How Hackers Steal Your Password

Although now considered to be insufficient for reliable security, passwords have historically been of great importance. Even now, passwords are the foundation of the security strategies of many major enterprises. However, passwords have to be stored somewhere, and many threat actors have dedicated themselves to obtaining these credentials. These are the password crackers, and they use a wide variety of methods to obtain their results.

Although breaching entire servers and leaking their credentials through SQL dumps is a common occurrence, more often password crackers use more prosaic methods to obtain data from individuals. Phishing for credential harvesting is a common method that requires little in the way of specific technical knowledge, simply requiring a fake login page to trick users into entering their credentials. More technical methods include the installation of a keylogger, tracking user keystrokes to observe them inputting their passwords, or a Man-in-the-Middle attack where a threat actor intercepts data during transmission, capturing credentials as they are sent to the authenticator. In some cases, where close personal contact is possible, a determined threat actor can simply look over a user’s shoulder while they input their password.

A password cracker doesn’t necessarily have to interact with a user at all in order to steal their password. One of the reasons security personnel insist on the use of unique passwords is that left to their own devices, many people choose common, easily guessable passwords. This is the root of the dictionary attack. Although it might seem old hat in these days of multi-factor authentication, dictionary attacks are still very effective against targets where security standards are lax.

Password crackers generally have financial motives in mind. Apart from the utility of whatever account they might unlock, stolen credentials are inherently valuable in themselves, and a password cracker can act as an initial access broker, obtaining a reward for selling bulk sets of credentials without ever exploiting them themselves. Even if the service the password is for is relatively valueless, the fact that so many people reuse passwords between services makes any password potentially valuable. Even with MFA becoming the norm, password security is still crucial, and it is strongly recommended that all users make use of strong passwords that avoid easily guessable information, regularly update their passwords every few months, and avoid reusing passwords between services.

‍