Analysis of Stratfor Site Breach Reveals Weak Passwords, Poor Enforcement

Update from Hacked and discredited: Anonymous takes down Stratfor

Stratfor’s clients include the U.S. Army and Air Force and the Miami Police Department, and a report released by Identity Finder, an identity theft and data loss prevention company in New York, stated that personal information about Stratfor’s subscribers with first names starting with A to M were already released. Information about those with first names beginning with N to Z are believed to be soon released in the coming week, along with 2.7 million email copies.

Information obtained from the hack so far released include:

• 50,277 unique credit card numbers (9,651 not expired)
• 86,594 e-mail addresses (47,680 unique)
• 27,537 phone numbers (25,680 unique)
• 44,188 encrypted passwords (50% can be cracked with ease)

While users need to select stronger passwords to access on online services, enterprises also need to enforce strong security policies for the Web sites and applications.

As Stratfor continues rebuilding its Website after the cyber-attack in which email addresses of its subscribers and other personal details were leaked, the company is coming under fire for its weak passwords and security policies.

Using a group of lists containing common passwords, names of people in Congress, words from the King James Bible, various computer jargon and programming phrases, previously dumped lists from Gawker and other sites and other lists, Hashcat was able to crack 25,690 passwords. A more extensive list that used words and phrases from various languages as well as common 3- and 4-character passwords, among others, yielded 21,933 additionally cracked hashes. It took Hashcat less than an hour to crack over 47,000 password hashes, according to the analysis.

The list of cracked password showed a high degree of passwords that used birthdates, names of family members, or something with a personal reference (such as 'ford1996'). Unlike "throwaway" passwords, such as '123456' and 'qwerty,' these personal passwords are more likely to be re-used on other sites because they are easier for the user to remember.

Detailed analysis here.