When we talk about hacking attacks and device compromises, one of the first things that comes to mind is passwords. Security constantly say that we should not use short, easy, and predictable (or even default) passwords. Cracking passwords is the first thing hackerswhen trying to gain access to a device or system.
Security company F-Secure has a set of honeypot” servers“ installed in countries around the world to detect cyberattacks. Researchers have observed through the honeypots that one of the main activities of hackers is scanning the internet for vulnerable devices.
The company stated that during the second half of last year, there was a significant increase in this activity.
Once a potentially vulnerable device is identified, hackers attempt to gain access to it.
According to F-Secure, the number one choice for passwords among hackers is the word “ admin .” This password should never be used on any device, especially if that device is connected to the internet. Other passwords that hackers try include: “ 12345 ,” “ default ,” “ password ,” and “ root .” Last year, the UK’s National Cyber Security Centre (NCSC) said that the password “ 123456 ” was found 23 million times in breaches.
The passwords cybercriminals try also reflect the types of devices they target, F-Secure said. For example, they were found to be trying recorders video and routers.
“ Brute forcing default usernames and passwords of IoT devices remains an effective method for using these devices in botnets, which can be used in DDoS attacks ,” F-Secure warned.
Security experts stress that passwords for devices connected to the internet should be unique and long enough. "Passphrases" are more effective, according to the FBI.
