  |
|
||||
|
Low-Tech Password Cracker: ChocolateBy Enterprise IT Planet StaffApril 20, 2004
Out of a small sample of 172 office workers that were approached on the street, more than a third (37%) willingly divulged their password when simply asked, according to Infosecurity Europe 2004's organizers. Sadly, a large majority -- a full 71 percent -- forked over the information when bribed with chocolate. Last year, 90 percent of office workers approached at the Waterloo Station accepted a cheap pen in exchange for their password. 65% of those surveyed did so the year before in 2002. Indeed while chocolate may prove difficult for those with a sweet tooth, many still fall victim to social engineering, or in this case, a little light prodding minus the candy. Interviewers found that by fishing for the answer, such as implying that it is likely to be someone they know or a favorite sports team, workers broke down and let the secret slip. 34 percent fell for this ploy. The most common passwords, incidentally, were based on the names of loved ones, cars, teams and pets. The survey also found that 40 percent knew their co-workers passwords, and that 20 percent never change their passwords while 51 do so on a monthly basis. Disturbingly, many keep their passwords in a drawer scribbled on a piece of paper or in easily accessible Word files. Also troubling for its potential to launch both identity theft scams and breaches in corporate network security is the fact that roughly two thirds of those surveyed used the same password for work and personal business. Luckily, 53 percent said they would never reveal a password over the phone, as opposed to walking up to them in the street and just asking apparently. What would the other 47 percent do? That's something for IT managers to ponder. Nonetheless, the survey and its shocking results will surely be a topic of discussion during next week's Infosecurity Europe 2004 conference in Olympia, London during April 27-29.
|
|
|
|
|||||
|
||||||
|
||||||||||||||||||||||||||||||
Measuring Infrastructure Value
Email
Print
Digg This
Add to del.icio.us
