eBook Review: The Password Management Guide

Let's be honest.  Most people have a small set of passwords they reuse on multiple websites.  They come up with a password they think is secure, but by reusing the password on multiple sites, a compromise of one account results in a compromise of the rest.

But nobody would want to hack you, right?  Wrong.  There's a lot of value in a compromised account.

• Do you use Amazon.com? A compromised account can order goods and have them shipped to a different address.
• Do you use PayPal? A compromised account could wipe out your bank account.
• Do you email family and friends? A compromised account could be used by scammers to trick your family and friends into sending money through Western Union to the scammer overseas.
• Do you use social networking? A compromised account could be used to spam your friends

But remembering multiple, complex passwords is hard!!!!

It doesn't have to be.

I was very impressed by the information contained within The Password Management Guide.

The guide covers the following topics and more:

• Dangers of password re-use
• How to create a secure password
• Examples of available password manager programs
• Two-factor Authentication
• How to monitor to see if your password has been compromised

I found the guide very well written, and it should be extremely useful to anyone regardless of "tech savvy" level.

And the good news is, for a limited time you can get the 35 page eBook FREE!

Download Here!

Do you like the guide? Hate it? Feel free to let me know in the comments section below.

Hacking the News for Profit - Stock Short Selling

Today the Associated Press' Twitter account was hacked (quite possibly as the result of a sophisticated spear phishing campaign), and started posting fake news headlines.  Specifically, a news headline was posted that there were multiple explosions in the White House, and that the president had been injured.

And while the fact that @AP was compromised was fascinating, what happened next is what should really get your attention.  Shortly after the fake headline was posted, the Dow Jones plummeted 150 points.

While the stock market recovered quickly after the news turned out to be fake, someone could have potentially made millions.

If someone knew when and what stocks were going to drop due to the hacked Twitter account's announcement, they could have performed a short sell on the affected stock(s).

Even if the affected stocks only provided a 1% return, a short on $100,000,000 worth of stocks would result in a $1,000,000 profit.

Something tells me this won't be the last time we see stocks affected by a hacked social media account announcing fake news.  There's a potential for great profit in it.

Root @th3j35t3r with Google Chrome

Today we're going to have a lesson on password strength and software vulnerabilities.

Disclaimer: Th3J35t3r's site has served targeted malware in the past designed to capture data... especially from members of Anonymous. Perform these steps at your own risk!

There's something interesting afoot on The Jester's website...


In the upper right corner there's a little "Pi" symbol.  If you've ever watched the movie "The Net" you know that interesting secrets are beneath the Pi symbol.

After clicking on the Pi icon you are presented with a UNIX style login prompt.

The login prompt allows you to login with the username "guest" and no password.  However any attempts to login with "root" are met with a password prompt.

And you Thought your Password Requirements Were Bad...

Apparently everything is bigger in Texas, including ridiculousness of password requirements...

From http://portal.cs.oag.state.tx.us/OAGStaticContent/portal/login/help/ChangePassword.htm

Remember that the new password must fulfill these requirements:

1. The password must be exactly 8 characters long.
2. It must contain at least one letter, one number, and one special character.
3. The only special characters allowed are: @ # $
4. A special character must not be located in the first or last position.
5. Two of the same characters sitting next to each other are considered to be a “set.” No “sets” are allowed.
6. Avoid using names, such as your name, user ID, or the name of your company or employer.
7. Other words that cannot be used are Texas, child, and the months of the year.
8. A new password cannot be too similar to the previous password.
1. Example: previous password - abc#1234, acceptable new password - acb$1243
2. Characters in the first, second, and third positions cannot be identical. (abc*****)
3. Characters in the second, third, and fourth positions cannot be identical. (*bc#****)
4. Characters in the sixth, seventh, and eighth positions cannot be identical. (*****234)
9. A password can be changed voluntarily (no Help Desk assistance needed) once in a 15-day period. If needed, the Help Desk can reset the password at any time.
10. The previous 8 passwords cannot be reused.

Ducati Motorcycle Default Password Vulnerability.

There's an interesting vulnerability writeup at osvdb.org detailing how to gain unauthorized access to a Ducati Motorcycle using the default ignition password.  Apparently by default the ignition password is set to the last 4 digits of the motorcycle's VIN number.

"Listening" to a Password Cracker

I used the P22.com Music Text Composition Generator to create music using attempted usernames and passwords I gathered during just one cracking attempt at my honeypot.  The music is recorded at 2400 BPM using Lead 8 (bass + lead).

I feel the music has an electrifying video game feel to it.  The purpose of this video is to raise online security awareness.  I hope you enjoy it!

YouTube Link

More password analysis

As more passwords are processed by my honeypot, I've decided to publish the password list in "cloud" format in addition to the raw data.  I feel this visualization is rather insightful, and shows interesting trends in password attempts.

Password Cloud

Interestingly enough is the fact that the most attempted password is "branburica".  A Google Search does not yield much info.

Password Cracker Analysis

Well I'm excited to say that just after a day of running Project Picnic Basket, I've already had someone stumble upon my SSH server and crack the password.

This was clearly an unintelligent cracker, which kept trying to crack the password after successfully cracking it.

I have taken the passwords which were used in the cracking attempt and dumped them into a nice Google Docs spreadsheet: Project Picnic Basket Cracked Passwords

Is your password on there?

I will update the list as I receive more crack attempts.

A little note on Password Strength

I've always wondered why organizations encourage such strict, hard to remember, password combinations, ultimately resulting in the user being forced to write down the password, making the password less secure.

xkcd, a web comic, defines the problem perfectly...xkcd: Password Strength