-: I've mentioned credential theft
in the last couple of lectures,
but I want to go a little bit more in depth in this,
just to make sure you understand the different facets
of credential theft.
So, credential theft is when an attacker targets users,
services or simply brute-forces the credential
to compromise them.
Essentially, they want to get your user name and password.
Now, one of the ways they do that is phishing,
and phishing is aimed at stealing credentials
by tricking users into clicking a link in an email
or entering their user name and password.
I know we've talked about this a lot,
so we're just gonna move on from here.
The next one is they can compromise other websites
and this is one we haven't really discussed yet.
But it really revolves around the concept of password reuse.
How many of you use the same password at multiple websites?
Come on, be honest.
You know you probably do, right?
So you might have the same password on your Gmail account,
your Facebook account, your LinkedIn account
and all of your other ones, so if I can break into say,
Yahoo and reverse engineer your password
because they've been storing it in, I don't know, MD5,
hmm, that never happened, oh wait, yeah it did.
And millions of people,
have gotten their credentials stolen at Yahoo,
well it wasn't necessarily
the fact they got your Yahoo email
that was really the concern.
It was the fact that they got your password.
And they can then try that Yahoo email address and password
at multiple other sites, like Facebook, like Gmail,
like LinkedIn and see if you used the same credentials.
If you reuse those credentials,
now they've got access to all those other sites.
So as an organization I can actually get hacked
because you have reused your password at 17 other websites
and one of those organizations got hacked
and now they've got access on my server
because your password was reused.
You see the problem here?
So password reuse is a big issue.
So how do you prevent password reuse,
well, you make it easy for your users.
You give them something like Last Pass,
where all the passwords are stored with one master key.
Or you use something like the US government uses
which is smart cards and they put the smart card in
and all you have to remember is one pin number
and then it can allow single sign on
or federated identity across their enterprise.
These are some of the ways you can do things,
is either tokens, cards, single master passwords
that then open up individual passwords
and put them into the websites,
lots of different ways to move,
but you want to make sure
that you're not using password reuse,
reusing the same password at every single website,
because that is a big vulnerability.
Now the next one we want to talk about is brute-force.
Every password is vulnerable eventually.
I can crack any password on the planet,
no matter how long it is and how strong it is,
it's just a matter of time.
Now some of them may take me millions
or billions or trillions of years
and so I'll die before I ever crack it.
But eventually that computer can crack it.
This is gonna log-in with every possible combination.
I'll try A and I'll try AA and I'll try AB
and I'll try AC and I'll go through
all the combinations until I find your password.
Now, how do you prevent it?
Well you limit the number of log-in attempts.
If I say you only get three log-in attempts
and then it locks you out
and you have to contact the administrator,
that's a good way to stop brute-force attacks.
The other way you can do it is,
prevent bots from trying automation,
and you can do this by using CAPTCHA's
and I'm sure you've seen this in lots of websites,
but an example is here on the screen.
They're those funny looking words,
funny looking pictures or even the button that says,
I'm not a robot, and you click that and then you can log in.
This slows down the attack and prevents it
and makes it where a human has to brute-force it
which just makes it take way to much time and effort.
And they'll move on to somebody else.