This algorithm can probably guess your password

TarGuess framework uses mathematical models to crack your paswords

University researchers have developed a framework that can guess passwords 73% of the time.

The system, called Targuess, was built by researchers from Lancaster University, Peking University and Fujian Normal University, whopublisheda paper on their efforts, saying thatagainst more security-conscious users, the framework can still claim success 32% of the time.

While trawling online/offline password guessing has been intensively studied, only a few studies have examined targeted online guessing, where an attacker guesses a specific victim's password for a service, by exploiting the victim's personal information, such as one sister password leaked from another account and some personally identifiable information (PII).

"A key challenge for targeted online guessing is to choose the most effective password candidates, while the number of guess attempts allowed by a server's lockout or throttling mechanisms is typically very small," said the authors.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The researchers said that TarGuess "systematically characterises typical targeted guessing scenarios with seven sound mathematical models", each of which is based on varied kinds of data available to an attacker. These models allow the team to design novel and efficient guessing algorithms.

The team then carried out experiments using 10 large real-world password datasets, notably including ones found in the Yahoo breach. Among the ten most popular passwords used on Yahoo were (unsurprisingly) 123456, password, welcome, and ninja, among others.

Targuess was trained up on one set of passwords from one website and then used its training to guess passwords users used on other websites.

The researchers said that the results from the framework suggested that currently used security mechanisms would be largely ineffective against the targeted online guessing threat, and this threat has already become much more damaging than expected.

"We believe that the new algorithms and knowledge of effectiveness of targeted guessing models can shed light on both existing password practice and future password research," said the authors.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/security/ddos/28039/how-to-protect-against-a-ddos-attack
Security

How to protect against a DDoS attack

25 Oct 2019
Visit/data-breaches/29418/equifax-data-breach-cost-14-billion-so-far/page/0/1
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/microsoft-windows/354526/memes-and-viking-funerals-the-internet-reacts-to-the
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
Visit/network-internet/broadband/354530/openreach-offers-free-full-fibre-installation-for-thousands-of
broadband

Openreach offers free full-fibre installation for thousands of homes

14 Jan 2020