Black datamining archeology: what could be more effective than a dictionary attack?

For those who are lazy to read further, I will immediately say the answer: the attack “login is equal to password”. According to statistics, login equal password is more common than the most common password from the dictionary. Further in the article there will be some statistical studies on this topic, and a story from which it all began.




')

One such story, which happened back in 2000 with a certain young man, prompted me to begin such a study. Not being a hacker, he wanted to crack the mailbox of one person. Her login ended in two digits, like this: masha86@mail.com. After the trivial passwords that did not come up, the guy suggested that the password might look like this: mashaDD, where DD is two random numbers. The complexity of this attack is only 100 attempts, and at about the twentieth attempt the password came up, the box was cracked. What can you not do in your youth because of jealousy and for the sake of love ...

Therefore, in today's study, I decided to check how often passwords are found that are either equal to or are a small modification of their passwords.

For a start, in addition to 6 million passwords for mail entries, I connected to the study a database of passwords from a single non-mail site for 3.5 million entries. These are fresh entries (May 2015), containing quite a few invalid passwords. I built statistics on passwords from this site separately.

Password is equal to login
The number of entries where the password is equal to the login: approximately 87 thousand for mail passwords, 50 thousand for passwords from the site. Is it a lot or a little? For comparison, I cite the two most common passwords (1st and 2nd place in the distribution). Also for convenience, I quote values ​​in thousandths (‰) of the total number of passwords.

Mail passwords				Passwords from the site
	amount	‰			amount	‰
Password is equal to login	86908	14.3		Password is equal to login	49327	14.0
Top 1 "123456"	82830	13.6		Top 1 "qwerty"	33322	9.5
Top 2 qwerty	53144	8.7		Top 2 "123456"	21775	6.2

Overlap
Next, let's see how often there are cases where the password is a small modification of the login. Such cases are not so frequent, but this is offset by the small complexity of the attack.

		Mail passwords		Passwords from the site
Type of attack	Complexity	amount	‰	amount	‰
Password and login are different one last character	~ 70	1835	0.30	20869 (!)	5.93
Differ by two characters, and the numbers:	100	1702	0.28	1226	0.35
One character added for password	~ 100	5508	0.90	1930	0.55
Or two	~ 10,000	5087	0.84	3269	0.93
Added 4, but only numbers	from 100 up to 10,000	7267	1.19	3252	0.92

In terms of frequency, all these cases fall into the top 50 most common passwords:




Conclusion
Now on many mail portals (but very rarely on regular sites and forums) you cannot set a password equal to the login. However, for all the time I met only one site in which it was impossible to set a password by adding one character to the login. The site wrote: “your password is very similar to the login”. However, such a situation on the modern Internet is more the exception.

Meanwhile, attacks with the selection of a password by a small modification of the login are quite effective in terms of the frequency of occurrence, and do not require great complexity in terms of the number of options.

Of course, if we compare the integral complexity, a dictionary attack is somewhat more advantageous. On the other hand, attacks by login modification are not counted in security systems, even on large portals.



Previous issue: Black Archeology Mining Date

In the next issue: a comparison of the mail password database with the password database of a non-mail website. How useful were mail passwords leaked in 2014?