update: After I made this post, I found Constellation’s twitter feed and sent them a note. As of Monday morning at 8:30, the page is now returning a “Service Unavailable” message. If you’re morbidly curious, the google cache of the page can be see (at least for a little while). For the record the form was not only accessible over http, but the form action was submitted over http as well. The warning message that was at the bottom of their page read as follows:

Note:   After submitting this form, you MAY see a warning message about redirecting to an unsecure document. Please acknowledge the message and proceed.

I also noticed that the notice at the bottom of the page says “Rev April 2002″, which may explain a thing or two about why it was designed the way it was designed. (I also noticed a few other poor security practices in that login form, but there’s really no need to beat a dead horse). Kudos to CEG for responding so quickly.

If anyone from CEG is reading this, you may be interested in my next post, which I hope to make in a day or two.

In the last few weeks there have been a few stories about criminals using stolen credentials to steal large amounts of money from unsuspecting victims. The Zeus botnet stole about a million dollars from UK banks. Criminals stole a million dollars from UVA, and the Diocese of Des Moines had 600K stolen. All of these followed a similar pattern – criminals used stolen credentials to move money to other bank accounts. I’m reminded of the 2010 Verizon Data Breach Investigations Report (if you haven’t read it, please do). One of the recommendations was to limit the amount of damage that can be caused by compromised credentials. If these banks had been following that advice, their customers might not now be out millions of dollars. If they had implemented any sort of program to look for fraud indicators, they likely would have avoided this whole mess. I know of many banks that have such a program in place, and let’s just say that I haven’t seen any of them show up in the news lately.

• The top 17 or so passwords accounted for about 25% of all passwords in use. That means you could crack one out of every four passwords in 17 guesses.
• The most common password (accounting for 9.4% of the passwords in use) was the extension itself.
• Shorter passwords were greatly preferred over longer ones. (This shouldn’t shock anyone).

The most interesting thing though, was the distribution of passwords by length, which I’ve reproduced below:

So, even though shorter passwords are more common, passwords of an even length are more common than the odd number which immediately precedes them. (The one exception is 7-8, where 7 is more common, perhaps because people use a 7 digit phone number as a password). The main question on my mind of course is why – does the human brain find it easier to remember string of numbers in pairs? Do people just like even numbers more?

Secure wireless

Originally uploaded by bachrach44

I noticed this on the wall at a recent ISSA meeting. In addition to the obvious security issue I’m trying to bring attention to, there is a bonus security issue being illustrated here – you can see my reflection!