Call me crass, but what I really want to know is whether “schadenfreude” is a strong password.
Wait for it…1…2…3…4…5…6…Yah?
Article by Graham Cluley on his website.
Emphasis in red added by me.
Brian Wood, VP Marketing
———
The top 50 woeful passwords exposed by the Adobe security breach
In early October, Adobe revealed that hackers had breached its network and (as well as stealing source code) had accessed customer databases including the details of approximately 3 million users.
Within a couple of weeks, however, Adobe was forced to acknowledge that a more accurate figure for the number of people who were impacted by the hack was some 38 million active users after a 3.8GB file containing more than 150 million usernames/passwords was dumped on the net.
“So far, our investigation has confirmed that the attackers obtained access to Adobe IDs and (what were at the time valid), encrypted passwords for approximately 38 million active users,” said Adobe spokesperson Heather Edell.
The truth is that, in a screw-up of colossal proportions, Adobe didn’t protect the password data with a one-way cryptographic hashing algorithm.
Instead, Adobe encrypted its password data with Triple DES (3DES) in ECB mode – an incredibly poor choice because it always produces the same output if you feed it the same input.
In short, if you happened to choose the same password as someone else, Adobe will have been storing the byte-for-byte same encrypted ciphertext version of the password for each user.
Furthermore, the leaked database included users’ plaintext password hints, helping to reveal what the most commonly used passwords were.
For instance, if you saw the following hints from thousands of different users, all associated with the same ciphertext, you would probably be able to guess the actual password that they shared – right?
1to6
numbers
123
654321
numeros
1-6
number
1
12
num
It’s not going to be aardvark with hints like that, is it?
Jeremi Gosney, of the security firm Stricture Consulting Group, was able to determine the top 100 most commonly used passwords in the Adobe database with ease.
Here are the first 50:
| # | Count | Ciphertext | Plaintext |
| 1. | 1911938 | EQ7fIpT7i/Q= | 123456 |
| 2. | 446162 | j9p+HwtWWT86aMjgZFLzYg== | 123456789 |
| 3. | 345834 | L8qbAD3jl3jioxG6CatHBw== | password |
| 4. | 211659 | BB4e6X+b2xLioxG6CatHBw== | adobe123 |
| 5. | 201580 | j9p+HwtWWT/ioxG6CatHBw== | 12345678 |
| 6. | 130832 | 5djv7ZCI2ws= | qwerty |
| 7. | 124253 | dQi0asWPYvQ= | 1234567 |
| 8. | 113884 | 7LqYzKVeq8I= | 111111 |
| 9. | 83411 | PMDTbP0LZxu03SwrFUvYGA== | photoshop |
| 10. | 82694 | e6MPXQ5G6a8= | 123123 |
| 11. | 76910 | j9p+HwtWWT8/HeZN+3oiCQ== | 1234567890 |
| 12. | 76186 | diQ+ie23vAA= | 000000 |
| 13. | 70791 | kCcUSCmonEA= | abc123 |
| 14. | 61453 | ukxzEcXU6Pw= | 1234 |
| 15. | 56744 | 5wEAInH22i4= | adobe1 |
| 16. | 54651 | WqflwJFYW3+PszVFZo1Ggg== | macromedia |
| 17. | 48850 | hjAYsdUA4+k= | azerty |
| 18. | 47142 | rpkvF+oZzQvioxG6CatHBw== | iloveyou |
| 19. | 44281 | xz6PIeGzr6g= | aaaaaa |
| 20. | 43670 | Ypsmk6AXQTk= | 654321 |
| 21. | 43497 | 4V+mGczxDEA= | 12345 |
| 22. | 37407 | yp2KLbBiQXs= | 666666 |
| 23. | 35325 | 2dJY5hIJ4FHioxG6CatHBw== | sunshine |
| 24. | 34963 | 1McuJ/7v9nE= | 123321 |
| 25. | 33452 | yxzNxPIsFno= | letmein |
| 26. | 32549 | dCgB24yq9Bw= | monkey |
| 27. | 31554 | dA8D8OYD55E= | asdfgh |
| 28. | 28349 | L8qbAD3jl3jSPm/keox4fA== | password1 |
| 29. | 28303 | zk8NJgAOqc4= | shadow |
| 30. | 28132 | Ttgs5+ZAZM7ioxG6CatHBw== | princess |
| 31. | 27853 | pTkQrKZ/JYM= | dragon |
| 32. | 27840 | 2aZl4Ouarwm52NYYI936YQ== | adobeadobe |
