Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×

Analyzing 20,000 MySpace Passwords 177

Posted by CmdrTaco from the thats-kinda-scary dept.
Rub3X writes "Author found 20 thousand MySpace passwords on a phishing site and did some tests on them. They were tested for strength, length and a number of other things. Also tested was the most popular password, and the most popular email service used when registering for myspace."
This discussion has been archived. No new comments can be posted.

Analyzing 20,000 MySpace Passwords More

Analyzing 20,000 MySpace Passwords

Comments Filter:
  • Slashdotted before we even being. CPU quota exceeded.
  • Site seems dead for know, but the Coral Cache [nyud.net] got the text atleast.

  • Author should have... (Score:5, Funny)

    by 10sball ( 80009 ) on Sunday September 17, 2006 @08:20AM (#16124375) Homepage
    spent some of that time analyzing the strength of his hosting plan

  • 666 - myname (Score:5, Informative)

    by vrta ( 905538 ) on Sunday September 17, 2006 @08:21AM (#16124378) Homepage
    Most common passwords used:
    13 - cookie123
    12 - iloveyou
    12 - password
    11 - abc123
    11 - fuckyou
    11 - miss4you

    • Re: (Score:3, Funny)

      by BadAnalogyGuy ( 945258 )
      That's amazing! I've got the same password on my luggage!

    • Re:666 - myname (Score:5, Insightful)

      by rednip ( 186217 ) * on Sunday September 17, 2006 @08:48AM (#16124467) Journal
      Most common passwords used:
      Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher.
      • I have to wonder how many of those top passwords were just the same person repeatedly trying without success to get into a fake site?

        • Re:666 - myname (Score:5, Insightful)

          by Tanktalus ( 794810 ) on Sunday September 17, 2006 @09:24AM (#16124586) Journal

          It depends on how smart the phisher is. If they take the password then redirect to the real MySpace account (to avoid arousing suspicions among even the gullable) where they can try again, there won't be many second-tries.

          If I were of low enough moral character to phish, that'd be what I'd do, anyway.

          • Re: (Score:2)

            by jZnat ( 793348 ) *
            You could phish for research purposes...

            • Re:666 - myname (Score:4, Funny)

              by Anonymous Coward on Sunday September 17, 2006 @02:45PM (#16125793)
              Would that be 'catch and release'?
              • While I doubt MySpace is using such a service, as a former employee of a firm that did a lot of anti-phising work, we used to identify phishing emails and send the URL's to other companies that specialized in flooding the site with bogus addresses while attempting to tie the site up and DOS just that port/virtual server. So its entirely possible the data being analized is largely bogus. Given that one of the most popular passwords was "fuckyou", I suspect there's at least a vigilante effect going on here...
        • Maybe it was actualy one person trying to cyber squat on 20 thousand myspace names in hopes that one day they would be worth something. he has a bot that auto answers email about them and logs into the site to give them a tour of thier prospective cyber home.

      • Almost (Score:5, Insightful)

        by benhocking ( 724439 ) <benjaminhocking.yahoo@com> on Sunday September 17, 2006 @09:12AM (#16124546) Homepage Journal
        "Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher" - or by people pretending to be MySpace users when targeted by a phisher - or by people giving a bogus password when targeted by a phisher.

        • Re:Almost (Score:5, Insightful)

          by flooey ( 695860 ) on Sunday September 17, 2006 @10:46AM (#16124841)
          "Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher" - or by people pretending to be MySpace users when targeted by a phisher - or by people giving a bogus password when targeted by a phisher.

          I'd imagine that's why fuckyou is up there so high. I sort of assume that's a message to the phisher rather than a real password.
          • When I'm bored, I look through my spam folder, and put fake data on the phishing websites. Is there any kind of program that automatically does it? Remember Blue Frog? What if there was a program that did the same for phishing websites.

            • Re: (Score:3, Informative)

              by devilspgd ( 652955 ) *
              It wouldn't do a ton of good since your average phisher has access to a ton of zombies they can verify a password list without triggering any IP:failedlookup ratio and banning themselves from the site.

