There was a lot of buzz about the leak of two huge databases of passwords a few days ago. This has been reported by Try Hunt on his blog. The two databases are called “Anti-Trust-Combo-List” and “Exploit.In“. If the sources of the leaks are not officially known, there are some ways to discover some of them (see my previous article about the “+” feature offered by Google).
A few days after the first leak, a second version of “Exploit.In” was released with even more passwords:
|
Name |
Size |
Credentials |
| Anti-Trust-Combo-List |
16GB |
540.701.509 |
| Exploit.In |
15GB |
499.305.318 |
| Exploit.In (2) |
24GB |
805.499.579 |
With the huge of amount of passwords released in the wild, you can assume that your password is also included. But what are those passwords? I used Robbin Wood‘s tool pipal to analyze those passwords.
I decided to analyze the Anti-Trust-Combo-List but I had to restart several times due to a lack of resources (pipal requires a lot of memory to generate the statistics) and it failed always. I decided to use a sample of the passwords. IÂ successfully analyzed 91M passwords. The results generated by pipal are available below.
What can we deduce? Weak passwords remain classic. Most passwords have only 8 characters and are based on lowercase characters. Interesting fact: users like to “increase” the complexity of the password by adding trailing numbers:
- Just one number (due to the fact that they have to change it regularly and just increase it at every expiration)
- By adding their birth year
- By adding the current year
Basic Results Total entries = 91178452 Total unique entries = 40958257 Top 20 passwords 123456 = 559283 (0.61%) 123456789 = 203554 (0.22%) passer2009 = 186798 (0.2%) abc123 = 100158 (0.11%) password = 96731 (0.11%) password1 = 84124 (0.09%) 12345678 = 80534 (0.09%) 12345 = 76051 (0.08%) homelesspa = 74418 (0.08%) 1234567 = 68161 (0.07%) 111111 = 66460 (0.07%) qwerty = 63957 (0.07%) 1234567890 = 58651 (0.06%) 123123 = 52272 (0.06%) iloveyou = 51664 (0.06%) 000000 = 49783 (0.05%) 1234 = 35583 (0.04%) 123456a = 34675 (0.04%) monkey = 32926 (0.04%) dragon = 29902 (0.03%) Top 20 base words password = 273853 (0.3%) passer = 208434 (0.23%) qwerty = 163356 (0.18%) love = 161514 (0.18%) july = 148833 (0.16%) march = 144519 (0.16%) phone = 122229 (0.13%) shark = 121618 (0.13%) lunch = 119449 (0.13%) pole = 119240 (0.13%) table = 119215 (0.13%) glass = 119164 (0.13%) frame = 118830 (0.13%) iloveyou = 118447 (0.13%) angel = 101049 (0.11%) alex = 98135 (0.11%) monkey = 97850 (0.11%) myspace = 90841 (0.1%) michael = 88258 (0.1%) mike = 82412 (0.09%) Password length (length ordered) 1 = 54418 (0.06%) 2 = 49550 (0.05%) 3 = 247263 (0.27%) 4 = 1046032 (1.15%) 5 = 1842546 (2.02%) 6 = 15660408 (17.18%) 7 = 14326554 (15.71%) 8 = 25586920 (28.06%) 9 = 12250247 (13.44%) 10 = 11895989 (13.05%) 11 = 2604066 (2.86%) 12 = 1788770 (1.96%) 13 = 1014515 (1.11%) 14 = 709778 (0.78%) 15 = 846485 (0.93%) 16 = 475022 (0.52%) 17 = 157311 (0.17%) 18 = 136428 (0.15%) 19 = 83420 (0.09%) 20 = 93576 (0.1%) 21 = 46885 (0.05%) 22 = 42648 (0.05%) 23 = 31118 (0.03%) 24 = 29999 (0.03%) 25 = 25956 (0.03%) 26 = 14798 (0.02%) 27 = 10285 (0.01%) 28 = 10245 (0.01%) 29 = 7895 (0.01%) 30 = 12573 (0.01%) 31 = 4168 (0.0%) 32 = 66017 (0.07%) 33 = 1887 (0.0%) 34 = 1422 (0.0%) 35 = 1017 (0.0%) 36 = 469 (0.0%) 37 = 250 (0.0%) 38 = 231 (0.0%) 39 = 116 (0.0%) 40 = 435 (0.0%) 41 = 45 (0.0%) 42 = 57 (0.0%) 43 = 14 (0.0%) 44 = 47 (0.0%) 45 = 5 (0.0%) 46 = 13 (0.0%) 47 = 1 (0.0%) 48 = 16 (0.0%) 49 = 14 (0.0%) 50 = 21 (0.0%) 51 = 2 (0.0%) 52 = 1 (0.0%) 53 = 2 (0.0%) 54 = 22 (0.0%) 55 = 1 (0.0%) 56 = 3 (0.0%) 57 = 1 (0.0%) 58 = 2 (0.0%) 60 = 10 (0.0%) 61 = 3 (0.0%) 63 = 3 (0.0%) 64 = 1 (0.0%) 65 = 2 (0.0%) 66 = 9 (0.0%) 67 = 2 (0.0%) 68 = 2 (0.0%) 69 = 1 (0.0%) 70 = 1 (0.0%) 71 = 3 (0.0%) 72 = 1 (0.0%) 73 = 1 (0.0%) 74 = 1 (0.0%) 76 = 2 (0.0%) 77 = 1 (0.0%) 78 = 1 (0.0%) 79 = 3 (0.0%) 81 = 3 (0.0%) 83 = 1 (0.0%) 85 = 1 (0.0%) 86 = 1 (0.0%) 88 = 1 (0.0%) 89 = 1 (0.0%) 90 = 6 (0.0%) 92 = 3 (0.0%) 93 = 1 (0.0%) 95 = 1 (0.0%) 96 = 16 (0.0%) 97 = 1 (0.0%) 98 = 3 (0.0%) 99 = 2 (0.0%) 100 = 1 (0.0%) 104 = 1 (0.0%) 107 = 1 (0.0%) 108 = 1 (0.0%) 109 = 1 (0.0%) 111 = 2 (0.0%) 114 = 1 (0.0%) 119 = 1 (0.0%) 128 = 377 (0.0%) Password length (count ordered) 8 = 25586920 (28.06%) 6 = 15660408 (17.18%) 7 = 14326554 (15.71%) 9 = 12250247 (13.44%) 10 = 11895989 (13.05%) 11 = 2604066 (2.86%) 5 = 1842546 (2.02%) 12 = 1788770 (1.96%) 4 = 1046032 (1.15%) 13 = 1014515 (1.11%) 15 = 846485 (0.93%) 14 = 709778 (0.78%) 16 = 475022 (0.52%) 3 = 247263 (0.27%) 17 = 157311 (0.17%) 18 = 136428 (0.15%) 20 = 93576 (0.1%) 19 = 83420 (0.09%) 32 = 66017 (0.07%) 1 = 54418 (0.06%) 2 = 49550 (0.05%) 21 = 46885 (0.05%) 22 = 42648 (0.05%) 23 = 31118 (0.03%) 24 = 29999 (0.03%) 25 = 25956 (0.03%) 26 = 14798 (0.02%) 30 = 12573 (0.01%) 27 = 10285 (0.01%) 28 = 10245 (0.01%) 29 = 7895 (0.01%) 31 = 4168 (0.0%) 33 = 1887 (0.0%) 34 = 1422 (0.0%) 35 = 1017 (0.0%) 36 = 469 (0.0%) 40 = 435 (0.0%) 128 = 377 (0.0%) 37 = 250 (0.0%) 38 = 231 (0.0%) 39 = 116 (0.0%) 42 = 57 (0.0%) 44 = 47 (0.0%) 41 = 45 (0.0%) 54 = 22 (0.0%) 50 = 21 (0.0%) 48 = 16 (0.0%) 96 = 16 (0.0%) 49 = 14 (0.0%) 43 = 14 (0.0%) 46 = 13 (0.0%) 60 = 10 (0.0%) 66 = 9 (0.0%) 90 = 6 (0.0%) 45 = 5 (0.0%) 71 = 3 (0.0%) 56 = 3 (0.0%) 92 = 3 (0.0%) 79 = 3 (0.0%) 98 = 3 (0.0%) 63 = 3 (0.0%) 61 = 3 (0.0%) 81 = 3 (0.0%) 51 = 2 (0.0%) 58 = 2 (0.0%) 65 = 2 (0.0%) 53 = 2 (0.0%) 67 = 2 (0.0%) 68 = 2 (0.0%) 76 = 2 (0.0%) 111 = 2 (0.0%) 99 = 2 (0.0%) 73 = 1 (0.0%) 72 = 1 (0.0%) 74 = 1 (0.0%) 70 = 1 (0.0%) 69 = 1 (0.0%) 77 = 1 (0.0%) 78 = 1 (0.0%) 64 = 1 (0.0%) 109 = 1 (0.0%) 114 = 1 (0.0%) 119 = 1 (0.0%) 83 = 1 (0.0%) 107 = 1 (0.0%) 85 = 1 (0.0%) 86 = 1 (0.0%) 104 = 1 (0.0%) 88 = 1 (0.0%) 89 = 1 (0.0%) 57 = 1 (0.0%) 100 = 1 (0.0%) 55 = 1 (0.0%) 93 = 1 (0.0%) 52 = 1 (0.0%) 95 = 1 (0.0%) 47 = 1 (0.0%) 97 = 1 (0.0%) 108 = 1 (0.0%) | | | | | | | || ||| ||| ||| ||| ||| ||| ||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 000000000011111111112222222222333333333344444444445555555555666666666677 012345678901234567890123456789012345678901234567890123456789012345678901 One to six characters = 18900217 (20.73%) One to eight characters = 58813691 (64.5'%) More than eight characters = 32364762 (35.5%) Only lowercase alpha = 25300978 (27.75%) Only uppercase alpha = 468686 (0.51%) Only alpha = 25769664 (28.26%) Only numeric = 9526597 (10.45%) First capital last symbol = 72550 (0.08%) First capital last number = 2427417 (2.66%) Single digit on the end = 13167140 (14.44%) Two digits on the end = 14225600 (15.6%) Three digits on the end = 6155272 (6.75%) Last number 0 = 4370023 (4.79%) 1 = 12711477 (13.94%) 2 = 5661520 (6.21%) 3 = 6642438 (7.29%) 4 = 3951994 (4.33%) 5 = 4028739 (4.42%) 6 = 4295485 (4.71%) 7 = 4055751 (4.45%) 8 = 3596305 (3.94%) 9 = 4240044 (4.65%) | | | | | | | | | ||| ||| |||| ||| | |||||||||| |||||||||| |||||||||| |||||||||| |||||||||| 0123456789 Last digit 1 = 12711477 (13.94%) 3 = 6642438 (7.29%) 2 = 5661520 (6.21%) 0 = 4370023 (4.79%) 6 = 4295485 (4.71%) 9 = 4240044 (4.65%) 7 = 4055751 (4.45%) 5 = 4028739 (4.42%) 4 = 3951994 (4.33%) 8 = 3596305 (3.94%) Last 2 digits (Top 20) 23 = 2831841 (3.11%) 12 = 1570044 (1.72%) 11 = 1325293 (1.45%) 01 = 1036629 (1.14%) 56 = 1013453 (1.11%) 10 = 909480 (1.0%) 00 = 897526 (0.98%) 13 = 854165 (0.94%) 09 = 814370 (0.89%) 21 = 812093 (0.89%) 