Hackers use a variety of techniques to crack passwords. Cybercrime is estimated to be a $10.5 trillion business. This already jaw-dropping figure is forecast to increase to $23.84 trillion by 2027. 

Malicious actors are not giving up on such as lucrative industry. Businesses can implement ever-changing security protocols, but hackers always find innovative and creative ways to find a way through. 

The techniques hackers use to crack passwords rank among some of the oldest nefarious means of stealing data such as bank credentials or sensitive data of your customers that can be sold to other companies. 

Malicious actors are also engaged in cybercrime to covertly profit from ads, cause disruption on a business network, hijack systems to demand a ransom payment to release it or take down a website and ruin a business’s reputation.

Whilst hackers will naturally target high-profile multinational corporations to score a big payday, the reality is that some hackers only have the technology and skills to target small businesses. And even private users like old people. 

The importance of creating strong passwords cannot be understated. In this article, we intend to show you precisely why you need a strong password. Listed below are 10 techniques hackers use to crack passwords. 

Malware

A whole host of malicious software falls under the umbrella and malware. One of the old-school techniques hackers still use to crack passwords is keylogging, a program specifically designed to listen to keyboard activity and steal passwords. 

Keylogger programs are actually legitimate tools used by software companies such as Microsoft and Google. The software records keystrokes that enable keyboards to communicate with software programs. Keystrokes transmit a signal that tells the software which functions to perform. You can see why this is such a successful tool for cybercriminals. 

The nefarious strategy typically begins by sending spam emails or setting up fake websites that are infected with malicious malware. If the hacker’s target downloads a malware-infected file or clicks on a malicious link, the keylogger program is installed on the victim’s computer and records the keystrokes typed into the keyboard.

Brute-Force Attack 

Brute force attacks are another of the old-school techniques hacked use to crack passwords. However, now that computer users are more aware of malicious activity, brute-force attacks are losing their effectiveness. 

However, that’s not to say that we should forget that technology exists. It’s likely that hackers will figure out ways to make the technology more sophisticated. 

Having said that, only the most sophisticated hackers will utilise brute force because they need a supercomputer. As Kaspersky points out: 

“…depending on the length and complexity of the password, cracking it can take anywhere from a few seconds to many years.” ~ Kaspersky

The reality is that small fry hackers are not going to spend several months to years going after targets that won’t deliver a sweet payday. Brute force attacks are cryptanalytic attacks that require high levels of computing power. 

Supercomputers can perform 109 combinations per second. If you have a weak password, the chances are it will be cracked in under 30 seconds. It’s unlikely that supercomputers are sold as part of the Hacking-as-a-software kits on the dark web. 

Dictionary Attack 

Dictionary attacks are a form of brute force attack. Hackers use software than can perform a vast range of password variations using words from the dictionary. This is why software companies force people to include numbers and symbols in their p^$$W0rd5. 

Using actual words makes the process of cracking passwords easier. But including numbers and digits makes it more difficult for end-users to remember passwords. When you have more passwords to remember than you can count on two hands, random password generators become problematic. And do they really work anyway?

The best way to create memorable passwords is to make up a passphrase using semantically unconnected words and switching letters out for numerals and symbols. You may want to design your personal cypher such as using VV15hUp0nA* (Wish Upon A Star). 

Social Engineering

Social engineering is another broad term that is used to categorise a raft of techniques hackers use to crack passwords and steal critical data or money. Typical examples include baiting, water-holing, honeytrap, tailgating and pretexting. 

The goal of social engineering is to persuade targets to part with sensitive information that can be used for nefarious means. It can be likened to piecing together a jigsaw puzzle so requires skill and patience. 

Malicious actors prey on the natural instincts of people to trust them. A common tactic, for example, is to pose as an IT support technician or web developer and request access passwords to an app or website. 

Another social engineering technique hackers use to crack passwords is whaling – a strategy that targets C-suite executives. It’s easier to trick someone into giving up private data than using malicious software – particularly now that most employees are cybersecurity aware. 

A common approach in a whaling attack would be for the hacker to pretend to be someone the executive knows from another firm requesting them to pay an invoice or wire money to a bank account as an investment. 

We have documented some real-life examples of whaling attacks in this article. Check it out so you know which red flags to look out for.

Phishing, Smishing and Spoofing

Phishing, smishing and spoofing are forms of social engineering but we’ve decided to list them separately because they are the most common techniques hackers use to crack passwords. 

One study identified 255 million phishing attacks in a 6-month period in 2022 – a 61% increase in the whole of 2021. It is estimated that a phishing attack is carried out every 11 seconds. 

Phishing involves sending a spam email to intended targets hoping to prompt them to click on a malicious link or download a document that is infected by malware. Smishing is the equivalent of phishing but using SMS rather than email. 

Fortunately, most phishing and smishing attempts are easy to spot. Okay, they’re not as obvious as the Nigerian Prince scam or the lawyer of a deceased person that has left you $10m in their will. But they’re still pretty obvious as you can see in these real-world phishing examples. 

