Whilst there are many ways criminals may steal passwords, the following three techniques are of the greatest risks to Australian Businesses:

1. Social engineered phishing attacks

‘Phishing’ is a technique used by cyber-criminals to trick a victim into handing over passwords and credentials. This will usually be done via sending an authentic looking email and asking users to either ‘log in’ or ‘reactive their account.’ The victim will then click on a link taking them to a realistic looking website where they will be prompted to provide personal details. Examples may include asking users to reactive Netflix accounts, phone accounts or electricity bills. As hackers know majority of people use the same passwords for most accounts, they are then able to steal the users credentials and attempt to hack their business profile.

2. Spray attacks

Spray attacks are a ‘scattergun approach’ by hackers. Criminals will use a range of common and weak passwords against a range of usernames, in attempts to gain a match. Once this match is acquired, the hacker can either breach the program they are trying to hack, or record the username + password combo to hack a more valuable asset – such as a business. The hacker can also record the combo to sell onto other hackers or, extort the user.

3. Brute force

Brute force is the opposite of a spray attack and usually more common against larger companies. In a brute force attack, hackers will target one, or a select few, accounts and attempt to guess passwords to gain access to a business. Pending the perceived size of the reward, hackers may spend large amounts of time attempting to breach one company network. Research has shown, longer and more complex passwords are exponentially harder to crack.^[v]  Is It is therefore imperative that business owners apply long passphrases to avoid a brute force attack.