22 = 709996 (0.78%) 89 = 706074 (0.77%) 07 = 675624 (0.74%) 34 = 627901 (0.69%) 08 = 626722 (0.69%) 69 = 572897 (0.63%) 88 = 557667 (0.61%) 77 = 557429 (0.61%) 14 = 539236 (0.59%) 45 = 530671 (0.58%) Last 3 digits (Top 20) 123 = 2221895 (2.44%) 456 = 807267 (0.89%) 234 = 434714 (0.48%) 009 = 326602 (0.36%) 789 = 318622 (0.35%) 000 = 316149 (0.35%) 345 = 295463 (0.32%) 111 = 263894 (0.29%) 101 = 225151 (0.25%) 007 = 222062 (0.24%) 321 = 221598 (0.24%) 666 = 201995 (0.22%) 010 = 192798 (0.21%) 777 = 164454 (0.18%) 011 = 141015 (0.15%) 001 = 138363 (0.15%) 008 = 137610 (0.15%) 999 = 129483 (0.14%) 987 = 126046 (0.14%) 678 = 123301 (0.14%) Last 4 digits (Top 20) 3456 = 727407 (0.8%) 1234 = 398622 (0.44%) 2009 = 298108 (0.33%) 2345 = 269935 (0.3%) 6789 = 258059 (0.28%) 1111 = 148964 (0.16%) 2010 = 140684 (0.15%) 2008 = 111014 (0.12%) 2000 = 110456 (0.12%) 0000 = 108767 (0.12%) 2011 = 103328 (0.11%) 5678 = 102873 (0.11%) 4567 = 94964 (0.1%) 2007 = 94172 (0.1%) 4321 = 92849 (0.1%) 3123 = 92104 (0.1%) 1990 = 87828 (0.1%) 1987 = 87142 (0.1%) 2006 = 86640 (0.1%) 1991 = 86574 (0.09%) Last 5 digits (Top 20) 23456 = 721648 (0.79%) 12345 = 261734 (0.29%) 56789 = 252914 (0.28%) 11111 = 116179 (0.13%) 45678 = 96011 (0.11%) 34567 = 90262 (0.1%) 23123 = 84654 (0.09%) 00000 = 81056 (0.09%) 54321 = 73623 (0.08%) 67890 = 66301 (0.07%) 21212 = 28777 (0.03%) 23321 = 28767 (0.03%) 77777 = 28572 (0.03%) 22222 = 27754 (0.03%) 55555 = 26081 (0.03%) 66666 = 25872 (0.03%) 56123 = 21354 (0.02%) 88888 = 19025 (0.02%) 99999 = 18288 (0.02%) 12233 = 16677 (0.02%) Character sets loweralphanum: 47681569 (52.29%) loweralpha: 25300978 (27.75%) numeric: 9526597 (10.45%) mixedalphanum: 3075964 (3.37%) loweralphaspecial: 1721507 (1.89%) loweralphaspecialnum: 1167596 (1.28%) mixedalpha: 981987 (1.08%) upperalphanum: 652292 (0.72%) upperalpha: 468686 (0.51%) mixedalphaspecialnum: 187283 (0.21%) specialnum: 81096 (0.09%) mixedalphaspecial: 53882 (0.06%) upperalphaspecialnum: 39668 (0.04%) upperalphaspecial: 18674 (0.02%) special: 14657 (0.02%) Character set ordering stringdigit: 41059315 (45.03%) allstring: 26751651 (29.34%) alldigit: 9526597 (10.45%) othermask: 4189226 (4.59%) digitstring: 4075593 (4.47%) stringdigitstring: 2802490 (3.07%) stringspecial: 792852 (0.87%) digitstringdigit: 716311 (0.79%) stringspecialstring: 701378 (0.77%) stringspecialdigit: 474579 (0.52%) specialstring: 45323 (0.05%) specialstringspecial: 28480 (0.03%) allspecial: 14657 (0.02%)