U.S. Markets close in 2 hrs 38 mins

If You're Using 'Password1,' Change It. Now.

Stacy Cowley

The number one way hackers get into protected systems isn't through a fancy technical exploit. It's by guessing the password.

That's not too hard when the most common password used on business systems is "Password1."

There's a technical reason for Password1's popularity: It's got an upper-case letter, a number and nine characters. That satisfies the complexity rules for many systems, including the default settings for Microsoft's widely used Active Directory identity management software.

Security services firm Trustwave spotlighted the "Password1" problem in its recently released "2012 Global Security Report," which summarizes the firm's findings from nearly 2 million network vulnerability scans and 300 recent security breach investigations.

Around 5% of passwords involve a variation of the word "password," the company's researchers found. The runner-up, "welcome," turns up in more than 1%.

Easily guessable or entirely blank passwords were the most common vulnerability Trustwave's SpiderLabs unit found in its penetration tests last year on clients' systems. The firm set an assortment of widely available password-cracking tools loose on 2.5 million passwords, and successfully broke more than 200,000 of them.

Verizon came up with similar results in its 2012 Data Breach Investigations Report, one of the security industry's most comprehensive annual studies. The full report will be released in several months, but Verizon previewed some of its findings at this week's RSA conference in San Francisco.

Exploiting weak or guessable passwords was the top method attackers used to gain access last year. It played a role in 29% of the security breaches Verizon's response team investigated.

[Related: Smartphone Features You Don't Really Need]

Verizon's scariest finding was that attackers are often inside victims' networks for months or years before they're discovered. Less than 20% of the intrusions Verizon studied were discovered within days, let alone hours.

Even scarier: Few companies discovered the breach on their own. More than two-thirds learned they'd been attacked only after an external party, such as a law-enforcement agency, notified them. Trustwave's findings were almost identical: Only 16% of the cases it investigated last year were internally detected.

So if your password is something guessable, what's the best way to make it more secure? Make it longer.

Adding complexity to your password -- swapping "password" for "p@S$w0rd" -- protects against so-called "dictionary" attacks, which automatically check against a list of standard words.

But attackers are increasingly using brute-force tools that simply cycle through all possible character combinations. Length is the only effective guard against those. A seven-character password has 70 trillion possible combinations; an eight-character password takes that to more than 6 quadrillion.

Even a few quadrillion options isn't a big deal for modern machines, though. Using a $1,500 computer built with off-the-shelf parts, it took Trustwave just 10 hours to harvest its 200,000 broken passwords.

"We've got to get ourselves using stuff larger than human memory capacity," independent security researcher Dan Kaminsky said during an RSA presentation on why passwords don't work.

He acknowledged that it's an uphill fight. Biometric authentication, smartcards, one-time key generators and other solutions can increase security, but at the cost of adding complexity.

"The fundamental win of the password over every other authentication technology is its utter simplicity on every device," Kaminsky said. "This is, of course, also their fundamental failing." To top of page

































  • Why Is Ford Stock Tanking before Its Q3 2018 Earnings Event?
    Finance
    Market Realist

    Why Is Ford Stock Tanking before Its Q3 2018 Earnings Event?

    Why Analysts Are Pessimistic about Ford’s Q3 2018 Earnings  Ford’s Q3 2018 earnings Ford Motor Company (F), the second-largest US automaker by 2017 vehicle sales volume, is set to release its third quarter of 2018 earnings report on October 24. But before

  • Now is a ‘once-in-a-lifetime’ chance to invest in US pot companies, investor says
    Finance
    Yahoo Finance

    Now is a ‘once-in-a-lifetime’ chance to invest in US pot companies, investor says

    With some Canadian pot stocks posting triple-digit return rates this year, many retail investors have looked north to pour cash into cannabis. U.S. cannabis companies are worth a lot more than their current valuations suggest since federal illegality has put undue pressure on the industry, said David Wenger, a New York attorney and senior editor of the Cannabis Law Digest.

  • Why ServiceSource International Is Imploding Today
    Business
    Motley Fool

    Why ServiceSource International Is Imploding Today

    Shares of ServiceSource (NASDAQ: SREV), a provider of outsourced inside sales and customer service solutions, are being obliterated today. The stock is down 46% as of 11:07 a.m. EDT on Friday after the company shared preliminary third-quarter results and revised its full-year guidance.

  • Here’s why you shouldn’t retire super early — even if you can
    Business
    MarketWatch

    Here’s why you shouldn’t retire super early — even if you can

    Despite the many perks of early retirement — waking up whenever you want, for example — it wasn’t the easiest decision. Earnings tend to peak around 48 for men and about 39 for women, according to an analysis by PayScale.

