For many years, passwords were regarded to be an admissible form of protecting privacy when it came to the digital world. However, as cryptography and biometrics began to become more widely accessible, the defects in this simple method of verification became more perceptible. It should not be surprising that passwords are the worst nightmare of a cyber-security professional. To solve this issue, some steps must be taken, like executing robust multi-layer verification. It is also mentionable decreasing risks to take into consideration the steps cyber culprits must take to hack your account which can result in password stealing.

Different methods which hackers use for password stealing

Phishing

Phishing is among the most usual password stealing methods presently in use today and is often employed for other kinds of cyberattacks. Rooted in social engineering tactics, its success is anticipated on being able to mislead a victim with apparently legitimate information while performing with malignant intent.

Businesses are highly cognizant of the extensive phishing endeavors on their employees and often do phishing training exercises on them, both with clear notice and on unsuspecting individuals. Usually conducted through email, success with phishing can also be accomplished with other communication forms such as SMS text messaging, known as ‘smishing’.

Phishing usually includes sending an email to a recipient while incorporating as many elements within the email as possible to make it seem legitimate i.e. company signatures, correct spelling and grammar, and more complicated attacks lately attach onto existing email threads with phishing coming later in the attack chain.

Social engineering

Talking about social engineering usually refers to the process of deceiving users into believing a hacker is a legitimate person. A common tactic is for hackers to contact a victim and as technical support, ask for things like network access passwords so as to offer help. This can be just as efficient if conducted in person, using a fake uniform and credentials, although that’s far less common nowadays.

Successful social engineering attacks can be unbelievably persuasive and highly profitable, as was the case when the CEO of a UK-based energy company lost £201,000 to hackers after they deceived him with an AI tool that imitated his assistant’s voice.

Malware

Keyloggers, screen scrapers, and a large number of other malicious tools are all defined as malware, malicious software made to steal personal information. Besides, highly troublesome malicious software like ransomware, which tries to block access to an entire system, there are also highly specialized malware families that aim at passwords particularly.

Keyloggers, and their type, record a user’s activity, whether that’s via keystrokes or screenshots, which are all then accessible to a hacker. Some malware will even effectively look through a user’s system to find password dictionaries or data related to web browsers.

Brute force attack

Brute force attacks refer to a host of various methods of password stealing that all involve conjecturing passwords in order to gain access to a system.

A simple example of a brute force attack would be a hacker easily conjecturing a person’s password based on pertinent clues. However, they can be more complicated than that. Credential recycling, for example, depends on the fact that many people reuse their passwords, some of which will have been leaked by previous information infringements. Reverse brute force attacks involve hackers taking some of the most typically used passwords and trying to conjecture related usernames which can lead to password stealing.

Most brute force attacks use some kind of automated processing, letting large quantities of passwords be injected into a system.

Dictionary attack

The dictionary attack is a bit more complicated example of a brute force attack. It employs an automated process of supplying a list of commonly-used passwords and phrases into a computer system until something fits. Most dictionaries will consist of credentials obtained from previous password stealing, although they will also include the most common passwords and word combinations.

This technique benefits from the fact that many people will employ unforgettable phrases as passwords, which are typically whole words stuck together. This is mainly the reason why systems will request the use of multiple character types when making a password.

Mask attack

Where dictionary attacks employ lists of all probable phrase and word combinations, mask attacks are very specific in their scope, often purifying guesses based on characters or numbers – typically rooted in existing knowledge.

For example, if a hacker is cognizant that a password starts with a number, they will be able to adapt the mask to only try those types of passwords. Password length, the order of characters, whether special characters are included, or how many times a single character is repeated are just some of the factors that can be used to arrange the mask. The target here is to dramatically decrees the time it takes to crack a password, and eliminate any inessential processing.