The Top Ten Password-Cracking Techniques Used by Hackers

Understanding the password-cracking techniques hackers use to blow your online accounts wide open is a great way to ensure it never happens to you.

You certainly will always need to change your password, and sometimes more urgently than you think, but mitigating against theft is a great way to stay on top of your account security. You can always head to www.haveibeenpwned.com to check if you’re at risk, but simply thinking your password is secure enough to not be hacked into is a bad mindset to have.

So, to help you understand just how hackers get your passwords – secure or otherwise – we’ve put together a list of the top ten password-cracking techniques used by hackers. Some of the below methods are certainly outdated, but that doesn’t mean they aren’t still being used. Read carefully and learn what to mitigate against.

The Top Ten Password-cracking Techniques Used by Hackers

1. Phishing

There’s an easy way to hack, ask the user for his or her password. A phishing email leads the unsuspecting reader to a spoofed log in page associated with whatever service it is the hacker wants to access, usually by requesting the user to put right some terrible problem with their security. That page then skims their password and the hacker can go use it for their own purpose.

Why bother going to the trouble of cracking the password when the user will happily give it to you anyway?

2. Social Engineering

Social engineering takes the whole “ask the user” concept outside of the inbox that phishing tends to stick with and into the real world.

A favorite of the social engineer is to call an office posing as an IT security tech guy and simply ask for the network access password. You’d be amazed at how often this works. Some even have the necessary gonads to don a suit and name badge before walking into a business to ask the receptionist the same question face to face.

Time and again, it’s been shown that many businesses either don’t have good security in place or people are too friendly and trusting when they shouldn’t be, such as giving people access to sensitive locations because of a uniform or sob story.

3. Malware

Malware comes in many forms, such as a keylogger, also known as a screen scraper, which records everything you type or takes screenshots during a login process, and then forwards a copy of this file to hacker central.

Some malware will look for the existence of a web browser client password file and copy it, which, unless properly encrypted, will contain easily accessible saved passwords from the user’s browsing history.

4. Dictionary Attack

The dictionary attack uses a simple file containing words that can be found in a dictionary, hence its rather straightforward name. In other words, this attack uses exactly the kind of words that many people use as their password.

Cleverly grouping words together such as “letmein” or “superadministratorguy” will not prevent your password from being cracked this way – well, not for more than a few extra seconds.

5. Rainbow Table Attack

Rainbow tables aren’t as colorful as their name may imply but, for a hacker, your password could well be at the end of it. In the most straightforward way possible, you can boil a rainbow table down into a list of pre-computed hashes – the numerical value used when encrypting a password. This table contains hashes of all possible password combinations for any given hashing algorithm. Rainbow tables are attractive as it reduces the time needed to crack a password hash to simply just looking something up in a list.

However, rainbow tables are huge, unwieldy things. They require serious computing power to run and a table becomes useless if the hash it’s trying to find has been “salted” by the addition of random characters to its password ahead of hashing the algorithm.

There is talk of salted rainbow tables existing, but these would be so large as to be difficult to use in practice. They would likely only work with a predefined “random character” set and password strings below 12 characters as the size of the table would be prohibitive to even state-level hackers otherwise.

6. Spidering

Savvy hackers have realized that many corporate passwords are made up of words that are connected to the business itself. Studying corporate literature, website sales material, and even the websites of competitors and listed customers can provide the ammunition to build a custom word list to use in a brute force attack.

Really savvy hackers have automated the process and let a spidering application, similar to the web crawlers employed by leading search engines to identify keywords, and then collect and collate the lists for them.

7. Offline Cracking

It’s easy to imagine that passwords are safe when the systems they protect lock out users after three or four wrong guesses, blocking automated guessing applications. Well, that would be true if it were not for the fact that most password hacking takes place offline, using a set of hashes in a password file that has been ‘obtained’ from a compromised system.

Often the target in question has been compromised via a hack on a third party, which then provides access to the system servers and those all-important user password hash files. The password cracker can then take as long as they need to try and crack the code without alerting the target system or individual user.

8. Brute Force Attack

Similar to the dictionary attack, the brute force attack comes with an added bonus for the hacker. Instead of simply using words, a brute force attack lets them detect non-dictionary words by working through all possible alpha-numeric combinations from aaa1 to zzz10.

It’s not quick, provided your password is over a handful of characters long, but it will uncover your password eventually. Brute force attacks can be shortened by throwing additional computing horsepower, in terms of both processing power – including harnessing the power of your video card GPU – and machine numbers, such as using distributed computing models like online bitcoin miners.

