sirlonewolf

I got this from one of my friends that works in IT [hide=PHPBB Password Analysis]PHPBB Password Analysis Posted by Robert Graham, Feb 6, 2009 05:56 PM A popular Website, phpbb.com, was recently hacked. The hacker published approximately 20,000 user passwords from the site. This is like candy to us security professionals because it's hard data we can use to figure out how users choose passwords. I wrote a program to analyze these passwords looking for patterns, and came up with some interesting results. This incident is similar to one two years ago when MySpace was hacked, revealing about 30,000 passwords. Both Wired and InfoWorld published articles analyzing the passwords. The striking different between the two incidents is that the phpbb passwords are simpler. MySpace requires that passwords "must be between 6 and 10 characters, and contain at least 1 number or punctuation character." Most people satisfied this requirement by simply appending "1" to the ends of their passwords. The phpbb site has no such restrictions -- the passwords are shorter and rarely contain anything more than a dictionary word. It's hard to judge exactly how many passwords are dictionary words. A lot of words, like "xbox" or "pokemon," are clearly words, but aren't in an English dictionary. I ran the phpbb passwords through various dictionary files and come up with a 65% match (for a simple English dictionary) and 94% (for "hacker" dictionaries). The dictionary words were overwhelmingly simple ones, like "apple" or "orange," rather than complex words like "pomegranate." 16% of passwords matched a person's first name. This includes people choosing their own first names or those of their spouses or children. The most popular first names were Joshua, Thomas, Michael, and Charlie. But I wonder if there is something else going on. Joshua, for example, was also the password to the computer in "Wargames," which almost certainly accounts for it being at top. Variations of the name "Jordan" are popular, which almost certainly refers to "Michael Jordan," a prominent basketball start (such as "jordan23," referring to his jersey number). This makes me wonder how many people use "Michael" as a password to refer to their children compared to sports stars. 14% of passwords were patterns on the keyboard, like "1234," "qwerty," or "asdf." There are a lot of different patterns people choose, like "1qaz2wsx" or "1q2w3e." I spent a while googling "159357," trying to figure out how to categorize it, then realized it was a pattern on the numeric keypad. I suppose whereas "1234" is popular among righthanded people, "159357" will be popular among lefties. 4% are variations of the word "password," such as "passw0rd," "password1," or "passwd." I googled "drowssap," trying to figure out how to categorize it, until I realized it was "password" spelled backward. 5% of passwords are pop-culture references from TV, movies, and music. These tend to be youth culture ("hannah," "pokemon," "tigger") and geeky ("klingon," "starwars," "matrix," "legolas," "ironman"). Music, though, appears to have a much broader age demographic, with a lot of old bands, like "ironmaiden." Some notable pop-culture references are chosen not because they are popular, but because they sound like passwords, such as "ou812" ('80s Van Halen album), "blink182" ('90s pop), "rush2112" ('80s album), and "8675309" ('80s pop song). 4% of passwords appear to reference things nearby. The name "samsung" is a popular password, I think because it's the brand name on the monitor that people are looking at (I have two in front of me right now). Similarly, there are a lot of names of home computers like "dell," "packard," "apple," "pavilion," "presario," "compaq," and so on. It's hard to figure out what belongs in this category, though. Is "cocacola" a popular password because there is a can of coke on their desks? Or just because it's a well-known name? In any event, "cocacola" appears to be more popular than "pepsi" among those who choose passwords. 3% of passwords are "emo" words. Swear words, especially the F-word, are common, but so are various forms of love and hate (like "iloveyou" or "ihateyou"). 3% are "don't care" words. I've always thought that dialogs, like Microsoft's UAC, should have a button labeled "whatever." When prompted with, "This program may contain a virus, do you want to run it?" instead of having two buttons, "YES" or "NO", dialogs should contain a third button labeled "WHATEVER" or "I DON'T CARE." A lot of password choices reflect this attitude, either implicitly with "abc123" or "blahblah," or explicitly with "whatever," "whocares," or "nothing." 1.3% are passwords people saw in movies/TV. This is a small category, consisting only of "letmein," "trustno1," "joshua," and "monkey," but it accounts for a large percentage of passwords. 1% are sports related. I'm not a sports fan so I'm unlikely to recognize a lot them and categorize them correctly. The U.S. has a lot of popular sports, a lot of teams, and a lot of stars. This breadth means that no particular name is very popular, but in other countries, they become more concentrated. For example, in the U.K., the popular soccer teams, "arsenal" and "liverpool," are regularly in the Top 10 lists of passwords. Here is the top 20 passwords from the phpbb dataset. You'll find nothing surprising here; all of them are on this Top 500 list. 3.03% "123456" 2.13% "password" 1.45% "phpbb" 0.91% "qwerty" 0.82% "12345" 0.59% "12345678" 0.58% "letmein" 0.53% "1234" 0.50% "test" 0.43% "123" 0.36% "trustno1" 0.33% "dragon" 0.31% "abc123" 0.31% "123456789" 0.31% "111111" 0.30% "hello" 0.30% "monkey" 0.28% "master" 0.22% "killer" 0.22% "123123" Notice that whereas "myspace1" was one of the most popular passwords in the MySpace dataset, "phpbb" is one of the most popular passwords in the phpbb dataset. I'm interested why "dragon," "master," and "killer" made the list. They appear prominently in other password lists, too. I have no explanation for their popularity. The password length distribution is as follows: 1 character 0.34% 2 characters 0.54% 3 characters 2.92% 4 characters 12.29% 5 characters 13.29% 6 characters 35.16% 7 characters 14.60% 8 characters 15.50% 9 characters 3.81% 10 characters 1.14% 11 characters 0.22% Note that phpbb has no requirements for password lengths, so people tend to choose shorter passwords than for sites like MySpace. Update: Ashley Pinner wrote to tell me that phpBB3 uses the newer salted-passwords that require a minimum of six characters, and that anybody who has logged in since the change has had their accounts upgraded to the new hashing scheme. This means if you have logged into phpbb.com recently, then your password is less likely to have been stolen. Update: A lot of left-handed people have told me that they use their right hand for the mouse, and therefore my theory about "159357" is incorrect. Robert Graham is CEO of Errata Security. Special to Dark Reading[/hide] i hope player have better passwords Nough Said

