"List of Common Passwords Accounts for Nearly All Cyberattacks"

Rapid7 recorded every attempt to compromise two common types of servers over a 12-month period using its honeypot network, discovering that the attempted credential attacks resulted in 512,000 permutations. Almost all of those passwords are found in a common password list, which is the RockYou2021 file containing 8.4 billion entries. This implies that attackers, or the subset of threat actors attacking Rapid7's honeypots, are following a set of rules. According to Tod Beardsley, director of research at Rapid7, the overlap in all of the attacks also suggests that attackers are taking the easy route. It seems that the attackers are not trying to be creative when it comes to unfocused, untargeted attacks across the Internet. Every year, security firms present research indicating that users continue to choose poor passwords. In October 2021, a cybersecurity researcher in Tel Aviv, Israel, discovered that he could recover the passwords to 70 percent of the wireless networks he cycled past, often because the password was a cellphone number. In 2019, an analysis of passwords leaked to the Internet revealed that "123456" was the most commonly used password, followed by "123456789" and "qwerty." However, it is unclear whether those leaks included old or rarely used accounts without password policies. Rapid7 researchers focused on common passwords used by attackers rather than defenders in this case, so the analysis applies to attackers' guesses in brute-force attacks. According to an analysis by cybersecurity firm ESET, such attacks have increased dramatically during the COVID-19 pandemic, with password guessing becoming the most popular method of attack in 2021. This article continues to discuss common passwords accounting for nearly all credential-based cyberattacks. 

Dark Reading reports "List of Common Passwords Accounts for Nearly All Cyberattacks"