9. Shoulder Surfing

Another form of social engineering, shoulder surfing, just as it implies, entails peeking over a person’s shoulders while they’re entering credentials, passwords, etc. Although the concept is very low tech, you’d be surprised how many passwords and sensitive information is stolen this way, so remain aware of your surroundings when accessing bank accounts, etc. on the go.

The most confident of hackers will take the guise of a parcel courier, aircon service technician, or anything else that gets them access to an office building. Once they are in, the service personnel “uniform” provides a kind of free pass to wander around unhindered, and make note of passwords being entered by genuine members of staff. It also provides an excellent opportunity to eyeball all those post-it notes stuck to the front of LCD screens with logins scribbled upon them.

10. Guess

The password crackers’ best friend, of course, is the predictability of the user. Unless a truly random password has been created using software dedicated to the task, a user-generated ‘random’ password is unlikely to be anything of the sort.

Instead, thanks to our brains’ emotional attachment to things we like, the chances are those random passwords are based upon our interests, hobbies, pets, family, and so on. In fact, passwords tend to be based on all the things we like to chat about on social networks and even include in our profiles. Password crackers are very likely to look at this information and make a few – often correct – educated guesses when attempting to crack a consumer-level password without resorting to dictionary or brute force attacks.

Other Attacks to Beware Of

If hackers are lacking anything, it isn’t creativity. Using a variety of techniques and adapting to ever-changing security protocols, these interlopers continue to succeed.

For example, anyone on Social Media has likely seen the fun quizzes and templates asking you to talk about your first car, your favorite food, the number one song on your 14th birthday. While these games seem harmless and they’re certainly fun to post, they’re actually an open template for security questions and account access verification answers.

When setting up an account, perhaps try using answers that don’t actually pertain to you but, that you can easily remember. “What was your first car?” Instead of answering truthfully, put your dream car instead. Otherwise, simply don’t post any security answers online.

Another way to gain access is simply resetting your password. The best line of defense against an interloper resetting your password is using an email address that you check frequently and keeping your contact information updated. If available, always enable 2-factor authentication. Even if the hacker learns your password, they can’t access the account without a unique verification code.

Best Practices to Protect Yourself from Hackers

• Maintain strong and unique passwords for all of your accounts, there are password managers available.
• Don’t click on links or download files in emails arbitrarily, it’s best to not do it at all but activation emails prevent this.
• Check for and apply security updates periodically. Most work computers might not allow this, the system administrator will take care of these things.
• When using a new computer or drive, consider using encryption. You can encrypt a HDD/SSD with data on it, but it can take hours or days because of the extra information.
• Use the notion of least privilege, which means only give access to what’s needed. Basically, create user accounts that aren’t admins for casual computer use by you or friends and family.

Frequently Asked Questions

Why do I need a different password for every site?

You probably know that you shouldn’t give out your passwords and you shouldn’t download any content you’re not familiar with, but what about the accounts you sign into every day? Suppose you use the same password for your bank account that you use for an arbitrary account like Grammarly. If Grammarly is hacked, the user then has your banking password too (and possibly your email making it even easier to gain access to all of your financial resources).

What can I do to protect my accounts?

Using 2FA on any accounts that offer the feature, using unique passwords for each account, and using a mixture of letters and symbols is the best line of defense against hackers. As stated previously, there are a lot of different ways that hackers gain access to your accounts, so other things you need to make sure that you’re doing regularly is keeping your software and apps up-to-date (for security patches) and avoiding any downloads you aren’t familiar with.

What is the safest way to keep passwords?

Keeping up with several uniquely strange passwords can be incredibly difficult. Although it’s far better to go through the password reset process than it is to have your accounts compromised, it is time-consuming. To keep your passwords safe you can use a service like Last Pass or KeePass to save all of your account passwords.

You can also use a unique algorithm to keep your passwords while making them easier to remember. For example, PayPal could be something like hwpp+c832. Essentially, this password is the first letter of each break in the URL (https://www.paypal.com) with the last number in the birth year of everyone in your home (just as an example). When you go to log into your account, view the URL which will give you the first few letters of this password.

Add symbols to make your password even more difficult to hack but organize them so that they’re easier to remember. For example, the “+” symbol can be for any accounts related to entertainment while the “!” can be used for financial accounts.

Practicing Online Safety

In a global era when communications can take place across the world seemingly in an instant, it’s important to remember that not everyone has good intentions. Protect yourself online by actively managing and updating your passwords and social media information leak awareness. Sharing is caring, but not personal information for the sake of becoming an easy target for cyber criminals.