Welcome!

Java IoT Authors: Elizabeth White, Stefan Bernbo, Harry Trott, Liz McMillan, Pat Romanski

Related Topics: Cloud Security, Java IoT, Mobile IoT, Microsoft Cloud, Linux Containers

Cloud Security: Article

A Complex Password May Not Be a Strong Password

Anything you can do to be non-standard and random in creating a password will afford you a reasonably high degree of protectiion

(This content was originally posted on JasonPalmer.com.)

Just because your password meets complexity requirements does not necessarily make it a strong password. It is a given that many sites require you to have a password of a minimum length of at least six or eight characters, and some go so far as to require the addition of a number and at least one upper case letter. At first glance, this gives the appearance of a complex password that, in theory, should be harder to crack. If we consider a blind brute force attack that starts at six characters with “000000” and cycles through every combination of upper and lower case letters and numbers through “zzzzzz”, this is essentially true.

The problem is that automated password attacks have become intelligent in the sense that hackers have added “Pattern Matching” and LEET algorithms. (LEET refers to the substitution of a character in a word with a corresponding number or special character. Read more about LEET in Wikipedia here.)

In my article, “Strengthening Common Passwords”, I discuss that Hackers will look first to the most common passwords. For example, “123456” is first and “Password” is fourth on the list of common passwords. This fact reduces the need to even begin a brute force attack on your Password until thousands of common words, phrases, and numbers such as Sports Teams, Birth Years in the 1900’s, Popular Baby Names, Movie Titles, and Fictional Characters have been tried first through a pattern match attack.

This is just the tip of the iceberg in breaking a password that appears to be complex.

If we start with a common password, “yankees” and modify it to meet complexity requirements, it might become “Yankees1” which is not necessarily any more secure than if it were all lower case without the addition of the number. Applying “Pattern Matching”, what would be the most obvious “Pattern” modification to any common word (password) to meet complexity requirements? Answer: The capitalization of the first letter, which follows standard English Grammar rules and the addition of the number 1 or even 12. Even adding LEET so the password becomes [email protected] is not really a significant improvement because the next “pattern” applied in the attack to the well-known password list will be LEET substitutions.

How many of you just realized that your own password that properly met complexity requirements is not nearly as strong as you thought it was sixty seconds ago?

A pattern match attack program will first try making common pattern modifications to its list of well-known passwords before it starts a brute force sequential search. This will significantly increase the chances of success with minimal increase in the time required to crack your password.

Some of you are thinking, my password is really strong, it’s “1234qwerUIOP”. “No one could possibly guess that password, right? Again, on a pure sequential, brute force attack, to break a twelve character, non-dictionary password is a very long time. If we look closely at this password we see that it is three groups of four sequential characters from a standard computer keyboard: “1234” are the first four numbers of the numeral row, “qwer” are the first four characters of the top row, and “UIOP” are the last four letters of the top row. In short: it is a common pattern used for a password.

In order for a Password to be strong, it needs to be more than complex. It needs to be sufficiently long and suitably random to be truly effective.

Before you decide to abandon all online banking and social media activity for fear that almost no password you could create could ever be strong enough to protect your digital accounts, keep in mind a few key points: The above discussion applies to a hacker making a concerted specific effort to crack your password to gain access to one of your digital accounts. The likelihood that you will be a specific “high value” target is minimal. Again, I go back to my analogy that car thieves look for unlocked cars with the keys in the ignition.

The key take away is to make it as difficult as possible so that the hacker gives up after trying obvious well-known Passwords with or without Pattern Matching algorithms applied and moves on to someone else.

Follow best practices by trying to make your passwords sufficiently long with at least eight characters, use upper and lower case letters (if recognized as different by your particular web site account), always include a few numbers either as substitutions for letters (LEET) or as additional characters added at random places in the Password (do not just put at the beginning or end), and where permitted, try to do the same with special characters such as @ $ %! # by placing them at random locations in the Password.

