Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.
I’ve done a lot of internal infrastructure pentests, for companies of various sizes, and there wasn’t a single pentest where spraying MonthYYYY for the past two months wouldn’t get at least one hit.
That, and the fact that every company has at least one server hidden somwhere that’s still vulnerable to MS17-010, that they can’t update or replace for one reason or the other.
You are 100% describing my company… Still relying on SMB1 protocols and a “server” running windows XP in a closet somewhere. But we have 4 different passworded accounts minimum to do our job, and they all rotate at different times and can’t reuse varying amounts of previous passwords and have different requirements to be accepted… It is a nightmare to the point everyone just saves their passwords to the browser and/or write them on a pad of paper sitting on their desk. This includes computers that are in an area open to the public that anyone could just walk up and start using.
That is an absolute nightmare.
Yup. And all of this was at the recommendation of the million dollar security consultant we hired to get us out of the ransomware attack because we still have people that open all e-mail attachments.
I’m pretty sure we ended up trying to pay the ransom but it didn’t actually work, lol.
Yikes! I hope you find a better place eventually.
I assume if special characters were required then it became MonthYYYY!, yes?
It makes me smile a little to know that the spirit of ms08-067 still lives on in some way.
I was pretty sure that was eternal blue but didn’t believe it would still be relevant 10 years later.
To be fair, last internal pentest I was doing before switching jobs was like more than 5 years ago, so the situation might’ve changed.