## Five Steps to Avoid Getting Hacked

JMiks/Shutterstock.com

May 28, 2013

## related stories

It took three hackers less than a day to decipher the majority of a list of 16,000 encrypted passwords, all because of the laughably easy-to-crack passwords most of us pick to protect our online lives. The most successful guy got 90 percent of the "plains," as hackers call deciphered passwords in 20 hours; the least successful guy just 62 percent of them in about an hour. Yes, it's really that easy. But, rather than sit there, shocked at how little security passwords provide, we should use this Ars Technica article as a lesson in password security. And, the first lesson learned therein is: Never, ever use a six character password.

Rule 1: Six characters is too always too short. The very easiest and the first thing all of Ars's hackers did was guess your super weak six character passwords, via what's called a "brute force" attack. See, the most successful of the hackers, Jeremi Gosney, a password expert with Stricture Consulting Group, hacked 62 percent of the list in sixteen minutes because that's how easy it is to guess a code that's just six letters long:

Gosney's first stage cracked 10,233 hashes, or 62 percent of the leaked list, in just 16 minutes. It started with a brute-force crack for all passwords containing one to six characters, meaning his computer tried every possible combination starting with "a" and ending with "//////." Because guesses have a maximum length of six and are comprised of 95 characters—that's 26 lower-case letters, 26 upper-case letters, 10 digits, and 33 symbols—there are a manageable number of total guesses. This is calculated by adding the sum of 956 + 955 + 954 + 953 + 952 + 95. It took him just two minutes and 32 seconds to complete the round, and it yielded the first 1,316 plains of the exercise.

"Normally I start by brute-forcing all characters from length one to length six because even on a single GPU, this attack completes nearly instantly with fast hashes," Gosney told Ars.

Rule 2: So is a seven- and eight-character password, probably. After doing almost nothing to guess six-character passwords, it gets a tiny bit harder for hackers, but not much. For example, Gosney then did more of these types of guessing attacks with different permutations of longer possibilities, trying seven or eight character passwords with only lower case letters, for example. That technique takes mere seconds, and in this case revealed many additional "plains."

(Image via JMiks/Shutterstock.com)

## JOIN THE DISCUSSION

Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

• Modernizing IT for Mission Success

Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

• Communicating Innovation in Federal Government

Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

• Effective Ransomware Response

This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.