As a closing example looking back to “yankees”, we can even make it reasonably strong by applying all of the techniques so that it becomes “y@!nk3#3”. (Note that it uses LEET and adds in two special characters in random locations.) Even though we start with a very common password, “yankees”, a pattern match attack will most likely fail and the only option for the hacker will be to use a brute force sequential search.

Finally, you can also use “Patterns” to your advantage. (The Patterns which just capitalize the first letter, add a number 1 at the end or only use LEET on a well-known common password or dictionary word should not be used.)

In an effort to be able to remember your passwords you can create a non-obvious pattern to strengthen your common passwords: Perhaps you always add a # after the third letter and an ! before the last letter or instead of using a U in your spelling, you always use a V.

Anything you can do to be non-standard and appear random in creating your Password will afford you a reasonably high degree of protection from hackers who use common, pattern match and brute force passwords attacks.

Technical Note: The ability of a brute force sequential attack to succeed in cracking your Password depends largely on who is behind the attack and the amount of computer power brought to the task. A Hacker with a single computer may take months or centuries to crack your sufficiently long complex random password. A Hacker who has tens of thousands of zombie PC’s coordinating an attack will take significantly less time to be successful. If a Government Security Agency is behind the attack, with that amount of computer power, it might be a matter of hours or days to crack your password.

As scary as this all sounds, the provider of your digital account can go a long way to slow these attacks to a crawl. Many web sites will not allow another login attempt for a certain period of time after three to five login failures or will lock the account completely after five or ten login attempts. No automated attack can proceed if the web site will not allow a login due to failed attempts – human or automated.

