Digital Shadows, a leader in threat intelligence and digital risk protection, has published new research quantifying the scale of password compromise globally. The study finds more than 24 billion usernames and password combinations are in circulation in cybercriminal marketplaces, many on the dark web – the equivalent of nearly four for every person on the planet. This number represents a 65 percent increase from a previous report in 2020.
Unfortunately, consumers continue to use easy-to-guess passwords. Digital Shadows found the top 50 most common passwords incredibly are easy to guess and simply use the word ‘password’ or a combination of easily remembered numbers. Some 0.46 percent of all passwords – nearly one in every 200 – is 123456. Keyboard combinations such as ‘qwerty’ or ‘1q2w3e’ also are used commonly. Of the 50 most used passwords, 49 can be ‘cracked’ in under a second via easy-to-use tools available on criminal forums, which often are free or at a minimal cost.
However, the good news is that adding a ‘special character’ (such as @ # or _) to a basic 10-character password adds approximately 90 minutes to the amount of time an offline attack would take to crack the password. Adding two special characters results in an offline cracking time of approximately two days and four hours.
Cybercriminal marketplaces and forums remain the most commonplace for threat actors to advertise and sell stolen credentials. Over the last two years. this ecosystem for criminals has continued to expand, along with the range and sophistication of malware at their disposal. This has helped fuel the increase. Some combinations are advertised more than once on forums, but even after removing duplicates, Digital Shadows still found that 6.7 billion unique credentials exist – an increase of approximately 1.7 billion or 34 percent in two years.
Senior Cyber Threat Intelligence Analyst at Digital Shadows Chris Morgan predicted, “We will move to a ‘passwordless’ future, but for now the issue of breached credentials is out of control. Criminals have an endless list of breached credentials they can try but adding to this problem is weak passwords which mean many accounts can be guessed using automated tools in just seconds. In just the last 18 months, we at Digital Shadows have alerted our clients to 6.7 million exposed credentials. This includes the username and passwords of their staff, customers, servers and IoT devices. Many of these instances could have been mitigated through using stronger passwords and not sharing credentials across different accounts.”
Digital Shadows recommends these steps to keep credentials safe:
- Use a password manager – a password manager is an app on a phone, tablet or computer that stores passwords, so they can be made more complex and the person doesn’t need to remember them.
- Use multi-factor authentication (MFA) where account providers offer it – this can confirm identity and can replace passwords using PINs, facial recognition, fingerprints or inserting a USB key
- Use an authenticator app – these generate a new random six-digit code every 30 seconds that a user must enter to the website one which they are trying to authenticate
The full report entitled “Account takeovers in 2022: The 24-billion password problem” is available at: https://resources.digitalshadows.com/whitepapers-and-reports/account-takeover-in-2022/
To learn more, visit www.digitalshadows.com.
