Feeds

Chocolate the key to uncovering PC passwords

Sweet talk and sweets is all it takes

Seven Steps to Software Security

Three years since the last time they pulled this stunt, cheeky researchers can still wangle IT passwords with free chocolate and flirting.

A train station survey of 300 office workers carried out by Infosecurity Europe researchers in London revealed the disturbing statistic that 64 per cent would hand over their office computer passwords for a bar of chocolate "and a smile".

This percentage is marginally less than the last time Infosecurity Europe used this not-so-cunning honey trap trick, as reported by ENN.

The latest survey, however, also revealed what everyone knows but no one admits: 29 per cent of office workers know their colleagues' logins, and someone always has the boss's password.

The survey, which included a number of supposedly harder-to-crack IT professionals at a security conference, also revealed that over two-thirds of respondents thought the chief executive's secretary was usually the most likely candidate to have access to the head honcho's really juicy stuff.

Good-looking, chocolate-bearing researchers apparently had to probe a bit harder with the IT professionals than random train platform suits in order to get passwords, but the questions were simple.

Researchers asked IT conference delegates if they knew what the most common password is and then asked them what their password was. Only 22 per cent of IT professionals revealed their "Open Sesame" at this point, compared to 40 per cent of non-techie commuters. If at first they refused to give their password, researchers would then ask if it was based on a child, pet, football team, etc, and then suggest potential passwords by guessing the name of their child or team. By using this social engineering technique, a further 42 per cent of IT professionals and 22 per cent of commuters inadvertently revealed their password.

As the report authors pointed out: "What many of IT professionals failed to realise is that the researchers, who conducted the survey at the IT exhibition, had also read their names and organisation from their delegate badge as well!" Whoops.

One fifth of those surveyed said their organisation no longer uses passwords, with biometrics and coded tokens de rigueur.

The average number of work-related passwords was five, and the majority of respondents who regularly update their access codes (71 per cent) changed their password monthly.

More worryingly though, just under half of people questioned used the same corporate access passwords for all their personal web accounts such as online banking, retailing, and email. Half of respondents felt safe using internet banking services, but only one fifth could say the same about online retailing.

Meanwhile, two thirds said they would look at a file containing company salary details if they were sent it by mistake, and 20 per cent said they would circulate it among colleagues. Half of those who would take a peek would not pass on juicy info such as salary details, but this was more to do with fears of internal IT systems tracking file distribution patterns than respect of privacy. That is, if they thought they might get caught, many would keep schtum - digitally speaking at least.

Finally, 39 per cent said they would tell IT department staff their password. Only 32 per cent said they would tell their boss.

Infosecurity did not break down the gender split of its survey respondents, nor reveal what type of chocolate it was giving away - important metrics.

Copyright © 2007, ENN

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.