| 33. | 27720 | NpVKrCM6pKw= | daniel |
| 34. | 27699 | Dts8klglTQDioxG6CatHBw== | computer |
| 35. | 27415 | 4aiR1wv9z2Q= | michael |
| 36. | 27387 | XpDlpOQzTSE= | 121212 |
| 37. | 26502 | ldvmctKdeN8= | charlie |
| 38. | 25341 | 5nRuxOG9/Ho= | master |
| 39. | 24499 | y7F6CyUyVM/ioxG6CatHBw== | superman |
| 40. | 24372 | R3jcdque71gE+R+mSnMKEA== | qwertyuiop |
| 41. | 23417 | TduxwnCuA1U= | 112233 |
| 42. | 23157 | 2hD1nmJUmh3ioxG6CatHBw== | asdfasdf |
| 43. | 22719 | MyFBO2YW+Bw= | jessica |
| 44. | 22672 | cSZM/nlchzzioxG6CatHBw== | 1q2w3e4r |
| 45. | 22204 | Vqit1GVLLek= | welcome |
| 46. | 22180 | e+4n2zDarnvioxG6CatHBw== | 1qaz2wsx |
| 47. | 22143 | ZHgi8hFCTvrSPm/keox4fA== | 987654321 |
| 48. | 22103 | OrzNCxMfwrw= | fdsa |
| 49. | 21795 | 4chDWZgI7v0= | 753951 |
| 50. | 21449 | vp6d18mfGL+5n2auThm2+Q== | chocolate |
As you can see, the most popular password, chosen by almost two million Adobe users, is 123456. Other password choices are equally poor: password, 123456789, qwerty, etc…
As Gosney told ZDNet, it only took a few hours to determine the top 100 passwords:
The password hints were the most telling. An overwhelming number of people took the concept of a password hint too literally, and flat-out provided the password itself as the hint. By analysing thousands of password hints per ciphertext, and matching that information with what we know about the ciphertext thanks to ECB mode, we are able to determine a number of passwords with a reasonable degree of certainty. It took about three hours to determine what the top 100 passwords were with this method.
Gosney went on to tell me that the release of the Adobe password database could make a significant impact on future password cracking:
If we can recover the encryption key and decrypt the passwords, it will be huge for password crackers. RockYou was the first real glimpse we got at how users select passwords on a massive scale. This leak is nearly 5x the size of RockYou, and will give us amazing statistics for probabilistic password cracking.
The only good news in this sorry mess is that Adobe says that it now protects passwords following best practices, and it has now reset the exposed passwords. But that’s not going to be much help if you’ve used the same password elsewhere on the internet.
In short, you should never use the same password on multiple websites. And you need to stop choosing obvious, easy-to-crack passwords.
If you do make the mistake of reusing passwords, you are running the risk of having your password compromised in one place (perhaps via a phishing attack, spyware keyloggers or a data breach) and then hackers using it to unlock your other online accounts.
If you find passwords a burden – simply use password management software like LastPass, 1Password, and KeePass. They can generate complex, hard-to-crack passwords for you and do all the heavy work of remembering them on your behalf.
Meanwhile, if you run a company or website which needs to store users’ passwords, you should be taking much better care than Adobe did in ensuring that they are tricky to crack, using a one-way cryptographic hashing algorithm.
After all, if a hacker does manage to break into your computer systems you want to feel confident that they’re going to find it as hard as possible to crack the passwords your customers have entrusted you with.
And maybe it’s time to implement tougher requirements on your customers in the first place, ensuring that they use passwords that are more complex and harder to guess in future.
http://grahamcluley.com/2013/11/top-50-passwords-adobe-security-breach/