  • Business
    Benzinga

    Jim Cramer Shares His Thoughts On Amarin, AT&T, McDonald's And More

    On CNBC's "Mad Money Lightning Round", Jim Cramer said Arrowhead Pharmaceuticals Inc (NASDAQ: ARWR) is a great speculative stock. Cramer is willing to endorse AT&T Inc. (NYSE: T), but he thinks Verizon Communications Inc. (NYSE: VZ) offers more safety

  • What happens if you win Mega Millions' $970M jackpot?
    News
    Associated Press

    What happens if you win Mega Millions' $970M jackpot?

    Despite the terrible odds — one in 302.5 million for those keeping score at home — someone will eventually match all six numbers and win the Mega Millions jackpot, which now stands at $970 million. Here are some answers for someone holding that prized lottery ticket for what would be the second-largest lottery jackpot in U.S. history. Lottery officials recommend winners take a deep breath, put their winning ticket in a safe spot and consult with a reputable financial planner before popping over to the lottery headquarters.

  • Business
    Barrons.com

    How High Can Apple Stock Go? This Analyst Says the Sky’s the Limit

    The sky’s the limit for (AAPL) (AAPL), Wedbush Securities analyst Daniel Ives said in a note late Thursday that gave the company the highest price target on Wall Street. In his Overweight recommendation, Ives, managing director of equity research, initiated coverage with a $310 target on the stock, a 43.5% upside from Thursday’s closing price. Insatiable demand for Apple’s new crop of iPhones, including its highest-priced model yet (the $1,099 iPhone XS Max), will lead the charge in 2019 and beyond, Ives told Barron’s.

  • Suddenly Toxic, Saudi Prince Is Shunned by Investors He Courted
    World
    Bloomberg

    Suddenly Toxic, Saudi Prince Is Shunned by Investors He Courted

    Now Crown Prince Mohammed bin Salman could become the biggest risk to his own project. Everything changed when Jamal Khashoggi walked into the Saudi consulate in Istanbul on Oct. 2 and didn’t come out. Prince Mohammed, who’s denied any knowledge of Khashoggi’s fate, still has his defenders -– notably Donald Trump.

  • Goldman Sachs Adds Nvidia To 'Conviction Buy' List
    Business
    Yahoo Finance Video

    Goldman Sachs Adds Nvidia To 'Conviction Buy' List

    Goldman Sachs analyst Toshiya Hari reiterated his 'Buy' rating for Nvidia and added the chip-maker to Goldman’s 'Conviction Buy' list.

  • Home Depot vs. Lowe’s: Both Stocks Are Slumping, So Which One Should You Buy?
    Finance
    GoBankingRates

    Home Depot vs. Lowe’s: Both Stocks Are Slumping, So Which One Should You Buy?

    An analyst downgrade based on housing market outlooks has sent stocks from Lowe’s and Home Depot down over the last two days. Both Home Depot and Lowe’s are in downtrends dating back to September. On Wednesday, shares in Lowe’s and The Home Depot were slumping after disappointing housing market data led a key analyst to downgrade his ratings and slash price targets, and both stocks continued the slump into a second day on Thursday.

  • Why Yandex N.V. Stock Plunged Today
    Business
    Motley Fool

    Why Yandex N.V. Stock Plunged Today

    What happened Shares of Yandex N.V. (NASDAQ: YNDX) dropped 17.8% on Thursday following reports that Russia's state-owned Sberbank may take a controlling stake in the country's leading internet search company. More specifically, according to sources speaking

  • Palo Alto Networks Stock Upgraded: What You Need to Know
    Business
    Motley Fool

    Palo Alto Networks Stock Upgraded: What You Need to Know

    Cybersecurity company Palo Alto Networks (NYSE: PANW) won a big upgrade today when analysts at R.W. Baird announced they're assuming coverage of the stock and raising their price target to $250 a share. If they're right about that, Palo Alto Networks is worth more than 23% more than it currently costs. Many companies offer cybersecurity services, but which one is the best to invest in?

  • Business
    CNBC

    Trump-approved boycott appears to be hitting Harley-Davidson amid rising trade-ins for rival Indian brand

    Harley-Davidson sales continue to falter after a rough first half in which it lost share to Indian, its main U.S.-based competitor, according to BMO Capital Markets. Harley engaged in a public spat with Trump a few months ago when it said it was shifting some production overseas in response to retaliatory tariffs from abroad. "It should be disconcerting to HOG investors that most Indian dealers we speak with are seeing an uptick in Harley trade-ins for whatever the reason may be," BMO says.

  • Don't Be Fooled -- Intuitive Surgical Had Another Huge Quarter
    Business
    Motley Fool

    Don't Be Fooled -- Intuitive Surgical Had Another Huge Quarter

    One look at the headline numbers might have had Intuitive Surgical (NASDAQ: ISRG) investors worried. Revenue grew a modest 14%, but earnings were only up 2%? This is, after all, a company that trades for over 50 times earnings.  But worry not. The devil

  • Why This Hedge Fund Manager Loves PayPal
    Business
    Motley Fool

    Why This Hedge Fund Manager Loves PayPal

    One of the biggest hedge fund managers is Dan Loeb, manager of the sometimes-activist Third Point Capital. Third Point's Offshore Fund has returned an impressive 15.1% annualized vs. 8.1% for the S&P 500 since 1996. When a manager like Loeb makes a large bet, it's probably a good idea to listen.

