How Do Hackers Steal Passwords and How to Stop Them

TL;DR

Hackers steal or discover passwords through guessing, harvesting, cracking, password spraying, and credential stuffing. Strong defenses include long passwords checked against known vulnerable-password databases, unique credentials stored in a password manager, multi-factor authentication, passkeys, rate limiting, and monitoring for repeated login failures over time.

Transcript

Have you ever wondered how a bad guy hacks your password? It's a big problem. In fact, according to both IBM's Cost of a Data Breach Report and the X-Force Threat Intelligence Index, stolen, misused, or otherwise compromised credentials are the number one attack type. There are lots of ways this is done, but in this video, I'm gonna focus on five d... Read More

Key Insights

• Password guessing is an attempt to predict a credential using imagination, knowledge about an individual, passwords exposed on nearby notes, or databases created from previous breaches. Account lockout policies commonly limit this approach by stopping further attempts after three incorrect guesses.
• Password harvesting is the direct collection of a valid credential through malware or deception. A keylogger or information stealer can record typed passwords, while a phishing site can imitate a legitimate login page and send the submitted credentials to an attacker.
• Password cracking works by hashing candidate passwords and comparing the results with hashes extracted from a stolen password database. The attacker does not reverse the one-way hashing process, but identifies a password when a newly calculated hash matches a stored one.
• Password dictionaries and publicly known password lists make cracking more targeted than testing arbitrary combinations. If those sources fail, an attacker can attempt brute force by trying every possible password combination and hashing each candidate for comparison with the stolen hashes.
• Password spraying applies one likely password across many accounts within a single system. Because each account receives only one attempt before the attacker moves to the next, the attack can avoid three-strike lockouts and remain difficult to notice when conducted slowly.
• Credential stuffing applies a password across multiple systems rather than multiple accounts in one system. It exploits password reuse and can be harder to detect because separate systems may be monitored by different security personnel who cannot see the complete pattern.
• Password length is a major source of password strength, and excessive complexity can encourage people to write credentials down. Systems should also reject passwords found in databases of known vulnerable credentials and, when possible, identify reuse across multiple systems.
• Passkeys replace passwords with a stronger solution based on cryptographic techniques. Other recommended protections include password managers, multi-factor authentication, and rate limiting that rejects abnormal bursts of login attempts after normal authentication traffic has been baselined.

Questions & Answers

Q: What are the five main methods hackers use to steal passwords?

The five methods are password guessing, harvesting, cracking, password spraying, and credential stuffing. Guessing predicts a password, while harvesting captures it through malware or phishing. Cracking compares hashes of candidate passwords with stolen hashes. Spraying tests one password across many accounts in one system, while stuffing tests a password across multiple systems.

Q: How does password guessing work?

Password guessing begins with a candidate selected from imagination, personal knowledge about the account owner, a password written on a visible note, or a database of credentials exposed by earlier breaches. The attacker tries to log in and repeats the process after a failure. Many systems limit this method by locking the account after three incorrect attempts.

Q: How do keyloggers and phishing sites harvest passwords?

A keylogger or information stealer records what a person types, including passwords, and either stores the information for later retrieval or sends it to the attacker in real time. Phishing instead persuades someone to enter credentials into a fake website that appears legitimate. In both cases, the attacker receives the actual credential and can attempt a direct login.

Q: How does password cracking reveal a hashed password?

Password cracking does not reverse the one-way hashing process. An attacker starts with stolen password hashes, selects readable candidates from known-password databases, dictionaries, or brute-force combinations, and hashes each candidate using the same method. When a candidate hash matches a stolen hash, the attacker knows which readable password produced it and can use that credential.

Q: What is the difference between password spraying and credential stuffing?

Password spraying tests one likely password against many accounts within a single system. Credential stuffing tests a password across multiple systems. Both approaches exploit common or reused passwords, but their scope differs. Spraying can avoid account lockouts by making only one attempt per account, while stuffing can evade coordinated detection because different systems may have different security personnel.

Q: Why can password spraying avoid account lockouts?

Password spraying distributes login attempts across many accounts instead of repeatedly targeting one account. The attacker tries a chosen password once on the first account, then moves to the next account and continues through the system. Because no individual account receives three rapid failures, a three-strike lockout policy may not activate, especially when the attack proceeds slowly.

Q: How can people create and manage safer passwords?

People should favor long passwords, avoid credentials listed in databases of known vulnerable passwords, and use different passwords across systems. A password manager can generate strong credentials and keep track of them, reducing the pressure to memorize every password. This also makes password reuse less likely and reduces the number of systems exposed when one credential is compromised.

Q: What security controls help prevent password attacks?

Recommended controls include testing password length and appropriate complexity, checking proposed passwords against known vulnerable-password databases, encouraging unique credentials through password managers, and adding multi-factor authentication. Passkeys provide a passwordless option based on cryptographic techniques. Rate limiting can also reject abnormal bursts of login attempts, while monitoring can identify multiple authentication failures occurring over time.

Summary & Key Takeaways

• Password guessing uses personal knowledge, exposed notes, imagination, or passwords revealed in previous breaches to predict a credential. Because many systems lock an account after three failed attempts, ordinary guessing is unlikely to succeed unless the attacker makes an informed guess that proves correct within the permitted attempts.

• Harvesting captures credentials directly instead of predicting them. Keyloggers and information-stealing malware can record everything typed and send or store the data for an attacker. Phishing achieves a similar result by directing a person to a fake website where entered credentials flow directly to the attacker.

• Cracking compares hashes of candidate passwords with stolen password hashes, while spraying and stuffing reuse likely passwords across accounts or systems. Recommended defenses include long unique passwords, password managers, multi-factor authentication, passkeys, rate limiting, checks against known vulnerable passwords, and detection of repeated authentication failures over time.