      • Due Diligence (Score:3, Insightful)

        by bigattichouse ( 527527 )
        Due diligence would have him write a script to check which user/pass combinations were valid, and then analyze only those.

        • Re: (Score:3, Interesting)

          by jandrese ( 485 )
          Honestly, most of these pishing operations that I've seen are real lowbrow affairs. Proper engineering isn't exactly a common feature. Most of the time they don't care if 50% of the passwords (or more) don't work, all they need are a few hits to get what they need.

          • Re: (Score:3, Funny)

            by Firehed ( 942385 )
            Well, yeah, if you're phishing for bank account info. What the hell is to be gained by hijacking MySpace accounts?

            • Re: (Score:2, Funny)

              by kevlarman ( 983297 )
              you can offer to remove all the annoying backgrounds, music, movies, and spyware from the profiles of the stolen accounts, and threaten to put up even more of them if they don't pay up. it might work even better than stealing bank accounts

        • Re: (Score:3, Insightful)

          by TubeSteak ( 669689 )
          Due diligence would have him write a script to check which user/pass combinations were valid
          I think we would call that "unauthorized access"

          Methinks most people would know enough to avoid publicly admitting to testing those l/p's.

    • Re: (Score:2, Funny)

      by Deltaspectre ( 796409 )
      Pf, that can't be right, everyone knows the most common passwords are:

      God
      Sex
      Love
      and Secret

    • Re: (Score:2, Funny)

      by Anne_Nonymous ( 313852 )
      Interesting. It's only three steps from "I love you to" "Fuck you". That sounds about right.

    • Re: (Score:2, Funny)

      by hkgroove ( 791170 )
      "iloveyou"

      Damn! Tiger Tanaka has now been compromised! Must alert MI6.

    • Re: (Score:2)

      by syousef ( 465911 )
      1 - Ponies!

  • Interesting analysis, but... (Score:5, Insightful)

    by SilentChris ( 452960 ) on Sunday September 17, 2006 @08:23AM (#16124382) Homepage
    It's a fairly interesting (if not too detailed) analysis. A commenter makes a critical observation, though: these were passwords entered at the phishing site, not MySpace. As such, some people can easily recognize it's not the original site and add such gems as "fuckyou".

    Personally, I try to fit the following in every eBay phishing page I see:

    Field 1: "just who do you think you're kidding?"
    Field 2: "better luck next time, dolt."

    • Re:Interesting analysis, but... (Score:4, Interesting)

      by Daytona955i ( 448665 ) <flynnguy24 AT yahoo DOT com> on Sunday September 17, 2006 @08:57AM (#16124496)
      Also people who have stronger password probably would recognize it as a phishing site so the data is pretty much worthless. Also how many people went to the phising site, it's probably a small percentage of users.

      While the data is interesting, it really can't be used to determine anything other than the fact that some users have lame passwords.

      • Re: (Score:2)

        by setirw ( 854029 )
        Also people who have stronger password probably would recognize it as a phishing site so the data is pretty much worthless.

        Which excludes 1% of MySpace users, a negligible figure. The data is pretty accurate.

      • Re: (Score:2)

        by TheCarp ( 96830 ) *
        ha! true. Or at least people who know how to use a strong password.

        Personally, the passowrd that I us for free websites like slashdot and myspace (actually, I am not on myspace anymore, I closed the account because it was worthless at best and didn't like the idea of having my social netowork available publically)
        is weak as shit.

        Seriously, my unix boxes get strong passwords. My work accounts get strong passwords. Websites? Get a dictionary word that I picked at random 10 years ago. If i particularly think I

        • Re: (Score:2)

          by jZnat ( 793348 ) *
          So you generate a random number, encrypt that using your own throwaway key-pair (or one-time pad), and use the base64 output as your password? Actually, that'd be a good idea...

