214 lines
11 KiB
Plaintext
214 lines
11 KiB
Plaintext
|
VERY good advice about your password.
|
|||
|
|
Originally sent on STaTus BBS, and reprinted here by permission of the author.
|
|||
|
|
|
|||
|
|
Message : 9359 [Open] 3-31-91 9:40am
|
|||
|
|
From : Murray Moffatt
|
|||
|
|
To : Jon Clarke (x)
|
|||
|
|
Subject : #9344 hi
|
|||
|
|
Sig(s) : 1 (General)
|
|||
|
|
|
|||
|
|
Speaking of passwords, I think it's probably a good idea that someone
|
|||
|
|
should advise our new (and not so new) users on the art of picking
|
|||
|
|
passwords. Anybody volunteer? Speak now or forever hold your peace? No?
|
|||
|
|
Ok, I'll take it on myself to do this.
|
|||
|
|
|
|||
|
|
Your password is the only thing that stands between you and some nasty
|
|||
|
|
haker-type person. Your username is common knowledge to everybody that
|
|||
|
|
uses the system, so you must keep your password secret. This means not
|
|||
|
|
telling people, or lending it to people, or writing it down and sticking
|
|||
|
|
it to your screen, or anything like that.
|
|||
|
|
|
|||
|
|
It also means that you must choose your password carefully. Recent
|
|||
|
|
experiements have shown that 25% of people choose passwords that can
|
|||
|
|
easily be hacked. The method that is most often used to hack a password is
|
|||
|
|
called the 'dictionary hack'. The hacker gets a dictionary and goes
|
|||
|
|
through it trying each word as the password. Of course he doesn't do this
|
|||
|
|
by hand, he writes a little prog to do it, and the dictionary is a file of
|
|||
|
|
words. So, if you use a word that is found in the dictionary, you'll be
|
|||
|
|
found out. Just stop for a second and think if any of your passwords are
|
|||
|
|
words that are found in the dictionary?
|
|||
|
|
|
|||
|
|
So, how do you combat this? Simple, don't choose words from the
|
|||
|
|
dictionary! But at the same time it's not a good idea to use dates,
|
|||
|
|
number plates, phone numbers, etc. The best ways are to make us words.
|
|||
|
|
Simply string two or more words together to form a new word. For example,
|
|||
|
|
BLADE and RUNNER may be in the dictionary, but I'll bet that BLADERUNNER
|
|||
|
|
or BLADE-RUNNER or BLADE.RUNNER isn't! You can also use the initial
|
|||
|
|
letters from words of a phrase. For example, Three Blind Mice Ran Up The
|
|||
|
|
Clock would translate to a password of TBMRUTC. Looks like a nonsense
|
|||
|
|
word, doesn't it? But it means something to you, you just have to remember
|
|||
|
|
the phrase.
|
|||
|
|
|
|||
|
|
Also, remember not to use the same password on different systems. I know
|
|||
|
|
that this is a hard thing not to do, but try to have different passwords
|
|||
|
|
on each board you use. And change the passwords regularly. Where I work
|
|||
|
|
all the passwords expire after 30 days, and you're forced to enter a new
|
|||
|
|
one. Some systems, like IBM systems, remember the last 5 or so passwords
|
|||
|
|
that you've used, and won't let you re-use them. They also force you to
|
|||
|
|
have at least one digit in the password and other things as well.
|
|||
|
|
|
|||
|
|
Oh, and one last thing. There are a whole lot of commonly used passwords.
|
|||
|
|
These passwords are used so often by people, that the hacker will always
|
|||
|
|
try these first.
