‘Complex’ password may be easier to hack, researchers say

However, a new study has found these seemingly random passwords may be more obvious to hack than you realise.Researchers have shown that passwords such as ‘mnbvcxz’, ‘qaz2wsx’ and ‘adgjmptw’ can be cracked in seconds – and adding numbers to your codes does little to boost its strength.The analysis was made by hosting firm WP Engine […]

However, a new study has found these seemingly random passwords may be more obvious to hack than you realise.
Researchers have shown that passwords such as ‘mnbvcxz’, ‘qaz2wsx’ and ‘adgjmptw’ can be cracked in seconds – and adding numbers to your codes does little to boost its strength.
The analysis was made by hosting firm WP Engine using 10 million passwords recently released by security consultant Mark Burnett.
As with previous studies, researchers discovered the most common passwords are still ‘123456’, ‘password’, ‘qwerty’ and ‘111111’.
They also went a step further and listed all 50 of the most used words, which additionally included ‘superman’ and ‘letmein’.
These lists were then divided into sections including the top 10 colours, days of the week, fruits and animals used as passwords – which are ‘red’, ‘Friday’, ‘apple’ and ‘fish’ respectively.
But during the analysis they spotted that a number of complex passwords were being used by multiple people.
Entropy is used to determine the strength of a password in terms of ‘information entropy’.
This comes from information theory and is measured in bits.
The more bits a word is assigned, based on the number of guesses it would take to crack, the stronger the password.
Other words that received a low score include ‘qwertyuiop’, ‘1qaz2wsx’ and ‘zxcvbnm’.
This is because each of these words follow a certain pattern on a keyboard, known as ‘keyboard walks’.
There was an anomaly in this list, though, because the 20th most common keyboard pattern in this list of passwords was ‘adgjmptw’ – which on face value doesn’t appear to be an obvious keyboard pattern.
However, following further investigation the team realised this pattern is created when the nine keys on a telephone number pad are pressed in order.
The study said that his pattern in particular shows how password selection is changing as more people create them on touch devices.
In addition to these passwords being common, the researchers added that password crackers such as Passpat specialise in such patterns, leaving them more vulnerable than some simpler passwords.
Elsewhere, nearly half a million – or 420,000 (8.4 per cent) – of the 10 million passwords ended with a number between 0 and 99.
And more than one in five people who added those numbers simply chose 1.
Hackers can therefore try adding these numbers to the ends of words when trying to hack into an account.  
A cyber security expert, Chris Uwaje said at a cyber security summit in Abuja two years ago that most Nigerians, who are careless with their passwords, were still lucky that their log in details had not been hacked into because (many) bad hackers had not focused on the country.
He said (many) Nigerians are fond of writing their passwords in paper and keep somewhere or even save it in their phones.
 On average, the researchers said,  more women had passwords with an entropy score of 25 and above and people born in the 1980s were the most likely to use the word ‘love’ somewhere in their password.
In May 2013 a team of hackers managed to crack more than 14,800 supposedly random passwords – from a list of 16,449 – as part of a hacking experiment for a technology website.
The success rate for each hacker ranged from 62% to 90%, and the hacker who cracked 90% of hashed passwords did so in less than an hour using a computer cluster.
The hackers also managed to crack 16-character passwords including ‘qeadzcwrsfxv1331’.
Rather than repeatedly entering passwords into a website, the hackers used a list of hashed passwords they managed to get online.
Hashing takes each user’s plain text password and runs it through a one-way mathematical function.
This creates a unique string of numbers and letters called the hash.
Hashing makes it difficult for an attacker to move from hash back to password and it lets sites keep a list of hashes, rather than storing them insecurely as plain-text passwords.
This means if a list is stolen, the plain text passwords can’t be obtained easily.  However, this experiment shows this doesn’t mean its impossible.
When a user types a password into an online form or service, the system hashes the entered word and checks it against the user’s stored, pre-hashed password.
When the two hashes match, the user is allowed entry to their account.  
Jeremi Gosney, the founder and CEO of Stricture Consulting Group, managed to crack the first 10,233 hashes, or 62 per cent of the leaked list, in 16 minutes.
He used a so-called ‘brute-force crack’ for all passwords that were one to six characters long.
Brute-force attacks is when a computer tries every possible combination of six letters and characters, starting with ‘a’ and ending with ‘