While there are numerous ways password breaches can occur, they generally fall into two categories: targeted attacks, where a criminal focuses on obtaining credentials to gain access, and automated attacks, which don’t deliberately target any particular user account or system but attempt to compromise on a broader scale.
Targeted attacks
Guesswork
When businesses don’t enforce sufficiently rigorous password rules, users often choose weak passwords that are easy for attackers to guess. For example, passwords based on a child or partner’s name or date of birth are easy targets. However, this type of breach does require the attacker to have some knowledge of the victim’s life, family, or interests, so it requires relatively high effort from criminals.
Industrial espionage
Despite the obvious security risk, users often write down passwords that they find difficult to remember and keep them close to their workstations. If an attacker can gain physical access to your facility, they can easily harvest these credentials for use in subsequent attacks. They could also potentially install keylogging software on your users’ PCs, allowing them to capture passwords as users type them.
Automated attacks
Brute-force Attacks
Attackers can use brute-forcing tools to test your authentication process by trying millions of combinations of usernames and passwords automatically. Combining these tools with the huge lists of passwords harvested from previous breaches that are available on the dark web can massively improve the odds of success—because despite all advice to the contrary, many people use the same password across some (or all) of their online accounts. This means that if even one of a user’s online services suffers a data breach and their password finds its way onto a password list, criminals can easily breach all of their other accounts, too. For a more in-depth look at brute force attacks, read this blog on everything you need to know about brute force attacks.
Phishing
Phishing is an example of “playing the man and not the ball”. Instead of attempting to steal passwords directly, an attacker using phishing tries to trick users into freely volunteering their username, password, and other personal information to the attacker. For example, an attacker could send an email that purports to be from the user’s bank and includes a link to a fake website that looks just like the bank’s login page. If the user falls for it and enters their username and password, the information is sent to the attacker, not the bank.
Phishing attempts are often blocked by email services, yet even experienced users can be fooled—the success rate doesn’t need to be high for it to pay dividends. Automated tools enable attackers to send out millions of phishing emails every day, and if even a small percentage get through to vulnerable users, the scam will pay off.
Hacking
The most serious, high-profile, and embarrassing password breaches occur when attackers are able to break into company systems and access users’ password data directly. These days, it’s rare for companies to store passwords in plain text. However, if the passwords are hashed, once attackers get hold of the data, they can use automated tools to crack the hashes and obtain the original passwords.
In some cases, these types of breaches may leak thousands or even millions of passwords in a single attack, making them one of your IT security team’s worst nightmares.