However, hackers have taken phishing to the next level with a technique that has been labelled ‘spoofing’. By spoofing emails from legitimate companies such as Amazon, banks, insurance companies, utility companies etc, hackers can make the emails almost look real. 

Whilst the design of spoofing emails is pretty much flawless, there are one or two clues that you can use to identify malicious emails. The best way to identify a spoof email is to check the email address of the sender. Does it look legitimate? 

Email addresses that have suspicious dots or missing letters in them should be flagged as spoof emails. Some sloppy hackers from non-English speaking countries may also include a spelling mistake or grammar error in their email. Another red flag. 

Man-in-the-Middle (MITM)

A Man-in-the-Middle attack involves hackers positioning themselves between the target user and the software client to decipher or steal login credentials. For example, an end-user may be diverted to a fake login screen which for all intents and purposes looks exactly like the original login screen. 

A typical strategy is to sit between the user and a trusted system such as a server or HTTPS connection to websites that can also “listen in” and intercept data exchanges. MITM attacks are usually the initial gateway hackers use to engage in advanced persistent threat (APT) campaigns over a long period – presumably if the reward is big enough. 

Another technique hackers are using to target remote workers is to create public Wi-Fi networks that seemingly belong to a cafe, restaurant or another trusted source. Once users are connected to the fake network will hand over all the activity they perform whilst on the network. So don’t access password-protected accounts on public Wi-Fi. 

Rainbow Table Attack

Although passwords stored on a personal computer are encrypted by using hashes. If bad actors get access to the list of password hashes stored on a computer, they can easily break the code by using a rainbow table. 

Rainbow tables contain a hash value for each plain text in a password. Once a hacker breaks one password code, it’s not too difficult to get access to other passwords in your stored list. 

Fortunately, cybersecurity firms have developed an effective strategy known as salting to thwart rainbow table attacks. Subsequently, these types of attacks are less common. Salting involves adding random data to each hash to create a complex hash that can’t be decoded using precoded tables.

Spidering 

Spiders, better known as web crawlers, are another type of specialised software developed by tech companies that are being used by hackers to crack passwords. 

The most famous spiders are Googlebots which harvest data from the World Wide Web to index web pages and make it easier for end-users to find the information they are searching for. 

In spidering, the type of information hackers is hoping to source are partners you work with, investors, the software you use, where your bank accounts are stored etc. Essentially, spidering is a prior step that can help threat actors steal access credentials in a whaling or spearphishing attack.

Fake Quizzes 

In the last few years, it has emerged that hackers have been using social media to steal password credentials. What appears to be a harmless quiz or survey on Facebook could be used to wipe out your bank account. 

Fake quizzes and surveys ask questions that are typically used as security questions for bank account access. What was the name of your first pet? What was your nickname at school? What was your first car? This is why you should never include your date of birth on social media websites. 

Once hackers have enough information on a target to take the attack to the next level, you will receive an email. This could be a spoof email from your bank as mentioned above, but more commonly will be an ad with an irresistible offer to something you are interested in. 

If you purchase the product or service, you will be routed to a payment gateway as usual. Except it won’t be a legitimate payment gateway, it will be a fake page hackers have set up to steal your password. Once they have your bank details and login number, they will use the answers you provided in the survey to try and access your account. Are banks really doing enough to protect your account? Uh-uh. 

Shoulder Surfing 

If you get the sense that someone is looking over your shoulder when you’re logging into an application or an account on your business network, it might be a hacker. 

The term ‘shoulder surfing’ literally means shoulder surfing. It’s not a technical way for hackers to steal access data – which suggests the technology most hackers have access to is not very effective. 

That’s because the tools most hackers use are already known by cybersecurity firms. Subsequently, anti-virus software and VPNs are effective and cost-efficient technologies that protect your business network. 

Best Practices to Prevent Techniques Hackers Use To Crack Passwords

1. Create unique personal cypher and passphrases that use a combination of upper and lowercase letters, symbols and numbers; example: ^^yVV1f31$K001 – My Wife Is Cool. 

2. Don’t use password generators. Brute force attacks can surely work out digitally generated passwords. They might be random generators, but hackers can also build random generators. 

3. Always check that links and documents in emails and chat room messages (such as Microsoft Teams) are from legitimate sources. Create cybersecurity protocols to double-check this. 

4. Never click on links, download or open documents that do not originate from a verified source. 

5. Perform security updates regularly (patch management) 

6. Install firewalls and anti-malware/spyware technology

7. Use multi-factor authentication software 

8. Take advantage of cloud permissions that do not give unauthorised users access to areas of your business network that stores sensitive data

IT Support Professionals in London 

Businesses that need expert advice to help protect their business network should take advantage of our IT support professionals in London. With over 20 years of experience in serving businesses in London and the southeast, Micro Pro has developed a reputation as a reliable IT support partner for businesses in the UK. Contact us today and protect your business networks against techniques hackers use to crack passwords.