Passwords in use in a university timesharing environment

0 n Thursday morning, November 3, 1988, the national news reported that a computer virus had shut down a nationwide computer network, Internet. The virus, actually a worm program, took advantage of “flaws in utility programs in systems based on BSD-derived versions of Unix.” uThe flaws allowed the program to break into those machines and copy itself, thus infecting those systems,” cvcntually spreading to thousands of machines and halting normal network activity [ 111. One part of the worm program attempted to break user passwords using a mini-dictionary of 432 words it contained [l 11. This list, only a part of the program, raised several important questions: Where did the list come from? How was it created? Is the list representative of passwords found on other computers. ) We cannot answer the first two questions, but we can provide possible answers to the last.