ElcomSoft blog

«…Everything you wanted to know about password recovery, data decryption,
mobile & cloud forensics…»

Archive for the ‘Human Factor’ Category

Password Usage Behavior Survey Announced

Wednesday, June 3rd, 2009

ElcomSoft is launching a survey intended to collect more information on how people handle their passwords, which remain a major way for user authentication. Whether you are ElcomSoft customer or haven’t seriously thought about password security, we hope you will answer our questions.

The questionnaire is well designed and if you have no time you can simply tick the matching answers which are prepared for your convenience. If you have a special experience to share or lots of thoughts on passwords, please take a while and use empty spaces provided for your own answers.

The survey is set to run for several weeks in order to cover more people, for we understand that summer is the best season for vacations. After the survey is completed and results calculated, we will release a full report with facts and figures. We tried to put sensible questions in the belief that results’ analysis will help us find out which questions should be better and more deeply highlighted in our articles, whitepapers, as well as in our blog.

This is the first our empirical research and we hope you will find it interesting and enjoyable. You definitely have your own opinion on passwords, and as you understand this survey is a perfect way for you to share that opinion. So what do you think? Be frank and open, take the questionnaire, and help us let others know about it.

 

Officers of Indian Customs To Be Punished For Password Breach

Wednesday, June 3rd, 2009

The Central Board of Excise and Customs of India claimed that compromised passwords are the biggest threat to system security. Despite elaborate instructions on passwords, which all employees are supposed to follow, “instances of password compromise continue to recur with unfailing regularity”, an unnamed official says.

Sharing of passwords was identified as one of the main reasons of unauthorized access and information leakage. According to CBEC representative, officers who share their passwords with others should “be regarded as being in collusion in the fraud that results”. To prevent insecure use of passwords CBEC plans to introduce a set of measures, including disciplinary action and even dismissal from the Government service.   

Penalty threat may not be the most effective solution. In case of password breach, complex countermeasures are required, and regular password audit is a significant part of it. If it is required that users change their passwords every 30 days, then system administrators have to perform password audits with the same regularity. There is a lot of both free and commercial auditing tools that allow to check password security.

Source: Business Line

Using Passwords Online

Monday, June 1st, 2009

 Today’s technologies allow staying online practically 24 hrs a day, periodically falling into a sleeping mode. The Internet became easily accessible and numerous devices can connect us to the web from everywhere, and every time when we surf the web we are being registered, at least via IP address of our devices. 

I bet it was more than once that you had to fill out a sort of name-company-position-email-telephone-whatever form when registering or subscribing to something. Do you think about preserving privacy of your information when leaving such data on someone’s website? (more…)

Adobe PDF security

Friday, May 22nd, 2009

Wow, Adobe rethinks PDF security. Curious why? Because of vulnerabilities in Abobe Reader (and so zero-day exploits), of course. From the article:

According to Finnish security company F-Secure, patching 48.9% of all targeted attacks conducted this year involved a malicious PDF file attached to a legitimate-looking e-mail, a huge change from 2008, when PDFs made up just 28.6% of targeted attacks.

But security model of PDF encryption/protection is not going to change, [un]fortunately. (more…)

Secret Questions Are Vulnerable To Guessing Attacks, Study Says

Wednesday, May 20th, 2009

Although it is widely known that authentication via ‘secret’ questions is not secure, now we finally have statistical evidence to prove it. Microsoft Research and Carnegie Mellon University have conducted a study that measures how guessable answers to ‘secret’ questions are. The researchers looked at the questions used by AOL, Google, Microsoft, and Yahoo! in order to authenticate users who need to reset their forgotten passwords. The ability of users to memorize their answers was also questioned. (more…)

Too much security won’t spoil the router, will it make it better?

Monday, May 18th, 2009

A number of D-link routers are now equipped with captcha feature. Sounds interesting. 

Chief technology officer in D-link says: "We are excited to be the first in the market to implement captcha into our routers, providing yet another layer of security to our customers".

No doubt, captcha is a wonderful spam filter for mails and a reliable obstacle to unauthorized access in the web, but is it as good for routers as for the web? (more…)

Week of Scams

Friday, May 15th, 2009

This week has witnessed several scams involving social sites. On Tuesday Twitter users posted answers to their online security questions for everyone to see. On Wednesday Twitter account of the New York Times was hacked, and on Thursday we witnessed a phishing attack on Facebook. (more…)

Laptop security – myths and mistakes

Wednesday, May 13th, 2009

Today’s businesses are very mobile. Sometimes you don’t even need to have a conventional office, it becomes virtual, it is always with you in your mobile phones, netbooks and laptops. Such mobile mini-offices stuffed with corporate documents and reports, partners’ data, confidencial correspondence, access passwords are in danger of being stolen, both virtually and physically. You can try to protect your laptop using laptop security cable locks but what if it was stolen? Let all your information go into adversary’s hands? Do you _really_ think that your Windows logon password is an impenetrable barrier for the adversary? Have you heard of Elcomsoft System Recovery? You still think your laptop is secure because you have BIOS password and/or partial drive encryption? Read an article by Kevin Beaver ‘Securing corporate data on your laptops’ , take off rose-colored glasses and revise your laptop security as suggested in Kevin’s step-by-step outline. 

 

NIST drafts new enterprise password management (open to publication, distribution and adaptation!)

Wednesday, May 13th, 2009

Probably you’ve already heard about this vicious circle thousand times:

Requiring that passwords be long and complex makes it less likely that attackers will guess or crack them, but it also makes the passwords harder for users to remember, and thus more likely to be stored insecurely. This increases the likelihood that users will store their passwords insecurely and expose them to attackers.

So, how to work out an appropriate password policy? Need help? Find some tips in NIST (The National Institute of Standards and Technology) study, GUIDE TO ENTERPRISE PASSWORD MANAGEMENT (DRAFT), which “has been prepared for use by Federal agencies”, but also “may be used by nongovernmental organizations on a voluntary basis”.

Here are some nuggets from the paper: 

• Organizations should review their password policies periodically, particularly as major technology changes occur (e.g., new operating system) that may affect password management.

Users should be made aware of threats against their knowledge and behavior, such as phishing attacks, keystroke loggers, and shoulder surfing, and how they should respond when they suspect an attack may be occurring.

• Organizations should consider having different policies for password expiration for different types of systems, operating systems, and applications, to reflect their varying security needs and usability requirements.

Do you have something to add? So, review and revise it freely – the paper is not subject to copyright. 😉 

 

Password-related news

Tuesday, May 12th, 2009

There is a few, so I’ll put ’em all into a single blog post 🙂

First, Phoenix Technologies announced a program (for Windows XP/Vista) to link mobile phones with computer. But no, this is not about data transfer between the phone and PC. Indeed, this is a security system: walk away from your computer, and it will lock automatically; when the user returns, the program will automatically unlock the system. Of course, using Bluetooth (what else? :)). More details on Phoenix Freeze web site.

Second, Researchers take over botnet, grab 56,000 passwords an hour. Actually, this is not a very fresh idea (to steal the passwords using the malware). More important: the researchers found that most users reused passwords for multiple sites. I can guess that there are even some users who have the same passwords for accessing web sites (from pet lovers forum to online banking) and critical business data. So instead of breaking your PGP Disk container (which is really secury, even with our GPU acceleration), someone can just get the password saved by your browser. You’re warned.

And finally, just a funny story: Creative passwords only useful if you can remember them. Btw, how many cats do you have? 😉