VERY good advice about your password. Originally sent on STaTus BBS, and reprinted here by permission of the author. Message : 9359 [Open] 3-31-91 9:40am From : Murray Moffatt To : Jon Clarke (x) Subject : #9344 hi Sig(s) : 1 (General) Speaking of passwords, I think it's probably a good idea that someone should advise our new (and not so new) users on the art of picking passwords. Anybody volunteer? Speak now or forever hold your peace? No? Ok, I'll take it on myself to do this. Your password is the only thing that stands between you and some nasty haker-type person. Your username is common knowledge to everybody that uses the system, so you must keep your password secret. This means not telling people, or lending it to people, or writing it down and sticking it to your screen, or anything like that. It also means that you must choose your password carefully. Recent experiements have shown that 25% of people choose passwords that can easily be hacked. The method that is most often used to hack a password is called the 'dictionary hack'. The hacker gets a dictionary and goes through it trying each word as the password. Of course he doesn't do this by hand, he writes a little prog to do it, and the dictionary is a file of words. So, if you use a word that is found in the dictionary, you'll be found out. Just stop for a second and think if any of your passwords are words that are found in the dictionary? So, how do you combat this? Simple, don't choose words from the dictionary! But at the same time it's not a good idea to use dates, number plates, phone numbers, etc. The best ways are to make us words. Simply string two or more words together to form a new word. For example, BLADE and RUNNER may be in the dictionary, but I'll bet that BLADERUNNER or BLADE-RUNNER or BLADE.RUNNER isn't! You can also use the initial letters from words of a phrase. For example, Three Blind Mice Ran Up The Clock would translate to a password of TBMRUTC. Looks like a nonsense word, doesn't it? But it means something to you, you just have to remember the phrase. Also, remember not to use the same password on different systems. I know that this is a hard thing not to do, but try to have different passwords on each board you use. And change the passwords regularly. Where I work all the passwords expire after 30 days, and you're forced to enter a new one. Some systems, like IBM systems, remember the last 5 or so passwords that you've used, and won't let you re-use them. They also force you to have at least one digit in the password and other things as well. Oh, and one last thing. There are a whole lot of commonly used passwords. These passwords are used so often by people, that the hacker will always try these first. Heres a list that I grabbed of Usenet that someone posted of the most commonly used passwords: alt/security/ 369 From: jsax@cdp.UUCP Subject: Re: OVERUSED PASSWORDS Date: 9 Jan 91 05:08:00 GMT Nf-ID: #R:cdp:1159900002:cdp:1159900003:000:6649 Nf-From: cdp.UUCP!jsax Jan 8 21:08:00 1991 Taken from 'A Novice's Guide to Hacking- 1989 Edition' by The Mentor LOD/H Password List ============= aaa daniel jester rascal academia danny johnny really ada dave joseph rebecca adrian deb joshua remote aerobics debbie judith rick airplane deborah juggle reagan albany december julia robot albatross desperate kathleen robotics albert develop kermit rolex alex diet kernel ronald alexander digital knight rosebud algebra discovery lambda rosemary alias disney larry roses alpha dog lazarus ruben alphabet drought lee rules ama duncan leroy ruth amy easy lewis sal analog eatme light saxon anchor edges lisa scheme andy edwin louis scott andrea egghead lynne scotty animal eileen mac secret answer einstein macintosh sensor anything elephant mack serenity arrow elizabeth maggot sex arthur ellen magic shark asshole emerald malcolm sharon athena engine mark shit atmosphere engineer markus shiva bacchus enterprise marty shuttle badass enzyme marvin simon bailey euclid master simple banana evelyn maurice singer bandit extension merlin single banks fairway mets smile bass felicia michael smiles batman fender michelle smooch beauty fermat mike smother beaver finite minimum snatch beethoven flower minsky snoopy beloved foolproof mogul soap benz football moose socrates beowulf format mozart spit berkeley forsythe nancy spring berlin fourier napoleon subway beta fred network success beverly friend newton summer bob frighten next super brenda fun olivia support brian gabriel oracle surfer bridget garfield orca suzanne broadway gauss orwell tangerine bumbling george osiris tape cardinal gertrude outlaw target carmen gibson oxford taylor carolina ginger pacific telephone caroline gnu painless temptation castle golf pam tiger cat golfer paper toggle celtics gorgeous password tomato change graham pat toyota charles gryphon patricia trivial charming guest penguin unhappy charon guitar pete unicorn chester hacker peter unknown cigar harmony philip urchin classic harold phoenix utility coffee harvey pierre vicky coke heinlein pizza virginia collins hello plover warren comrade help polynomial water computer herbert praise weenie condo honey prelude whatnot condom horse prince whitney cookie imperial protect will cooper include pumpkin william create ingres puppet willie creation innocuous rabbit winston creator irishman rachmaninoff wizard cretin isis rainbow wombat daemon japan raindrop yosemite dancer jessica random zap ----snip-----snip----------- The Internet Worm used a lot of the above passwords in it's first password pass. After that it just used the dictionary, etc. It'd really be worth it to check this list when people change passwords. That plus 1-2 month password expire is good security. It's amazing how many people use SECRET or MODEM for their password. Not to mention using their first name.. Jon "God hates me." vector0!jon@sactoh0.SAC.CA.US "Hate 'im back, works for me." ...ames!pacbell!sactoh0!vector0!jon alt/security/ 372 From: shipley@remarque.berkeley.edu (Pete Shipley) Subject: Re: OVERUSED PASSWORDS Date: 10 Jan 91 01:58:06 GMT Organization: Processed People for a Processed America In article <1159900002@cdp> jsax@cdp.UUCP writes: > >I received this from a respondent to my article on alt.security >recently. Is your password on the list? (Tell me! Tell me!) > > These are passwords that were used by the Internet worm, and >are included in COPS. > > >aaa I person would be crazy to admit there password is on that list, because you will be able to crack that persons account in less then two minutes using telnet. Note that list is used my everyone, it is effective on non-educated users but since every password checker written in the last five years has this list (or the list the internet worm was built from) it is not as useful as it once was for password cracking. I suggest aquiring a list of female names, I have had the most sucess with those lists. My 8mm tape collection used a list of common last names, female names, male names, the worm list, /usr/dict/words (from SunOS 4.1) and the word list from Webster's 7th Collegiate Dictionary, plus a list I put together (contains default password some OS's come with). -Pete Pete Shipley: email: shipley@berkeley.edu Flames: cimarron@postgres.berkeley.edu uunet!lurnix!shipley or ucbvax!shipley or apple!nli!{root,shipley} Spelling corections: /dev/null Quote: "Anger is an energy" ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::  .