Password Spraying

What is it?

Password Spraying happens when an attacker places a list of usernames in a program and runs (sprays) various passwords with the list of usernames. An attacker hopes that at least username and password combination will work. Attackers will typically try to use common passwords against the usernames, as those are what are most likely to work.

Why is it dangerous?

An attacker needs just one of those passwords to match a username to be able to login and compromise a system, network, organization, etc.

How do you combat these attacks?

Use passwords that are unique to you –
- include a mix of symbols, numbers, lower and upper-case letters
- avoid words you find in the dictionary
- consider using a phrase or sentence, then take the first letter of each word and add symbols and numbers that make sense for you to remember
Do NOT reuse passwords – Why? Because if a personal account you have is compromised, attackers will try to use that password to gain access to other accounts of yours by using the password discovered.

Want to check if any of your accounts have been a part of a known data breach?
Copy and paste this link into a URL to find out! https://haveibeenpwned.com/

If your account was associated in a breach:

Make sure you’ve changed your password since the date of the breach occurred
Don’t reuse the old compromised account password ever again

Don’t use password (or similar passwords) found on a dump lists. If your password is similar to one on the list -- Ex. It has 2018, 2019, or 2020 in it -- please change it immediately.

Password Dump List

Winter2016
Winter2017
Winter16
Winter17
Winter12
Spring2016
Spring2017
Spring16
Spring17
Spring12
Summer2016
Summer2017
Summer16
Summer17
Fall2016
Fall2017
Summer16
Summer17
Fall2016
Fall2017
Fall1234
Autumn2016
Autumn2017
Autumn16
Autumn17
Autumn12
Password1
Password2
Password3
Password4
Password5
Password6
Password7
Password8
Password9
Password01
Password12
Password123
Pa$$w0rd
Password2016
Password2017
Password16
Password17
January1
January2016
January2017
January16
January17
February1
February2016
February2017
February16
February17
March123
March2016
March2017
April123
April2016
April2017
May12345
June1234
June2016
June2017
July1234
July2016
July2017
August12
August2016
August2017
August16
August17
September1
September2016
September2017
September16
September17
October1
October2016
October2017
October16
October17
November1
November2016
November2017
November16
November17
December1
December2016
December2017
December16
December17
Master12
Master2016
Master2017
Master16
Master17
Dragon12
Dragon2016
Dragon2017
Dragon16
Dragon17
Monkey12
Monkey2016
Monkey2017
Monkey16
Monkey17
Shadow12
Shadow2016
Shadow2017
Shadow16
Shadow17
Qwerty12
Qwerty2016
Qwerty2017
Qwerty16
Qwerty17
God12345
Iloveyou1
Iloveyou2016
Iloveyou2017
Iloveyou16
Iloveyou17
Thankyou1
Thankyou2016
Thankyou2017
Thankyou16
Thankyou17
Welcome1
Welcome2016
Welcome2017
Welcome16
Welcome17
Baseball1
Baseball2016
Baseball2017
Baseball16
Baseball17
Football1
Football2016
Football2017
Football16
Football17
Letmein1
Letmein2016
Letmein20162017
Letmein16
Letmein17
Abc1234
Mustang1
Mustang2016
Mustang2017
Mustang16
Mustang17
Access12
Access2016
Access2017
Access16
Access17
Superman1
Superman2016
Superman2017
Superman16
Superman17
Batman1
Batman2016
Batman2017
Batman16
Batman17
Qwertyuiop1
Qwertyuiop2016
Qwertyuiop2017
Qwertyuiop16
Qwertyuiop17
123Qweasd
Jesus123
Jesus2016
Jesus2017
Ninja123
Ninja2016
Ninja2017