Is your Company's data vulnerable to hackers?

In an effort to find out how vulnerable internet-connected computers are to hacker attacks, Michael Cukier, assistant professor at the University of Maryland, and two of his grad students set up four Linux computers with weak security to see if they would be attacked by hackers. What he learned helps to explain the magnitude of the problem facing every computer connected to the Internet.

Cukier’s test results showed that his computers were attacked by hackers on average every 39 seconds, 2,244 times each day. Furthermore, they discovered that most of the hacker attacks came not from the stereotypical hacker geniuses you often see in movies, but from relatively novice hackers who used software programs to do their dirty work.  His experiment discovered they used software programs that used “dictionary scripts”.  The dictionary scripts try to gain entry to your computer by going through a a list of common usernames and passwords. What are the common usernames and passwords? I’ll explain more about that in a minute, so stay with me.

But first…. who did they find to be vulnerable to the attacks? Everyone, according to Cukier’s study. The programs used by hackers don’t discriminate. They try usernames and passwords on thousands of computers at a time, every minute of every day.

Ok, a minute is up I think. What usernames should you, and especially your network administrator avoid? your employees avoid?

Cukier says in his article: - “Root” was the top username guess by dictionary scripts—attempted 12 times as often as the second-place “admin.” Successful ‘root’ access would open the entire computer to the hacker, while ‘admin’ would grant access to somewhat lesser administrative privileges. Other top usernames in the hackers’ scripts were “test,” “guest,” “info,” “adm,” “mysql,” “user,” “administrator” and “oracle.” All should be avoided as usernames, Cukier advises.”

Other passwords to avoid:

• Don’t make your username and password the same. Cukier says that 43 percent of password guesses by the hacker programs were the same as the username.
  

• That was followed by the username followed by 123.
  

• Other common passwords included 123456, 1234, 12345, passwd, 123, test, and 1.
  

• Computer security experts further recommend that a password should never be the same or similiar to a username. 

I did a quick search on google while I was researching information for this article, a small fraction of the sites I found included:

• Feb. 9, 2007 - Computer backup tapes containing payroll data on 52,000 Johns Hopkins workers and medical information on 83,000 patients were lost last month. - Yahoo News
  

• “Eighty-one percent of companies surveyed reported the loss of one or more laptops containing sensitive information during the past 12 months, according to the survey, which queried nearly 500 information security professionals.”  - PC World.
  

• “In a survey of 600 IT managers in the U.S. regarding their views on cybercrime, IBM found that three quarters of them believe threats to corporate security now come from inside their own organizations.” - Network World

• “Corporations can be tighter than Fort Knox with their firewalls, but do not consider how easy it is for someone to walk into their office, lift a machine and walk out the front door,” said Figueiredo.- Information Week
  

• “Massachusetts Attorney General Martha Coakley will lead a civil investigation by dozens of states into the security breach disclosed last month by The TJX Companies Inc., the owner of T.J. Maxx and Marshalls retailers.” - PC World

Dawn Turner
The SearchLogix Group