Last year, LinkedIn had a massive data breach where millions of passwords were leaked and it seems that from the total data 35% of users were using weak passwords to begin with while the other 65% were using passwords that could be “cracked”.
Researchers at Preempt wanted to know how many LinkedIn accounts were vulnerable before the breach. Unfortunately, the numbers came as a surprise to the researchers, and not for the better. In fact, 35% of LinkedIn passwords were already known from previous password dictionaries, making them vulnerable to the attack. Then, the other 65% can be cracked using sophisticated cracking software.
"Anyone who has used the same password on LinkedIn as they have on other accounts is clearly vulnerable right now across those accounts. Unfortunately, many users don't make this connection in their minds. account has been compromised so they simply change their LinkedIn password without realizing that if they use the same password on other accounts they are exposed. For IT this is an unknown vulnerability to deal with," the researchers explain.
So the researchers checked how many LinkedIn passwords had been used in the past in previous password dictionaries. They found over 63,500,000 million passwords that had been used in the past. It doesn't matter how complex the password is, if it's already in an online database, it can be easily cracked.
Then they looked at a bunch of other things and found that they too can be cracked very easily. They created three password models – low complexity, where only the password length rules are enforced, medium complexity where users have common patterns in their passwords (the first letter is capitalized, the last letter is a digit), and high complexity where users are aware of not using common patterns in their passwords.
The LinkedIn data leak showed that there is a major threat to organizations whose employees have not been adequately informed about how to keep security levels high even through choosing the right password for their social media.
