Measuring the Risk Password Reuse Poses for a University

On September 30th, 2019, the IT Security team at the University of Chicago (UChicago) identified suspicious activity on over 100 user accounts. As a result, they locked those accounts and forced those users to change their password. As we explain below, it turns out that every affected UChicago account was reusing a password that had also been used on Chegg, an education technology company that provides homework help, textbook rentals, and other student services. Just a few weeks earlier, a data breach of Chegg had become public. Chegg relied on unsalted MD5—an outdated cryptographic hash function—to store the passwords of their 40 million subscribers. Furthermore, they did not have a process in place for deleting old accounts [4]. Faced with an ever-increasing number of accounts that require a password, many users cope by using similar passwords—or even the exact same password—across different accounts. Unfortunately for users, attackers leverage this propensity to compromise accounts. When any service suffers a data breach, attackers typically try to log into other services with the same email address or username alongside a password that is either the same as the leaked password or tweaked in simple ways. Even if a user follows every piece of advice about creating a strong password, all it takes is a single data breach to put them at risk if they have reused that password for any other account. Attackers’ ability to conduct attacks exploiting reused passwords has increased as hundreds of websites have had their password databases stolen and leaked over the last decade [8]. This state of affairs raises many questions for system administrators and IT leaders trying to protect their organizations. How do threats from password reuse compare to threats from users choosing common, easy-to-guess passwords? For how long do accounts remain vulnerable? Out of hundreds of data breaches, how important is it to account for them all? How often do attackers appear to have exploited reused passwords, and what factors make them more likely to have done so? To answer these sorts of questions, our team of academic researchers collaborated with our university’s IT Security and Identity Management teams to conduct a twenty-year retrospective analysis of our university’s vulnerability to password-guessing attacks. This analysis was possible because our university’s password-composition policy prohibits a user from ever returning to one of their previously used passwords, which requires maintaining a password history database (a time-stamped log of historical password hashes) and comparing against it whenever a user submits a new password. As a result, the university’s IT Security and Identity Management teams have a record of every password used by university affiliates over the past twenty years. When we learned about this unique data source, we realized how valuable it could be for gaining insight into the longitudinal aspects of reused and compromised credentials. At the same time, because our analysis would enable us to identify potentially vulnerable accounts that had not yet been exploited, this collaboration enabled our university to better protect users against future attacks. Our full study [10] appears at the USENIX Security Symposium in August 2023. In this article, we summarize our key findings, focusing on recommendations and lessons for organizations trying to defend against attacks exploiting password reuse.