thanks u all she is at the Cockroach soldiers now its not that fast but at least she is getting 10 crimson charms a trip

she dont do slayer all her slayer lvl's are from quest and randoms ps: her summoning is now lvl 63

this is my wifes account and she wants 70 summoning for zamorak hawk where can she go and train to get the best drops of crimson charms for her lvl .

Hawt :thumbsup: Where's the proof that it's actually an official account? Quick find code: 14-15-72-58211248 here i took a pic i wonder why thy did not an announce this on the official runescape webpage news ?

I dont think so Betrayal at Falador was not on the list so why would the new book be?

I wish jagex would not keep us in the dark, i am getting a Stomach Alsur (lol) from all this waiting in suspens for mechscape / stellar dawn things i will like to know 1: what skill will there be how menny and to what level will u be able to train them 2: story line, what type of quest, mini quest and mini games will be avalible wen the game is releast 3: character development. will there be diffrent starting races,classes and or factions. 4:modes of transport ect. vehicles and Teleportation devices ( not by magical means ) 5:equipment , inventory slots how meny will there be 6:the playable world and environment. will there be one world like in runescape or multiple planets each with there own environment 7: player vs player, player vs monster and player vs environment. how will this be implemented. 8: bots, autoers, trade limits and rwt. hope thy dont break the game and make it unpleasant for us legal and honest players. 9: contents updates. how freequnt will it be 10: the cost of membership this is what i would like to know and if i forgot someting please post it Ps: a estimated time of release.

i do sometimes till prayer and/or food is up that how i got my first d-legs from steel dragons Ps some tasks i hate to do like corrupted terror birds so i telly as soon i am done with them

If you check the list closely, you will see that it contains both "Mechscape" and "Stellar Dawn". yes that is true but mechscape was regested in 2005 and it could have been a codename used till the real name stellar dawn was regested.

