from existing password data, recognize patterns, and automate various techniques to compromise user accounts." In addition to expertly enacting Brute Force and Dictionary attacks defined above,  here are other common AI password cracking methods:

• Pattern Recognition - AI algorithms can recognize patterns and trends in passwords, such as the use of common phrases.
  
• Data Mining - AI can mine and analyze large datasets, such as breached password databases.
• Credential Stuffing - It is the automated process of using stolen username-password pairs from one site to gain unauthorized access to another.
• Keyboard Sound-Based Attacks - An AI model can replicate a typed password on a laptop with an accuracy rate of 95 percent.
  

Time it Takes Brute Force Hack Passwords in 2024 

Color Code:

Purple - Cracked instantly; uses 4-6 characters and no character variety.

Red - Cracked in a few seconds to 5 months; uses 7 - 14 slightly varied characters.

Orange - Cracked in 2 to 33,000 years; uses 11 - 14 widely varied characters.

Yellow - Takes 618,000 to 2 billion years to crack; uses 11 - 16 widely varied characters.

Green - Takes 11 billion to 19 quadrillion years to crack! They use widely varied 13 - 18 characters.

Protect Passwords from Artificial Intelligence

Using  the best password and security practices make it harder for artificial intelligence tools to figure out your password. To protect against AI and other hacking tools:

• Create stronger passwords
• Use multi-factor authentication
• Avoid public Wi-Fi
  
• Use password managers
  
• Monitor data breaches

Password Managers

While technology promises to make our lives easier, and it generally does, every new website and application we sign up for is another password we must remember. For many, it becomes impossible to remember all of them. Think about yourself – do you reuse your passwords on multiple accounts? This is considered risky, so utilizing a password manager can reduce your risk.

What is a Password Manager?

A password manager is a software application designed to store and manage online credentials and generate strong passwords. The passwords are usually stored in an encrypted database and locked behind a master password. Once you log into a password manager using a "master" password, you then create an entry for a specific application and utilize the password manager for logging into that application.

Steps to Set Up a Password Manager:

1. Download a password manager program.

2. Create a master password for your password vault.

3. Start logging into your accounts.

4. Begin to change your passwords.

Pros and Cons of Password Managers

While password managers have many benefits, they are not foolproof. Weighing these pros and cons against your needs and habits can help you to decide what is best for you. (There is not currently a specific password manager that WPI Information Technology supports as university-wide software.)

PROS:

1. No need to memorize all your passwords.
2. Help to protect your identity.
   
3. A highly secure password is generated for you.
   
4. They enable easy access to accounts across multiple devices.
   
5. Many password managers work across different systems, for quick access to your passwords regardless of which system you’re on.
   
6. Saves time.

CONS:

1. Password managers have been hacked, but overall, their track record when it comes to securing data is very good.
2. Password managers can be a single point of failure, for instance, if the master password is forgotten or lost.
   
3. All of your sensitive data is stored in one place.
   

Make a Strong Password

Here are tips on how to make a strong password. Your master password is the key to your password manager, so it is imperative that it's both strong and memorable!

• Don’t reuse passwords.
• Create long, complex passwords with a variety of character types.
• Use a passphrase, a series of words that are easy to remember but hard to guess, such as a favorite quote.

Example of Passwords with Increasing Complexity

For additional password tips, check out this article from the Cybersecurity and Infrastructure Security Agency.

Learning with Laughter