          • Re: (Score:3, Interesting)

            by TheCarp ( 96830 ) *
            Nope, I actually use a mnemonic system to hel me remeber them

            Its funny how often I have to give someone "the stare" when they ask "whats your password"... but truth is, I couldn't even rattle it off if I tried. I learn the mnemonic and the muscle memory of typing it, but I don't know it character by character.

            I have to sit down for a sec and go over the mnemonic to remeber the individual chars.

            -Steve

    • Re: (Score:2, Funny)

      by zlogic ( 892404 )
      Hehe...
      When I'm asked to enter a credit card number, I usually enter my real one. It only works in Russia, there's no money on it (and the only reason I got it was because it was free) but the bastards may be charged with CC fraud. Hell, I think there are more carders in Russia than legitimate CC owners :-)
    • True, although I actually used a long variant of fuckyou for my Windows admin password (I figure Windows is screwed against local attacks and I had its services down and firewalls up).

  • Passwords from hacker site = biased. (Score:5, Interesting)

    by Vo0k ( 760020 ) on Sunday September 17, 2006 @08:25AM (#16124393) Journal
    Say, 10% of passwords contained on a site was obtained using a dictionary attack. Then perform analysis on these password. Conclusion that basing on statistically significant number of passwords (10%, >10000) almost 100% of passwords on the site are vulnerable to dictionary attack is simply wrong - the sample was biased.
    Similar about phishing-originated passwords. Phishing is a result of bad practices on user side, and usually clicking attachments in spam, using insecure browser and no antivirus is connected with using poor quality passwords. The results WILL show worse quality of user passwords than real simply because the passwords originate from subset of users who know less of security in general (and as result, got hacked.)

  • Flawed (Score:4, Insightful)

    by schabot ( 941087 ) <`s.chabot' `at' `gmail.com'> on Sunday September 17, 2006 @08:25AM (#16124394) Homepage
    The analysis is flawed as a general indicator of MySpace passwords because it is only a subset of people who would actually fall for phishing attacks. Of course such people will have horrible password habits

    Now, I am changing my password to cookie321, no one will see that coming.

    • Re: (Score:2)

      by setirw ( 854029 )
      Then again, how many MySpace users wouldn't fall for a phishing scheme? :)

      It's probably pretty accurate.

    • Re: (Score:3, Informative)

      by tomhudson ( 43916 )

      "Now, I am changing my password to cookie321, no one will see that coming."

      No, no - you have to change it to "wookie321". The glove won't fit, and Endor something or other ...

      Seriously, who even cares about the passwords to myspace. The "numeric strength" so-called "analysis" was screwed up. Since myspace requires a number in the password, a lot of people put their name and a digit or two after it as their account password. They also sometimes screw up their email address info, which is how you can end

      • Re:Flawed (Score:5, Insightful)

        by Zapman ( 2662 ) on Sunday September 17, 2006 @10:31AM (#16124794)
        This is what it is. It's an analysis of passwords, obtained by a script kiddie's phishing site. The author makes no claims to 'analysing the strength of every myspace password' or some such. All the information you need to analyze his results are right there.

        He didn't 'choose' to study this... the data fell into his hands, and he offered analysis.

        This is a great little 'news for nerds' thing. The author says he has this data, he's smart enough not to publish it (just the analysis), he gives some interesting results from raw analysis of the 'data'. Take the story for what it is: Sunday morning on Slashdot.

        • Re: (Score:3, Insightful)

          by tomhudson ( 43916 )

          My point was (if you had read the article) that his claim that he was able to measure the strength of the passwords was flawed. There were passwords that myspace couldn't have accepted as valid passwords because they require at least one digit (so "fuckyou" couldn't have been a password).

          The "known bad" data should have been dropped immediately.

          • And then what? Twiddle his thumb? Commission a new phishing scam? It was something to do for this guy which is interesting.

              Myspace only recently started to require stronger passwords. My password for the site has no number in it.
      • and how the #@%^$ am I supposed to contact them and tell them - "Hey, you have a typo in your email address - I'm getting all these stupid "'I heart cats' would like to be added as one of your friends" messages ..
        Change their password. delete the account. They had it for only a couple of days anyway if you get their "welcome to myspace" email. They'll just create another one.

