Excuse Me United States, Your Password Is Showing – OpEd
By Published by the Foreign Policy Research Institute
By Lawrence Husick*
(FPRI) — A recent analysis of a new variant of a widespread ransomware attack illustrated just how sophisticated, yet simple, breaching computer security has become. The attack, known as “Emotet,” hit the Pennsylvania city of Allentown, breaking through firewalls, evading the latest antivirus software, and costing the city more than $1 million at last count. The city cannot process financial transactions, and its police department cannot access key crime databases. Although the city is working to fix its systems, the end is still not in sight.
Security research firm Fidelis Security has published its analysis of Emotet, and one feature is especially noteworthy because it demonstrates the adage that in security, people are always the weakest link. Emotet spreads through local area networks by “brute forcing” attacks using common passwords. How common? The ones used by this particular strain of malware are listed below. If your password is one of those listed, it means that you are in the vulnerable majority of business computer system users. In fact, according to one security expert, if you use one of these as your password, you would be better off just using your own name instead!
123, password, Password, letmein, 1234, 12345, 123456, 1234567, 12345678, 123456789, 1234567890, qwerty, love, iloveyou, princess, master, monkey, abc123, 99999999, 9999999, 999999, 99999, 9999, 999, 99, 9, 88888888, 8888888, 888888, 88888, 8888, 888, 88, 8, 77777777, 7777777, 777777, 77777, 7777, 777, 77, 7, 66666666, 6666666, 666666, 66666, 6666, 666, 66, 6, 55555555, 5555555, 555555, 55555, 5555, 555, 55, 5, 44444444, 4444444, 444444, 44444, 4444, 444, 44, 4, 33333333, 3333333, 333333, 33333, 3333, 333, 33, 3, 22222222, 2222222, 222222, 22222, 2222, 222, 22, 2, 11111111, 1111111, 111111, 11111, 1111, 111, 11, 1, 00000000, 0000000, 00000, 0000, 000, 00, 0987654321, 987654321, 87654321, 7654321, 654321, 54321, 4321, 321, 21, 12, super, secret, server, computer, owner, backup, database, lotus, oracle, business, manager, temporary, ihavenopass, nothing, nopassword, nopass, Internet, internet, example, sample, love123, boss123, work123, home123, mypc123, temp123, test123, qwe123, pw123, root123, pass123, pass12, pass1, admin123, admin12, admin1, password123, password12, password1, default, foobar, foofoo, temptemp, temp, testtest, test, rootroot, root, zzzzz, zzzz, zzz, xxxxx, xxxx, qqqqq, qqqq, qqq, aaaaa, aaaa, aaa, sql, file, web, foo, job, home, work, intranet, controller, killer, games, private, market, coffee, cookie, forever, freedom, student, account, academia, files, windows, monitor, unknown, anything, letitbe, domain, access, money, campus, explorer, exchange, customer, cluster, nobody, codeword, codename, changeme, desktop, security, secure, public, system, shadow, office, supervisor, superuser, share, adminadmin, mypassword, mypass, pass, Login, login, passwd, zxcvbn, zxcvb, zxccxz, zxcxz, qazwsxedc, qazwsx, q1w2e3, qweasdzxc, asdfgh, asdzxc, asddsa, asdsa, qweasd, qweewq, qwewq, nimda, administrator, Admin, admin, a1b2c3, 1q2w3e, 1234qwer, 1234abcd, 123asd, 123qwe, 123abc, 123321, 12321, 123123, James, John, Robert, Michael, William, David, Richard, Charles, Joseph, Thomas, Christopher, Daniel, Paul, Mark, Donald, George, Kenneth, Steven, Edward, Brian, Ronald, Anthony, Kevin, Mary, Patricia, Linda, Barbara, Elizabeth, Jennifer, Maria, Susan, Margaret, Dorothy, Lisa, Nancy, Karen, Betty, Helen, Sandra, Donna, Carol, james, john, robert, michael, william, david, richard, charles, joseph, thomas, christopher, daniel, paul, mark, donald, george, kenneth, steven, edward, brian, ronald, anthony, kevin, mary, patricia, linda, barbara, elizabeth, jennifer, maria, susan, margaret, dorothy, lisa, nancy, karen, betty, helen, sandra, donna, carol, baseball, dragon, football, mustang, superman, 696969, batman, trustno1
As always, security begins with user education—teaching those who use the technology how best to defend against threats. It also means teaching the sobering fact that there is no lock that cannot be picked by an adversary willing to spend the time and money to do so. Computer security is more difficult because the bad guys are able to pick the locks from literally anywhere, and the cost to attack a system may be very low because using code from others is simple and easy.
What does this mean for critical systems, such as those that tally our votes and that run our electric grid? It means that we may always be playing catch-up. It means that we must not only continuously invest in improving security of the hardware and software, but that we must continue to educate those who manage and operate the systems. Government and private sector officials must also communicate to the public that these systems are being monitored and their security is being improved constantly in response to the threats encountered because an additional target of foreign “threat actors” is public confidence in the systems themselves.
In his testimony before the Senate Armed Services Committee on February 27, Admiral Mike Rogers, who heads both the National Security Agency and US Cyber Command, stated that he has yet to be given the order to safeguard our elections from interference by Russia. “President Putin has clearly come to the conclusion that there’s little price to pay and that therefore ‘I can continue this activity,’” said Admiral Rogers, who will retire in April. “Clearly what we have done hasn’t been enough.”
Admiral Rogers was asked during the hearing whether he had the authority and the ability to disrupt the Russian cyber campaign. Admiral Rogers replied, “I don’t have the day-to-day authority to do that.” “So you would need, basically, to be directed by the president,” stated Rhode Island Senator Jack Reed. “Have you been directed to do so?” “No, I have not,” replied Admiral Rogers.
It appears that while the U.S. badly needs to play catch-up, some parts of our government have yet to take the field. With mid-term elections months away, and a general consensus among our intelligence agencies that Russia is continuing the same campaign that many believe helped put the candidate more sympathetic to the Putin regime in the White House, Americans and their allies have a right to ask if and when the orders will be given to Admiral Rogers and his agencies to defend the informational foundations of representative government.
About the author:
*Lawrence Husick is Co-Chairman of the Foreign Policy Research Institute’s Center for the Study of Terrorism where he concentrates on the study of terrorist tactics and counterterrorism strategies, with a particular focus on technology leverage as a defining characteristic of the modern terrorist.
Source:
This article was published by FPRI.
