With breaches and cyber-attacks continually increasing every year, a constant stream of compromised passwords finds their way to the dark web for purchase and use. This should NOT be a surprise. 80% of breaches involved stolen or misused credentials1. And this makes sense … why use advanced attack techniques when stealing credentials and assuming user identities is easier, less detectable, and still works?
Stealthbits leverages the “Have I Been Pwned” breach password dictionary within StealthAUDIT and StealthINTERCEPT Enterprise Password Enforcer to search for the existence of and proactively prevent the use of over 500 million passwords from being used inside our customers’ Active Directory environments. As of Friday, June 19th, Troy Hunt – the dictionary’s creator and curated – added 17.3 million more bad passwords to the list, bringing the total to 572 million known bad or compromised passwords.
“…it is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords. This list should include passwords from previous breach corpuses, dictionary words, and specific words (such as the name of the service itself) that users are likely to choose.”NIST Special Publication 800-63B
It is hard to know if your organization’s credentials are at risk if you don’t check! With over 17 million new ones you not only want to check current passwords but also use the HIBP database to prevent any of the 572 million compromised passwords from being used today or any time in the future.
While some password favorites are seen repeatedly…
…maybe more importantly are the ones that are seen less frequently…
It’s easy enough to write rules to detect or exclude the most common 4.6 million passwords seen more than 50 times. Unique passwords that comprise over 99% of the database and are excellent for offline attacks. 34% of respondents said they share passwords or accounts with their coworkers2. 62% reuse the same password for work and personal accounts3. This means a breach at Gmail, LinkedIn, Sony, Home Depot, etc… can expose your user’s corporate passwords and more likely if the passwords are shared.
Both StealthINTERCEPT and StealthAUDIT can leverage the “Have I Been Pwned or HIBP” breach dictionary. StealthAUDIT inspects the current set of AD passwords to see if any compromised ones are in use. Then StealthINTERCEPT prevents any new compromised passwords from even being used. Passwords are still the first line of defense against cyber-attacks, so it’s important to ensure your users are employing good ones.
In addition to checking passwords against a breach dictionary, Stealthbits can also:
For fun, let’s take a look at the most popular passwords and how often they are used. Do your users leverage any of these?
|Clear Text Password||Hash||Number of Occurrences|
Damon is the Director of Product Marketing at Stealthbits responsible for Active Directory and Privileged Access Management solutions. He has over 20 years of experience addressing marketing challenges of all kinds for many notable, B2B software companies, including Red Hat, Quest Software, Sterling Commerce, and most recently SecureAuth. Damon has a passion for cybersecurity software and improving the defenses of organizations against cyber-attacks. Damon resides in Columbus, Ohio.
Proper data security begins with a strong foundation. Find out what you're standing on with a free deep-dive into the security of your Structured and Unstructured Data, Active Directory, and Windows infrastructure.Read more
Start a Free Stealthbits Trial!
No risk. No obligation.