|
|||
|
|
|
|||
|
|
Heres a list that I grabbed of Usenet that someone posted of the most
|
|||
|
|
commonly used passwords:
|
|||
|
|
|
|||
|
|
alt/security/ 369
|
|||
|
|
From: jsax@cdp.UUCP
|
|||
|
|
Subject: Re: OVERUSED PASSWORDS
|
|||
|
|
Date: 9 Jan 91 05:08:00 GMT
|
|||
|
|
Nf-ID: #R:cdp:1159900002:cdp:1159900003:000:6649
|
|||
|
|
Nf-From: cdp.UUCP!jsax Jan 8 21:08:00 1991
|
|||
|
|
|
|||
|
|
Taken from
|
|||
|
|
'A Novice's Guide to Hacking- 1989 Edition'
|
|||
|
|
by
|
|||
|
|
The Mentor LOD/H
|
|||
|
|
|
|||
|
|
Password List
|
|||
|
|
=============
|
|||
|
|
|
|||
|
|
aaa daniel jester rascal
|
|||
|
|
academia danny johnny really
|
|||
|
|
ada dave joseph rebecca
|
|||
|
|
adrian deb joshua remote
|
|||
|
|
aerobics debbie judith rick
|
|||
|
|
airplane deborah juggle reagan
|
|||
|
|
albany december julia robot
|
|||
|
|
albatross desperate kathleen robotics
|
|||
|
|
albert develop kermit rolex
|
|||
|
|
alex diet kernel ronald
|
|||
|
|
alexander digital knight rosebud
|
|||
|
|
algebra discovery lambda rosemary
|
|||
|
|
alias disney larry roses
|
|||
|
|
alpha dog lazarus ruben
|
|||
|
|
alphabet drought lee rules
|
|||
|
|
ama duncan leroy ruth
|
|||
|
|
amy easy lewis sal
|
|||
|
|
analog eatme light saxon
|
|||
|
|
anchor edges lisa scheme
|
|||
|
|
andy edwin louis scott
|
|||
|
|
andrea egghead lynne scotty
|
|||
|
|
animal eileen mac secret
|
|||
|
|
answer einstein macintosh sensor
|
|||
|
|
anything elephant mack serenity
|
|||
|
|
arrow elizabeth maggot sex
|
|||
|
|
arthur ellen magic shark
|
|||
|
|
asshole emerald malcolm sharon
|
|||
|
|
athena engine mark shit
|
|||
|
|
atmosphere engineer markus shiva
|
|||
|
|
bacchus enterprise marty shuttle
|
|||
|
|
badass enzyme marvin simon
|
|||
|
|
bailey euclid master simple
|
|||
|
|
banana evelyn maurice singer
|
|||
|
|
bandit extension merlin single
|
|||
|
|
banks fairway mets smile
|
|||
|
|
bass felicia michael smiles
|
|||
|
|
batman fender michelle smooch
|
|||
|
|
beauty fermat mike smother
|
|||
|
|
beaver finite minimum snatch
|
|||
|
|
beethoven flower minsky snoopy
|
|||
|
|
beloved foolproof mogul soap
|
|||
|
|
benz football moose socrates
|
|||
|
|
beowulf format mozart spit
|
|||
|
|
berkeley forsythe nancy spring
|
|||
|
|
berlin fourier napoleon subway
|
|||
|
|
beta fred network success
|
|||
|
|
beverly friend newton summer
|
|||
|
|
bob frighten next super
|
|||
|
|
brenda fun olivia support
|
|||
|
|
brian gabriel oracle surfer
|
|||
|
|
bridget garfield orca suzanne
|
|||
|
|
broadway gauss orwell tangerine
|
|||
|
|
bumbling george osiris tape
|
|||
|
|
cardinal gertrude outlaw target
|
|||
|
|
carmen gibson oxford taylor
|
|||
|
|
carolina ginger pacific telephone
|
|||
|
|
caroline gnu painless temptation
|
|||
|
|
castle golf pam tiger
|
|||
|
|
cat golfer paper toggle
|
|||
|
|
celtics gorgeous password tomato
|
|||
|
|
change graham pat toyota
|
|||
|
|
charles gryphon patricia trivial
|
|||
|
|
charming guest penguin unhappy
|
|||
|
|
charon guitar pete unicorn
|
|||
|
|
chester hacker peter unknown
|
|||
|
|
cigar harmony philip urchin
|
|||
|
|
classic harold phoenix utility
|
|||
|
|
coffee harvey pierre vicky
|
|||
|
|
coke heinlein pizza virginia
|
|||
|
|
collins hello plover warren
|
|||
|
|
comrade help polynomial water
|
|||
|
|
computer herbert praise weenie
|
|||
|
|
condo honey prelude whatnot
|
|||
|
|
condom horse prince whitney
|
|||
|
|
cookie imperial protect will
|
|||
|
|
cooper include pumpkin william
|
|||
|
|
create ingres puppet willie
|
|||
|
|
creation innocuous rabbit winston
|
|||
|
|
creator irishman rachmaninoff wizard
|
|||
|
|
cretin isis rainbow wombat
|
|||
|
|
daemon japan raindrop yosemite
|
|||
|
|
dancer jessica random zap
|
|||
|
|
|
|||
|
|
----snip-----snip-----------
|
|||
|
|
|
|||
|
|
The Internet Worm used a lot of the above passwords in it's first
|
|||
|
|
password pass. After that it just used the dictionary, etc.