a funorb game i did not think of that i hope not i want mechscape or stellar dawn :pray:

I found this while searching for news about mechscape ( i can't wait to try it ) stellar dawn it sound like a space adventure so maybe it is mechscape's real name or a hole new mmo that jagex is working on EDIT on 14-02-2009 [hide=Q & A about Mechscape by head of mechscape]Head Of Mechscape Answers Your Questions, from Mechscape World Q & A about Mechscape on Mechscape World[/hide]

bts feb 2009 [hide=] [/hide] no quest :cry: :wall: :x

today is the day we all been waiting for the 150th quest ( bts feb ) :ohnoes: :ohnoes: :ohnoes: :ohnoes: :ohnoes: :ohnoes: hope we are not dissapointed :o best of luck to all :pray:

Thank you all for the quick replays

Hi I would like to know how u can become a animal in castle wars in the waiting room. I have ask the players that turn in to sheep, bunnys and imps but thy dont want to tell how to do it. eny help with this will be welcome thx

I would like to see a sequel to cold wars (i love those penguins ) and then there is still a lot of items that still need to come out borrows boots dragon pickaxe dragon warhammer dragon kite shield dragon cape or cloak more abyssal armor and weapons granite boots and gloves more granite weapons more crystal armor and weapons a upgrade to proselyte and boots, gloves and shield would be nice and useful and the one item i would like most to come from the 150th quest is: dragon limb so we can make dragon crossbows ps. a RFD2 will be awesome to especially if it has like 15 to 25 side quest to do

hi again U have never replayed to my previous post on your thread and i would like to be on your support list. Some where in 2009 jagex in going to open the eastern land and with that lots of new content for runescape i think it would be the perfect place for a new skill to start and a new skill will be due in 2009 if jagex keep to how thy release new skills i also like the idea of dinosaurs for summoning i think it will be fun to have dinosaurs for pets to One more idea i have is some rare fossils can be cleaned and framed or assembled to be displayed in your player owned house Thanks for a great threat and i hope we get the Archeology skill in 2009 Ps: please update your support list

I'm surprised that, given this line, no one has mentioned archeology. And the, "Leave no stone unturned." line that was mentioned a bit ago. Yes i think archeology skill has a great chance of being the next skill if u look at Varrock Museum and the 100 Kudos u will need to travel to the Dig Site Island (not released yet) there is also a great thread about a archeology skill check it out

Happy b-day and hope there is many more to come ( late but not forgotten ) :thumbsup: =D> \ I am always excited about the updates to the game and i think the game can only get better and better thanks for the best game ever Ps: I can not wait to see what 2009 will bring to the game pss: Forgive all the noobs that always complain about Jagex been unfair and not bringing updates out on time or taking away the wild or free trading the game is better for it and take your time with the updates so u can make Runescape better for all thank u.

Assassins Creed, mass effect, crysis, and spore are but a few games u can play on your new pc 3 more games that ill get wen thy come out is starcraft 2, diablo 3, and fallout 3 enjoy your new pc and have fun with the new game u gona play on it

every one ask me to wait for the firemaking update. now that the update is here and we know what it bring to firemaking ( Beacon Network Mini game ) and the nice xp and rewards it gives. The beacon lighting is nearly like my signal fires and bonfires combined now if we only can make the wood required into bonfire bundles. This is really a nice addition to firemaking but firemaking needs more diversity and be more useful as a skill with more benefits and support for other skills. Player need the skill to have benefits for them for there hard work of getting a high level in the skill.

here are some more that i got Abyssal Demon lvl 124 id=439 Abyssal Walker lvl 81 id=510 Abyssal Guardian lvl 59 id=512 Abyssal Leech lvl 41 id=511

Yes sir. And, I still don't see Parts 3 or 4... and people are wanting Part 5? here i parts 3 and 4 for u

here are some pic's of the guards in Falador. first one lvl 19 id=621 no.2 lvl 21 no. id tag the only one i found was this one http://tip.it/runescape/index.php?rs2monster_id=62 no. 3 lvl 22 with crossbow id=740 no. 4 with bow id=626 i hope these help

wen is part 5 coming out :ohnoes: