Why password theft is the main method to hack you

A recent report indicates that more than half of security incidents were caused by credential theft, after this incident, ransomware and DDoS attacks were placed as the second and third most used method by cybercriminals to achieve their goals. Therefore, password attacks are one of the most used to try to hack companies, organizations and also users. The reason is because users do not care about properly managing their credentials, therefore, cybercriminals take advantage of this to attack them.

How they steal passwords to attack

Cyber ​​criminals often exploit web vulnerabilities and in other services to steal the entire database of users and passwords. A good security practice that the vast majority of services use is to store the password hashesIn this way, to obtain the passwords it is necessary to carry out an attack on these hashes, which greatly hinders the possibility of obtaining the keys in plain text.

The hash of a password can be cracked Usually by two methods: brute force (thousands of combinations and permutations of characters are tried to find the password) or dictionary (the main passwords that people put are tested). Cybercriminals often use powerful computers to crack as many passwords as possible, and then try to break into different user services. We must remember that one of the main security recommendations is not to reuse passwords in different services, something fundamental if one of the services that we are using is hacked, because it will not affect all the others that we are using.

Now that you know what cybercriminals do to steal and crack passwords, we are going to explain what you can do to avoid being hacked.

What can I do to avoid being hacked?

If cybercriminals have entered a service and have obtained their passwords, generally what the main services do is reset the passwords to prevent their clients from being affected, however, it is possible that some do not do this so as not to reveal that They have been hacked. For this reason, here are the best recommendations to properly manage access credentials:

• Use complex passwordsIf possible, you should use a randomly generated password in order to make it harder for password cracking programs to do their job.
• Use whenever possible the two-step authenticationIn addition, our recommendation is that you use an authenticator application, never use SMS messages because it is not safe to use this. In addition, if you use an authenticating app, it is recommended that it has synchronization in the cloud, with the aim of storing the tokens there, and in case of loss of the terminal, you can continue accessing without any problem.
• Every 3 months you should change your password of the different services, although today we are using dozens of services simultaneously, it is advisable to change the key regularly in the most important services.
• Use a password manager where they are all stored, in this way, we will not have the need to use easy-to-remember passwords.

If you are an administrator of an online service or system administrator, it is recommended that you carry out the following recommendations regarding passwords:

• Activate the complex password policyboth in length and in the use of different characters.
• Activate that every 3 months users are forced to change their passwords, for security cuestions. This new password should not be similar to the old key, but rather a completely new one.
• Do a review of all users, and revoke credentials of those users who are no longer in the company, or who should not have a user.

As you can see, although cybercriminals continue to focus on stealing passwords, cracking them and using stolen user credentials, if we follow some basic recommendations when managing passwords, we will not have intrusion problems.