NewsPublished 9 Apr 2026

Number Usage in Passwords: Take Two, (Thu, Apr 9th)

Source SANS ISC Handlers Diary

Description

In a previous diary [1], we looked to see how numbers were used within passwords submitted to honeypots. One of the items of interest was how dates, and more specifically years, were represented within the data and how that changed over time. It is often seen that years and seasons are used in passwords, especially when password change requirements include frequenty password changes. Some examples we might see today:

Impact

The use of predictable numeric patterns such as current or past years and dates in passwords weakens password entropy, making them more vulnerable to guessing and brute-force attacks. Attackers can leverage this knowledge to optimize password cracking attempts by including these common numeric sequences, increasing the likelihood of successful unauthorized access. While no direct exploit or active widespread attack is reported, the habitual use of such patterns represents a medium-level security risk by reducing password effectiveness.

Defensive guidance

There is no specific patch or fix applicable as this is a behavioral security issue related to password composition. Users and organizations should avoid including easily guessable numeric patterns such as current or past years, seasons, or dates in passwords. Instead, passwords should be constructed using a combination of unrelated characters, symbols, and numbers to increase complexity. Security policies and password guidance should emphasize avoiding date-based or sequential number patterns. No vendor advisory or official fix is applicable for this issue.

Summary

The threat involves the predictable use of numeric sequences, especially years and dates, in passwords captured by honeypots. Analysis of nearly 500,000 unique passwords submitted between April 2024 and March 2026 reveals frequent inclusion of contiguous numbers like '123', '1234', and years corresponding to the current or previous years. Passwords often incorporate years at the end, with some containing future years or date formats (YYYYMMDD, MMDDYYYY, DDMMYYYY). This pattern suggests users commonly embed dates related to password change requirements or personal information, which can be exploited by attackers using targeted password guessing strategies. Additionally, some numeric sequences in passwords were linked to command attempts related to network stress testing or DDoS activity, though these are separate from the password pattern issue.

References

isc.sans.edu/diary/rss/32866 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Apr 2026, 01:06 UTC

References

Community reviews