        • No - this account has been around for quite some time. They just changed their email address, and somehow mixed up some letters, and it ended up going to one of my accounts. For now, I'm just ignoring it. What else is there to do, really. Its just someone's myspace account, and hopefully they've created another one, and the old one will die from being ignored.

          If I were the nosy type, I might have snooped through the account and find some personal detail or other that would let me identify the person, but

      • They also sometimes screw up their email address info

        I have my own domain in .co.uk for which there are some very similar domains in .gov.uk, .ac.uk, and various similar spellings in .co.uk.

        I get very fed up with mis-directed emails, and it's quite obvious that many websites don't do any kind of validation before signing people up to mailing lists. The best/worst one recently was from Amazon, and I would have been able to order things using the credit card that someone saved in their account details!!

    • Re: (Score:3, Funny)

      by NexFlamma ( 919608 )
      Agreed. One would have to assume that there would be a high likelyhood that people who would fall for a phishing attack would be the same kinds of people who are uneducated about internet security, hence, strong password usage.

      Not only that, but in selecting Myspace to study strength of passwords, you're going to come to the conclusion that everyone on the planet is a moron. It would be like judging the intelligence of the average person by giving IQ tests during American Idol.
      • The IQ of the average person is 100, by definition..

        The scary thought is that 50% of the population are more stupid than that (and 100 is no rocket scientist - I find I notice the stupidity below the mid 120's.. it makes it hard to have a decent conversation when the other side is a monosyllabic moron..).

        • Re: (Score:2)

          by GC ( 19160 )
          Whether "50% of the population are more stupid than that" depends on whether average is defined as median or mean. It's probably close, but then you also need to define what "population" means.

    • Then again, why would anyone bother using a strong password on MySpace? I generally use the same weak, easy to remember password on EVERY website. I don't want to remember 10,000 passwords for every site that requires registration. Sure, I use strong, unique passwords for bank accounts and whatnot, but I'm not really concerned about someone stealing my MySpace password and changing my profile.

  • Email Passwrod (Score:5, Interesting)

    by lobsterGun ( 415085 ) on Sunday September 17, 2006 @08:34AM (#16124420)
    It would be interesting to see how many of the names in that list use the same password for MySpace account as they do in their email account.

  • Who cares about myspace password strength? (Score:5, Insightful)

    by smkndrkn ( 3654 ) on Sunday September 17, 2006 @08:47AM (#16124462)
    I have a few "sets" of passwords that I use. Basically it goes like this:

    1) Online banking - Very complex ( as complex as my banking site will allow that is ) / Important work related passwords
    2) Unimportant work related passwords (Such as the log in to view the cacti graphs for example) / Public websites that require a password and I care a little bit about
    3) Public websites I could give a rats ass about having broken into. Myspace would be listed here. So would my slashdot account.

    So my point is just because people use crappy passwords for myspace doesn't nesasarily mean they don't have a clue......but being caught by phishers does. ;)
    • Warning: website plug (but relevant to the point here)

      I use a similar tiered strategy but would still get an uneasy feeling whenever I used a predictable or common password. So now for "public websites I could give a rats ass about having broken into," I use mushpup, which is just a modified SHA-1 hashing function, but allows you to get a secure password wherever you have web access and recover it easily next time you need it.

      mushpup suggests a password strategy similar to the parent post:

      http://mushpup.or [mushpup.org]

  • strong passwords? (Score:5, Informative)

    by nephridium ( 928664 ) on Sunday September 17, 2006 @09:19AM (#16124564)
    Most common passwords used:

    13 - cookie123
    12 - iloveyou
    12 - password
    11 - abc123
    11 - fuckyou
    11 - miss4you
    9 - password19
    9 - clumsy
    8 - sassy
    8 - summer06
    8 - pablobob
    8 - boobie
    8 - fuckyou1
    8 - iloveyou1
    8 - tink69
    8 - password1
    7 - gospel
    7 - terrete
    7 - monster7
    7 - marlboro1
    7 - bitch1
    7 - flower
    7 - space

    Summary:

    While the passwords weren't the best, they weren't exactly terrible. [...]
    According to TFA it seems most passwords used on myspace are made up of dictionary words (mostly lower case) and a numeric suffix (usually <4 digits). Imho such a password does look horrible, especially after seeing how important some of the myspace pages seem to be for certain people.

