These are the most commonly hacked passwords – is one of them yours?

Hundreds of millions of internet users continue to put themselves at risk of having their accounts hacked by using incredibly simple and commonly used passwords which can easily be guessed by cyber criminals – or worse, just plucked from databases of stolen information.

An analysis of the 100,000 most common passwords made public by data breaches and hacking campaigns suggests that vast swathes of people still don’t understand the importance of having a strong password – or how to create one – using names, sports teams, bands and even just keys close together on the keyboard in an effort to secure accounts.

The passwords have been gathered using information from global data data breaches which are already in the public domain, having been leaked, shared or sold by hackers on the dark web.

The full list has been created and shared by the UK’s National Cyber Security Centre – the cyber arm of the GCHQ intelligence service – with the aim of encouraging users to create strong passwords to help protect sensitive data.

By far the most commonly used password revealed in data breaches is ‘123456’, with 23.2 million accounts using this password – made up of the first six numerical keys across the top of a keyboard; 7.7 million users went the whole hog and used almost all the numerical keys, opting to use ‘123456789’ as their password.

The remainder of the top five most commonly used passwords are each used by over 3 million users who’ve fallen data breaches – ‘qwerty’ appears 3.8m times, ‘password’ appears 3.6m times and ‘111111’ appears 3.1 million times.

Many of the top 50 most used passwords – almost all of which are used by over half a million people – are based around basic ideas, like being made up a simple series of numbers, or the same number repeated six or seven times.

Passwords ‘iloveyou’, ‘monkey’ and ‘dragon’ are among the top 20 most used, while ‘myspace1’ is ranked 26th on the list with 735,980 users selecting it as their password – it’s likely that they selected this as their password for MySpace, even if many have long forgotten about their account on the early social network.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)  

Names are a common password theme, with hundreds of thousands of users just using a single name as a password. ‘ashley’ and ‘michael’ are used by over 400,000 users each, with ‘daniel’, ‘jessica’ and ‘charlie’ each used over 300,000 times.

It’s likely that these are the users’ own names – meaning that if a hacker gets hold of an email address and no password, cracking it by using the victim’s first name might blow the thing wide open.

Bands are also a common theme when it comes to users selecting simple passwords, with the password list detailing how 285,706 users opted for ‘blink182′ as their password – making the pop-punk band the most commonly selected music related password. ’50cent’, ‘enimem’, ‘metallica’ and ‘slipknot’ are all each used over 140,000 times.

Sports teams are another common theme amongst the most reguarly breached passwords. Liverpool wins the title of most used Premier League football team in passwords, with 280,723 users choosing ‘liverpool’ to lock their account.

The remainder of the top five Premier League football teams in the top five most commonly breached passwords are ‘chelsea’ ‘arsenal’ ‘manutd’ and ‘everton’.

People who use their favourite sports team as their password could easily find themselves the victim of a hack – many sports fans will talk about their favourite team on social media and it could therefore be relatively simple for a cyber criminal to seek this information out on Twitter or Facebook and use the information in an effort to crack the account.

SEE: The secret to being a great spy agency in the 21st century: Incubating startups [TechRepublic]

A major problem with these simple passwords is that it’s incredibly likely that the users are using them across multiple accounts – meaning that if their email address and password are exposed in a breach they could easily be used to access other services they uses including social media and online shopping accounts.

“Password re-use is a major risk that can be avoided – nobody should protect sensitive data with something that can be guessed, like their first name, local football team or favourite band,” said Dr Ian Levy, NCSC’s Technical Director

“Using hard-to-guess passwords is a strong first step and we recommend combining three random but memorable words. Be creative and use words memorable to you, so people can’t guess your password.”

The NCSC – which has released the password list ahead of it’s CYBERUK 2019 conference in Glasgow – recommends using three random words as a password.

The password list was created using breached usernames and passwords collected on Have I Been Pwned, a website by security expert Troy Hunt which allows users to check if their email address appears in major data breaches.

“Making good password choices is the single biggest control consumers have over their own personal security posture. We typically haven’t done a very good job of that either as individuals or as the organisations asking us to register with them,” said Hunt.

“Recognising the passwords that are most likely to result in a successful account takeover is an important first step in helping people create a more secure online presence,” he added.

The NCSC has published advice on what makes a good password and how users can secure their accounts on the official NCSC website.

READ MORE ON CYBER SECURITY

READ MORE HERE