|
|||
|
|
|
|||
|
|
It'd really be worth it to check this list when people change
|
|||
|
|
passwords. That plus 1-2 month password expire is good security.
|
|||
|
|
|
|||
|
|
It's amazing how many people use SECRET or MODEM for their
|
|||
|
|
password. Not to mention using their first name..
|
|||
|
|
|
|||
|
|
|
|||
|
|
Jon "God hates me."
|
|||
|
|
vector0!jon@sactoh0.SAC.CA.US "Hate 'im back, works for me."
|
|||
|
|
...ames!pacbell!sactoh0!vector0!jon
|
|||
|
|
|
|||
|
|
|
|||
|
|
alt/security/ 372
|
|||
|
|
From: shipley@remarque.berkeley.edu (Pete Shipley)
|
|||
|
|
Subject: Re: OVERUSED PASSWORDS
|
|||
|
|
Date: 10 Jan 91 01:58:06 GMT
|
|||
|
|
Organization: Processed People for a Processed America
|
|||
|
|
|
|||
|
|
In article <1159900002@cdp> jsax@cdp.UUCP writes:
|
|||
|
|
>
|
|||
|
|
>I received this from a respondent to my article on alt.security
|
|||
|
|
>recently. Is your password on the list? (Tell me! Tell me!)
|
|||
|
|
>
|
|||
|
|
> These are passwords that were used by the Internet worm, and
|
|||
|
|
>are included in COPS.
|
|||
|
|
>
|
|||
|
|
>
|
|||
|
|
>aaa
|
|||
|
|
|
|||
|
|
I person would be crazy to admit there password is on that list,
|
|||
|
|
because you will be able to crack that persons account in less then two
|
|||
|
|
minutes using telnet.
|
|||
|
|
|
|||
|
|
Note that list is used my everyone, it is effective on non-educated
|
|||
|
|
users but since every password checker written in the last five years
|
|||
|
|
has this list (or the list the internet worm was built from) it is not
|
|||
|
|
as useful as it once was for password cracking. I suggest aquiring a
|
|||
|
|
list of female names, I have had the most sucess with those lists.
|
|||
|
|
|
|||
|
|
My 8mm tape collection used a list of common last names, female names,
|
|||
|
|
male names, the worm list, /usr/dict/words (from SunOS 4.1) and the
|
|||
|
|
word list from Webster's 7th Collegiate Dictionary, plus a list I put
|
|||
|
|
together (contains default password some OS's come with).
|
|||
|
|
|
|||
|
|
-Pete
|
|||
|
|
|
|||
|
|
Pete Shipley:
|
|||
|
|
email: shipley@berkeley.edu Flames:
|
|||
|
|
cimarron@postgres.berkeley.edu
|
|||
|
|
uunet!lurnix!shipley or ucbvax!shipley or apple!nli!{root,shipley}
|
|||
|
|
Spelling corections: /dev/null Quote: "Anger is an energy"
|
|||
|
|
|
|||
|
|
|
|||
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|||
|
|
|