    • There are publicly-available tools to prevent weak passwords from being used in the first place. OpenBSD has something, and I've compiled the library below and used it to protect ancient Oracle 7 accounts on HP-UX 10.20.

      $ rpm -qi cracklib
      Name : cracklib Relocations: (not relocatable)
      Version : 2.7 Vendor: CentOS
      Release : 29 Build Date: Mon 21 Feb 2005 01:54:42 PM CST
      Install Date: Mon 12 Dec 2005 06:18:57 PM CST Build Host: build2.hughesjr.centos.org
      Group : Syste

  • There are a lot of people who don't know or don't care..... If you open a website with registration with asking e-mail and new password. Thousands of people will give you their e-mail and they will pick the same password for your website as their e-mail password. :)

  • This 'paper' doesn't give MySpace haters much ammo (Score:4, Insightful)

    by erikwestlund ( 1003368 ) on Sunday September 17, 2006 @10:12AM (#16124735) Homepage
    I almost sense a disappointment that MySpace users didn't come out looking stupider. Give the MySpace users a break! Their computer illiteracy is made painfully clear, but imagine if Slashdot had a comparable way to highlight its posters social illiteracy. Perhaps there would be MySpacers writing on message boards about how stupid all Slashdot users were for their poor fashion sense. Yes, that would be stupid, but comparably as stupid as the blind, generalizing hate for MySpace users that is prevalent here.

  • How to get a password (Score:2, Interesting)

    by Anonymous Coward
    1. Put up a site that claims to have tens of thousands of passwords up.
    2. Post news on Slashdot.
    3. Users go to site, and SEARCH for their password. Hacker now has REAL passwords thanks to the searches.

    • Re: (Score:2)

      by teslar ( 706653 )
      I'd be interested in seeing how you would log the searches done using the browser search function as opposed to a hypothetical search box on the website?

  • strong passwords (Score:4, Interesting)

    by DigitalLifeForm ( 952353 ) on Sunday September 17, 2006 @10:40AM (#16124823)
    There was an MIT study claiming that the strength of passwords was affected by length alone. Because of brute force cracking, the longer the password, the longer it took to break. Consider the three character password where I allowed only numbers, and upper and lower case letters. Each position in the password would have 10 + 26 + 26 = 62 possibilities. A three letter password would have 62 * 62 * 62 combinations. Now, if I required "strength" by requiring the use of a letter, and both upper and lower case, I now have only 10 * 26 * 26 combinations. Requiring "strength" always reduces the set of possible combinations for the password.

    • Re:strong passwords (Score:4, Interesting)

      by nobodynoone ( 940116 ) on Sunday September 17, 2006 @10:58AM (#16124891)
      Yes, but in the instance of bruteforce, it is all about PERCIEVED strength, in which case the bruteforce attack must include numbers as well as letters, increasing possible combinations from the attack side to 36*36*36. So while the ACTUAL combinations may drop, the POSSIBLE combinations increase.

    • Re: (Score:2)

      by vidarh ( 309115 )
      The worst case (from a hackers point of view) time to crack a password is reduced if passwords are forced to be "good", assuming the attacker knows the rules (or an approximation) that the users are required to follow.

