Passwords are the key to our networks and online identities so it makes sense that password hacking would be the focus of many cyber criminals. In the Iranian hacking effort, password “spraying” technique was used to infiltrate 36 US companies and 11 more in Europe. Traditional password hacking involves trying thousands of passwords against a single account in the hopes of gaining access. Password spraying broadens the scope: Hackers find publicly available company email addresses and attempt to access these accounts using common passwords.

What happens once they’re in? Anything goes. Email can be deleted, forwarded, contacts or other user names and passwords can be stolen. In the Iranian hack, they downloaded existing data and set up email forwarding rules to receive new messages meant for the victim. Even if the user updated his or her password, the email forwarding rules stayed in place unless changed.

This is a reminder that your network is only as secure as the weakest password connected with it. If just one person in the organization uses a common password, your entire network is at risk. Most people know not to use ‘12345678’ or ‘password’ as their password, but what about ‘1qaz2wsx’? That looks strong, doesn’t it? It has eight seemingly random letters and numbers. This password is actually what is known as a “keyboard walk” and it is surely one of the first passwords used in password cracking tools.

Want to know if a password has been compromised? Enter it into https://haveibeenpwned.com/Passwords. This website tells you if a password has been breached in the past. 1qazwsx has been breached 726,341 times!

A user may think he or she is being clever using a keyboard walk password. This website is a great tool to show the danger of this type of passwords.