More Stories By Shelly Palmer

Shelly Palmer is the host of Fox Television’s "Shelly Palmer Digital Living" television show about living and working in a digital world. He is Fox 5′s (WNYW-TV New York) Tech Expert and the host of United Stations Radio Network’s, MediaBytes, a daily syndicated radio report that features insightful commentary and a unique insiders take on the biggest stories in technology, media, and entertainment.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, will demonstrate how to move beyond today's coding paradigm ...
The cloud market growth today is largely in public clouds. While there is a lot of spend in IT departments in virtualization, these aren’t yet translating into a true “cloud” experience within the enterprise. What is stopping the growth of the “private cloud” market? In his general session at 18th Cloud Expo, Nara Rajagopalan, CEO of Accelerite, explored the challenges in deploying, managing, and getting adoption for a private cloud within an enterprise. What are the key differences between wh...
SYS-CON Events has announced today that Roger Strukhoff has been named conference chair of Cloud Expo and @ThingsExpo 2016 Silicon Valley. The 19th Cloud Expo and 6th @ThingsExpo will take place on November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. "The Internet of Things brings trillions of dollars of opportunity to developers and enterprise IT, no matter how you measure it," stated Roger Strukhoff. "More importantly, it leverages the power of devices and the Interne...
"We work in the area of Big Data analytics and Big Data analytics is a very crowded space - you have Hadoop, ETL, warehousing, visualization and there's a lot of effort trying to get these tools to talk to each other," explained Mukund Deshpande, head of the Analytics practice at Accelerite, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
The idea of comparing data in motion (at the sensor level) to data at rest (in a Big Data server warehouse) with predictive analytics in the cloud is very appealing to the industrial IoT sector. The problem Big Data vendors have, however, is access to that data in motion at the sensor location. In his session at @ThingsExpo, Scott Allen, CMO of FreeWave, discussed how as IoT is increasingly adopted by industrial markets, there is going to be an increased demand for sensor data from the outermos...
UAS, drones or unmanned aircraft, no matter what you call them — this was their week. Our news stream was flooded with updates on the newly announced rules and regulations for commercial UAS from the FAA. So, naturally we have dedicated this week’s top news round up to highlight some of our favorite UAS stories.
Internet of @ThingsExpo has announced today that Chris Matthieu has been named tech chair of Internet of @ThingsExpo 2016 Silicon Valley. The 6thInternet of @ThingsExpo will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Basho Technologies has announced the latest release of Basho Riak TS, version 1.3. Riak TS is an enterprise-grade NoSQL database optimized for Internet of Things (IoT). The open source version enables developers to download the software for free and use it in production as well as make contributions to the code and develop applications around Riak TS. Enhancements to Riak TS make it quick, easy and cost-effective to spin up an instance to test new ideas and build IoT applications. In addition to...
CenturyLink has announced that application server solutions from GENBAND are now available as part of CenturyLink’s Networx contracts. The General Services Administration (GSA)’s Networx program includes the largest telecommunications contract vehicles ever awarded by the federal government. CenturyLink recently secured an extension through spring 2020 of its offerings available to federal government agencies via GSA’s Networx Universal and Enterprise contracts. GENBAND’s EXPERiUS™ Application...
In addition to all the benefits, IoT is also bringing new kind of customer experience challenges - cars that unlock themselves, thermostats turning houses into saunas and baby video monitors broadcasting over the internet. This list can only increase because while IoT services should be intuitive and simple to use, the delivery ecosystem is a myriad of potential problems as IoT explodes complexity. So finding a performance issue is like finding the proverbial needle in the haystack.
When people aren’t talking about VMs and containers, they’re talking about serverless architecture. Serverless is about no maintenance. It means you are not worried about low-level infrastructural and operational details. An event-driven serverless platform is a great use case for IoT. In his session at @ThingsExpo, Animesh Singh, an STSM and Lead for IBM Cloud Platform and Infrastructure, will detail how to build a distributed serverless, polyglot, microservices framework using open source tec...
Presidio has received the 2015 EMC Partner Services Quality Award from EMC Corporation for achieving outstanding service excellence and customer satisfaction as measured by the EMC Partner Services Quality (PSQ) program. Presidio was also honored as the 2015 EMC Americas Marketing Excellence Partner of the Year and 2015 Mid-Market East Partner of the Year. The EMC PSQ program is a project-specific survey program designed for partners with Service Partner designations to solicit customer feedbac...
Apixio Inc. has raised $19.3 million in Series D venture capital funding led by SSM Partners with participation from First Analysis, Bain Capital Ventures and Apixio’s largest angel investor. Apixio will dedicate the proceeds toward advancing and scaling products powered by its cognitive computing platform, further enabling insights for optimal patient care. The Series D funding comes as Apixio experiences strong momentum and increasing demand for its HCC Profiler solution, which mines unstruc...
The IoT is changing the way enterprises conduct business. In his session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, discussed how businesses can gain an edge over competitors by empowering consumers to take control through IoT. He cited examples such as a Washington, D.C.-based sports club that leveraged IoT and the cloud to develop a comprehensive booking system. He also highlighted how IoT can revitalize and restore outdated business models, making them profitable ...
IoT offers a value of almost $4 trillion to the manufacturing industry through platforms that can improve margins, optimize operations & drive high performance work teams. By using IoT technologies as a foundation, manufacturing customers are integrating worker safety with manufacturing systems, driving deep collaboration and utilizing analytics to exponentially increased per-unit margins. However, as Benoit Lheureux, the VP for Research at Gartner points out, “IoT project implementers often ...
"delaPlex is a software development company. We do team-based outsourcing development," explained Mark Rivers, COO and Co-founder of delaPlex Software, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
In his general session at 18th Cloud Expo, Lee Atchison, Principal Cloud Architect and Advocate at New Relic, discussed cloud as a ‘better data center’ and how it adds new capacity (faster) and improves application availability (redundancy). The cloud is a ‘Dynamic Tool for Dynamic Apps’ and resource allocation is an integral part of your application architecture, so use only the resources you need and allocate /de-allocate resources on the fly.
Connected devices and the industrial internet are growing exponentially every year with Cisco expecting 50 billion devices to be in operation by 2020. In this period of growth, location-based insights are becoming invaluable to many businesses as they adopt new connected technologies. Knowing when and where these devices connect from is critical for a number of scenarios in supply chain management, disaster management, emergency response, M2M, location marketing and more. In his session at @Th...
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to imp...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...