      However the reason "strong" passwords are generally still better is that a large portion of users pick bad passwords if they are not reminded or forced to pick good ones. That leads to a situation where the space of likely passwords is still dramatically smaller than the total space of possi

    • Re: (Score:3, Insightful)

      by mrcaseyj ( 902945 )
      The probability calculation is flawed. Although restricting the choices of passwords reduces the number of possibilities it doesn't reduce them all that much. A three character password with an upper, a lower, and a digit, isn't 10*26*26 possibilities. The first char can be any of 62. The next char can be any of at least 36 but could be any of 52 if the first char was a digit. The last char could be any of at least 10. Thus the correct calculation is at LEAST 62*36*10 but is actually more.

      More importantly,

  • trustno1 (Score:2, Interesting)

    by illectro ( 697914 )
    Recently while auditing user accounts this password turned up as one of the top 10 most common passwords - if you don't know, it's Fox Mulder's password in the X-Files. Passwords used in movies and tv are surprisingly common, 'joshua' is pretty common, and quite a few people use 'CPE1704TKS' proving that just because people remember detailed trivia from hacking movies they don't know what makes a good password.

  • Obvious password detector (Score:5, Interesting)

    by Animats ( 122034 ) on Sunday September 17, 2006 @11:30AM (#16125007) Homepage

    Twenty-two years on, here's my obvous password detector [animats.com]. This is C source code I wrote in 1984. This simple piece of code will prevent the use of passwords that are English words, by requiring that the password have at least two sequences of three letters not found in the dictionary. The "dictionary" is compressed down to a big table of hex constants; it's a 27x27x27 array of bool, with a 1 for each triplet found in the UNIX dictionary. So the code is simple, self-contained, and does no I/O.

    Put this in your password-change program and dictionary attacks stop working.

    The code is a bit dated; this is original K&R C, not ANSI C.

    I should do a Javascript version and give that out. The code is so small that it could easily be executed on user-side password pages.

    • Right, but it prevents passphrases, which are easier to remember and reproduce accurately. Not to mention they can be fashioned to be much much stronger.

      Any good detectors that support both out there?
  • It seems pretty obvious to me, the "fuckyou" password people KNEW about the phishing attempt, and thats why they typed in "fuckyou"

    If I ever encounter anything like that, that looks a little phishy, you always test the waters by sending a fake "fuckyou" password through and seeing what happens..

  • Password Strength (Score:3, Insightful)

    by localman ( 111171 ) on Sunday September 17, 2006 @01:05PM (#16125360) Homepage
    Most interesting to me is that despite most of the passwords being decent it makes not a lick of difference in these people being phished. Once again, being sharp and understanding of the big picture is more important than following any isolated rule about security. Good luck getting that out to the masses, though :)

    Cheers.
  • When the author makes statements like, Character length means little if your passwords dont have upper and lower case letters.?

    The author is saying that a 20 character all lower-case password is no better than a 5 character password that has both upper and lower case characters. That is just plain wrong.

    What other significant fallacies are there in the article?

  • My password.... (Score:3, Funny)

    by CrazyTalk ( 662055 ) on Sunday September 17, 2006 @05:23PM (#16126470)
    Is *******. That way I can always see what I'm typing.

  • One point deserves emphasis... (Score:5, Interesting)

    by dghcasp ( 459766 ) on Sunday September 17, 2006 @05:30PM (#16126512)

    He came up with a rating scheme from 1 to 4, where 4 is the "best" password. And he says "I consider strength two fine for a myspace account." Very good point: Not all websites need the same level of password strength.

    My personal pet peeve is websites that probably only require a 2 or 3 (on his scale) but demand strength 99. For example, forum sites that reject passwords that my bank would consider good enough.

    Your password was rejected because it was only seven characters long, does not contain enough characters that are neither letters or numbers, and contains a substring that was found in a dictionary of Croation words. Plus, you used that password three years ago when we forced you to change it with our 30-day password aging policy.

    My plea to anyone reading this who develops websites: The strength of the password only has to match the importance of the information that it's protecting.

    Thus endeth my rant.


  • Didn't this blogger commit a computer crime (at least in the US) by downloading the password file?

Slashdot Top Deals

"All the people are so happy now, their heads are caving in. I'm glad they are a snowman with protective rubber skin" -- They Might Be Giants

Close