Printed from www.pcpro.co.uk
12345 most popular stolen Hotmail password
Posted on 7 Oct 2009 at 08:44
The phishing attack that exposed the details of 10,000 Hotmail users has revealed that 12345 was the most popular password of those caught out, according to a security researcher.
That's alarming news given the glut of information and warnings that pepper the internet, especially given the fact that the second most popular password was 123456789.
The information was revealed by security research Bogdan Calin on his blog. Calin reviewed the list of 10,000 Hotmail accounts posted on PasteBin by hackers and discovered that of the 9,843 valid passwords, 82 of them used one of these two numbers.
Also popular, and equally weak, were the passwords 12345678, 1234567 and 111111 - which all featured in the top ten.
The rest of the top ten was filled out with names such as alejandra, alberto, and alejandro, leading Calin to suspect that the phishing kit was targeting Latinos.
Another interesting fact to be pulled from his research was the longest password, which came in at a staggering 30 characters and was "lafaroleratropezoooooooooooooo". The shortest password, on the other hand, was only one character long.
In general, Calin found that the majority of the passwords were between six and nine characters long, with the average password eight characters in length.
Hotmail users weren't the only ones caught out by the phishers, with GMail, Yahoo and AOL also reporting that their users have been targeted.
Author: Stuart Turton
Whoever had "lafaroleratropezoooooooooooooo" as their password is going to be so pissed off at having to pick a new one, unless they just stick another"o" at the end again.
By Shuflie on 7 Oct 2009 
0.8% = Alarming?
Sorry, but I'm amazed the figures weren't worse.
By VoiceOfReason on 7 Oct 2009
Replace 'password' with 'pass phrase'
Why don't all IT companies replace the word 'password' in their code with the words 'pass phrase' and encourage people to think of a phrase instead of a word?
For example, "I drive a BMW 320i" would be pretty secure and easy to remember if your car was indeed a BMW 320i.
"My dog's name is Spot" etc, etc.
By iwilson on 7 Oct 2009
Not just Hotmail
I worked on one site, where the previous IT services company reset everybody's password to 123456 - from the coffee boy up to the board!
Most of the users didn't even know how to change their passwords, so a year later, when we took over the contract, they were still set to 123456! :-O
By big_D on 7 Oct 2009
Perhaps those people knew it as a phishing scam and entered fake details. I know I would.
By peterm2k on 7 Oct 2009
Fonejacker eat your heart out!
No passwords of "password" then? That used to be popular.
You've got the makings of a quiz show right there...
"Nine characters, first letter capital, a symbol and a number, what's my password?"
"Ratings#0" ?
By cheysuli on 7 Oct 2009
@peterm2k - but if they knew it was a scam why would they reply at all?!
By halsteadk on 7 Oct 2009
I have to agree with iwilson - a pass phrase is far better than the idea of a password.
So instead of using the password 'letmein' we can now say 'let me in' - which was the password of choice for most admins at council offices in the south of England in the late 90s - lets hope they've changed them since.
But Still I am not surprised at the weak password users have to remember for so many different acounts - give them a phrase with numbers in it and then they are on a safer path.
By nicomo on 7 Oct 2009
I did once reply to one of these with fake details and giving my phone number as the fraud reporting hotline :)
By phantombudgie on 8 Oct 2009
advertisement
- 10 ways to boost traffic to a WordPress blog
- Reaction to the Apple iPad: ten days later
- How to switch off Virgin Media's mobile broadband image compression
- Infotec/Ricoh: here not to help
- TomTom 940T vs iPhone TomTom: a real road test
- Nvidia Fermi update: they have names!
- Twitter oven lets you have your cake and tweet it
- Where online businesses go terribly wrong
- Google Nexus One: first look review
- Dreading the move to ADSL
- Avira Premium Security Suite 9
- ZoneAlarm Internet Security Suite
- Webroot Internet Security Essentials
- Trend Micro Internet Security
- PC Tools Internet Security 2009
- Panda Internet Security 2009
- Norton Internet Security 2009
- Kaspersky Internet Security 2009
- F-Secure Internet Security 2009
- Eset Smart Security
- Microsoft must stop silently installing browser plugins
- Poking into Facebook security
- Has Microsoft shot itself in the foot with Security Essentials?
- Wi-Fi hacking: don't panic yet
- Gary McKinnon deserves prosecution not extradition
- Sex and online security: how much danger are we really in?
- Security without penalty
- The spam is out, but the viruses are in
- Security without a smile
- Security by numbers
advertisement
