Characterization of passwords used by the university community as a starting point for developing cybersecurity training

• João Roberto Randel UFRR
• Jorge Siqueira Serrão UFRR
• Hugo Lima Romão UFRR
• Felipe Leite Lobo UFRR
• Marcelo Henrique Oliveira Henklain UFRR
• Eduardo Luzeiro Feitosa UFAM

DOI: https://doi.org/10.5753/wei.2024.2617

Abstract

The adoption of weak passwords occurs, in part, because secure practices increase the effort in using systems. When teaching about strong passwords, it is useful to start from the user's behavior and improve it, thus reducing his/her effort. In our study, we broke 242 hashes of passwords from users at a university to characterize them and then, propose learning objectives. We evaluated the effectiveness of the brute force (BF) and hybrid attacks (BF and dictionary) on a basic and a professional machine. BF was more effective, cracking 62.81% of passwords. They had 5 to 12 characters and did not meet minimum security requirements. We noticed that users need to learn how to create long passwords with different types of characters.

References

Aljohani, M., Alruqi, M., Alboqomi, O., and Alqahtani, A. (2020). An experimental study to understand how users choose password. In: The 4th International Conference on

Future Networks and Distributed Systems (ICFNDS) (ICFNDS ’20). New York: ACM. DOI: 10.1145/3440749

Bispo-Jr., E. L., Raabe, A., Matos, E., Maschio, E., Barbosa, E. F., Carvalho, L. G., Bittencourt, R. A., Duran, R. S., and Falcão, T. P. (2019). Tecnologias na Educação em Computação: Primeiros Referenciais. Revista Brasileira de Informática na Educação – RBIE, 28, 509-527. DOI: 10.5753/RBIE.2020.28.0.509

Bošnjak, L., Sreš, J., and Brumen, B. (2018). Brute-force and dictionary attack on hashed real-world passwords. In: 41st International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO) (pp. 1161-1166). DOI: 10.23919/MIPRO.2018.8400211

Bošnjak, L., Sreš, J., and Brumen, B. (2019). Rejecting the death of passwords: Advice for the future. Computer Science and Information Systems, 16(1), 313-332. DOI: 10.2298/CSIS180328016B

Carvalho, E. A., Reis, T. A., and Alves, F. J. (2017). Ensino de noções básicas de segurança da informação nas escolas brasileiras. In: Anais do XXIII Workshop de Informática na Escola (WIE 2017). DOI: 10.5753/cbie.wie.2017.765

Carvalho, H., Ribeiro, J., Batista, D., and Pina, J. (2022). HashifyPass - Uma Ferramenta para Visualização de Hashes de Senhas. In: Anais Estendidos do XXII Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais (pp. 79-86). Porto Alegre: SBC. DOI: 10.5753/sbseg_estendido.2022.226940

Cortegoso, A. L., and Coser, D. S. (2013). Elaboração de programas de ensino: Material autoinstrutivo. EdUFSCar: São Carlos.

Glory, F. Z., Aftab, A. U., Tremblay-Savard, O., and Mohammed, N. (2019). Strong password generation based on user inputs. In: IEEE 10th Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON) (p. 416-423). DOI: 10.1109/IEMCON.2019.8936178

Guilherme, L. P., Ferreira, M. F., Fonseca, G. M., and Lazarin, N. M. (2021). Uma breve noção sobre o comportamento dos internautas em relação à segurança na rede. In: Anais da VII Escola Regional de Sistemas de Informação do Rio de Janeiro (pp. 1-7). Porto Alegre: SBC. DOI: 10.5753/ersirj.2021.16972

Hartwig, K., and Reuter, C. (2021). Nudge or restraint: How do people assess nudging in cybersecurity - a representative study in Germany. In: European Symposium on Usable Security 2021 (EuroUSEC ’21) (pp. 141-150). New York: ACM. DOI: 10.1145/3481357.3481514

Ji, S., Yang, S., Hu, X., Han, W., Li, Z., and Beyah, R. (2017). Zero-Sum Password Cracking Game: A Large-Scale Empirical Study on the Crackability, Correlation, and Security of Passwords. IEEE Transactions on Dependable and Secure Computing, 14(5), 550-564. DOI: 10.1109/TDSC.2015.2481884

Kienen, N., Panosso, M. G., Nery, A. G. S., Waku, I., and Carmo, J. S. (2021). Contextualização sobre a Programação de Condições para Desenvolvimento de Comportamentos (PCDC): Uma experiência brasileira. Perspectivas em Análise do Comportamento, 12(2), 360–390. Recuperado de [link]

Ruoslahti, H., Coburn, J., Trent, A., and Tikanmäki, I. (2021). Cyber Skills Gaps – A Systematic Review of the Academic Literature. Connections: The Quarterly Journal, 20(2), 33-45. DOI: 10.11610/Connections.20.2.04

Skinner, B. F. (2005). Science and human behavior. Cambridge, MA: The B. F. Skinner Foundation. (Trabalho original publicado em 1953). Recuperado de [link]

Steube, J. HashCat. (2022). Recuperado de [link]

Švábenský, V., Vykopal, J., and Čeleda, P. (2020). What are cybersecurity education papers about? A systematic literature review of SIGCSE and ITiCSE conferences. In: The 51st ACM Technical Symposium on Computer Science Education (SIGCSE ’20). DOI: 10.1145/3328778.3366816

Tsai, H. S., Jiang, M., Alhabash, S., LaRose, R., Rifon, N. J., and Cotten, S. R. (2016). Understanding online safety behaviors: A protection motivation theory perspective. Computers & Security, 59, 138-150. DOI: 10.1016/j.cose.2016.02.009

Whitty, M., Doodson, J., Creese, S., and Hodges, D. (2015). Individual Differences in Cyber Security Behaviors: An Examination of Who Is Sharing Passwords. Cyberpsychology, Behavior, and Social Networking, 18(1), 3-7. DOI: 10.1089/cyber.2014.0179

Zilio, D., and Neves-Filho, H. (2018). O que (não) há de “complexo” no comportamento? Behaviorismo radical, self, insight e linguagem. Psicologia USP, 29(3), 374–384. DOI: 10.1590/0103-656420170027