How Do Hackers Steal Passwords?

Hackers know that people often choose easy-to-remember passwords based on their names, birthdates, pets, and favorite things. These passwords are highly vulnerable to dictionary attacks.

The UK’s National Cyber Security Center (NCSC) found around one in six people use their pets’ names as passwords, and one in three people use the same password across multiple accounts and websites, making them easy targets.

To protect yourself against dictionary attacks:

• Don’t use common words or personal information in your passwords – Avoid anything that could easily be guessed or found through social media.
• Create unique passwords for every account – This significantly reduces the impact if one password happens to be compromised.
• Use a password manager – Most password managers include password generators that can create strong passwords that are randomly generated and are difficult to crack using dictionary attacks. They then store them, so they’re readily accessible while also being secure.
• Watch out for data breaches – Many password managers, including 1Password and Keeper, can also alert you if a password you’ve saved has been involved in a known data breach.

1Password

9.5

Review

Visit 1Password

They rely on the fact that many people reuse the same passwords across multiple websites and services. If one of your accounts is compromised in a data breach, and you use the same password elsewhere, hackers can easily access all your other accounts by testing password combinations.

Hackers can also use a reverse brute-force attack, in which they start with a known password and attempt to match it with other usernames.

Password managers provide several ways to defend against credential-stuffing attacks.

• Use unique passwords for every online account – This prevents a single breach from having a cascading effect on your entire online presence. Password keepers make it easy to store as many strong, unique passwords as you need.
• Use a password generator – This can help you create complex and truly random passwords. Of course, a password vault can store them, so you don’t have to remember them, and they’ll typically flag weak and reused passwords.
• Check for leaked credentials – Many password apps incorporate features to check if your email addresses or passwords have been exposed in data breaches, enabling you to update them before criminals can take advantage of the stolen credentials.

These communications may create a sense of urgency and claim there are issues with your account, or they might offer tantalizing deals. The goal is to get you to click on a malicious link or download an infected attachment.

Malware and keyloggers can potentially record all your login details, giving hackers access to your accounts. Fraudsters also set up fake sites that resemble real domains. If you enter your details here, they’ll immediately fall into the wrong hands.

The infamous “Nigerian Prince” scam is a classic example of a phishing attack. The victim receives an email from a supposedly wealthy person claiming to need help transferring money and offers a generous reward – but all they really want are your details or a “down payment” that will apparently unlock the funds.

Phishing attacks accounted for over a third of all US data breaches in 2023. For more information, check out our articles on the anatomy of a phishing attack and the Geek Squad scam.

Warning signs of phishing attempts include:

• Poor grammar and spelling – Phishing emails are often riddled with errors.
• Generic greetings – Emails may start with “Dear Customer” instead of your name.
• Suspicious URLs – Hover over links without clicking them to check their destinations. Misspelled domains or unusual addresses are red flags.
• Demands for immediate action – Phishers want you to act rashly without thinking things through, so always take a moment to consider what you’re being asked.

Expert tip – Many of the best antivirus software products include anti-phishing features. These tools actively analyze websites and emails to identify and block potential phishing attempts. Popular solutions include McAfee and Norton, which comes with its own password manager. You might also consider using one of the best VPN tools to further protect yourself from online tracking.

Norton

9.3

Review

Visit Norton

Once installed on your device, keyloggers can secretly record and transmit sensitive information, facilitating data exfiltration.

Keyloggers are often spread through phishing emails, malicious attachments, and infected websites. They can even sneak onto your devices via seemingly legitimate software downloads. To protect yourself from keyloggers:

• Keep your antivirus and anti-malware software up to date – Reliable security software can detect and remove keyloggers.
• Be cautious about what you download – Only download software and files from trusted sources, and be wary of emails from individuals you don’t know.
• Use a virtual keyboard for sensitive information – Some password managers and banks offer virtual keyboards that prevent keylogging as your key presses don’t go through an actual keyboard.
• Be vigilant when using public computers – Avoid logging into sensitive accounts on public computers, as they could be infected with malicious software.

If you believe you may be a victim of keylogging, check out our guide to how to detect keylogger software, how to remove spyware from iPhone, and how to remove spyware from Android.

Common social engineering tactics and password theft techniques include:

• Scenario building – Creating a false pretext or scenario to gain the victim’s trust and extract information.
• Baiting – Offering something enticing, like a free download or prize, in exchange for sensitive information.
• Quid pro quos – Promising a benefit in exchange for information – such as pretending to be from tech support or IT.

The best defense against social engineering is a healthy dose of skepticism. Follow these practices:

• Verify the source – If you receive an unexpected call or text asking for personal information, independently verify the sender’s identity before providing any details. Contact the company or person directly via their official website or a confirmed phone number.
• Never follow suspicious links or click on attachments – These can lead to malware infections and phishing websites even if a supposed company representative has directed you on the phone to access them.
• Don’t be pressured – If someone is trying to rush you into making a decision or providing information, it’s usually a red flag. Take your time to assess the situation.
• Educate yourself about common social engineering tactics – By learning the tricks fraudsters use, you’ll make it harder to deceive you.

Unfortunately, many people still use simple, easy-to-guess passwords like “123456” and “password.” Password spraying attacks leverage this weakness. To protect yourself from password spraying:

• Never use common or default passwords – They’re the first ones that hackers will try.
• Implement account lockout policies – Set your online accounts to lock after a few failed login attempts. This slows down password-spraying attacks.
• Monitor for suspicious login activity – Keep an eye on your account activity logs. Report any unauthorized login attempts immediately.
• Use multi-factor authentication (MFA) – If you have two-factor authentication or MFA in place, it’ll make unauthorized access dramatically harder, even if your password is guessed. Password managers like 1Password and NordPass can integrate with MFA tools like Google Authenticator to further streamline the login process. See our guide on how to set up and use Google Authenticator for more advice.