  • The only positive in autos is Tesla, says Jim Cramer
    F
    CNBC Videos

    The only positive in autos is Tesla, says Jim Cramer

    CNBC's 'Squawk on the Street' discusses Tesla after Tesla CEO Elon Musk announced the low-cost Model 3 vehicle.

  • Is CenturyLink, Inc. a Buy?
    Business
    Motley Fool

    Is CenturyLink, Inc. a Buy?

    Legacy landline telecom CenturyLink, Inc. (NYSE: CTL) gets plenty of grief. And understandably so, considering that its legacy business, copper wire landline and internet connections is a steadily declining business while fiber and wireless technologies

  • What’s Pfizer’s Current Valuation?
    Finance
    Market Realist

    What’s Pfizer’s Current Valuation?

    Pfizer's Stock Performance and Estimates in October (Continued from Prior Part) Pfizer’s valuation In this part, we’ll compare Pfizer’s (PFE) valuation with its peers including Merck (MRK), Johnson & Johnson (JNJ), Eli Lilly (LLY), and Bristol-Myers

  • Business
    Motley Fool

    Why IBM’s Brief Growth Streak Just Stalled

    Unfortunately for its shareholders, there was a speed bump on the road to rebound last quarter: The company reported this week that revenue shrank, and growth in its vital "strategic imperatives" businesses slowed. Seriously, when IBM's legacy mainframe business is the strongest performer in a given quarter, one has to see that as a problem.

  • 5 U.S. Marijuana Stocks to Buy Before the Market Lights Up
    Finance
    InvestorPlace

    5 U.S. Marijuana Stocks to Buy Before the Market Lights Up

    As such, the full range of recreational products offered by Tilray (NASDAQ:TLRY), Canopy Growth (NYSE:CGC) and their peers can now be sold throughout Canada. One question for American investors is how that affects U.S. marijuana stocks? What happened in Canada changes little in the U.S. The federal ban on marijuana remains in place.

  • Why Activision Blizzard, United Rentals, and Gap Slumped Today
    Business
    Motley Fool

    Why Activision Blizzard, United Rentals, and Gap Slumped Today

    The stock market had a tough session on Thursday, with the Dow Jones Industrial Average finishing down over 300 points. Investors continued to worry about rising interest rates in the U.S., but they also turned their attention to the global macroeconomic picture, where new concerns about the prospects for growth in areas like Europe and China weighed on sentiment. Company-specific news hurt certain stocks, and Activision Blizzard (NASDAQ: ATVI), United Rentals (NYSE: URI), and Gap (NYSE: GPS) were among the worst performers on the day.

  • Caterpillar, Boeing Sell Off After Honeywell's Tariff Pessimism
    Business
    Bloomberg

    Caterpillar, Boeing Sell Off After Honeywell's Tariff Pessimism

    The company’s executives are bracing for “hundreds of millions of dollars” in earnings pressure next year from the expanded tariff lists. Caterpillar and Boeing dropped more than 1 percent while the Dow rose 0.5 percent.

  • Love Dividends? 3 Stocks You Might Want to Buy
    Business
    Motley Fool

    Love Dividends? 3 Stocks You Might Want to Buy

    It's even better when you know that the dividend is a big one! You'll get more of those good feelings if you add high-yielding Magellan Midstream Partners, L.P. (NYSE: MMP), General Mills, Inc. (NYSE: GIS), and Tanger Factory Outlet Centers, Inc. (NYSE: SKT) to your income portfolio. It has also been reworking older brands, notably with new yogurt and ice cream products.

  • Marijuana investors may lose 90% of their money in Canada, so consider the really big prize elsewhere
    News
    MarketWatch

    Marijuana investors may lose 90% of their money in Canada, so consider the really big prize elsewhere

    Marijuana presents a tremendous opportunity for investors over the next few years. Naïve investors are excited. The reality is that professionals will pick their pockets, and many naïve investors who are excited now will end up losing 90% of their investment.

  • Kinder Morgan Inc.’s CEO Outlines a 4-Step Plan for a Brighter Tomorrow
    Business
    Motley Fool

    Kinder Morgan Inc.’s CEO Outlines a 4-Step Plan for a Brighter Tomorrow

    Kinder Morgan (NYSE: KMI) recently completed a "momentous" quarter according to CEO Steve Kean. Not only did the pipeline giant's financial results beat its expectations, but it was a pivotal quarter on a strategic front, because the company closed the sale of the Trans Mountain Pipeline and locked up another new growth project. Complete the distribution of the Trans Mountain proceeds and continue our discussions on turning the positive indications that we now have from all three rating agencies into positive ratings actions.