From RockYou to RockYou2024: Analyzing Password Patterns Across Generations, Their Use in Industrial Systems and Vulnerability to Password Guessing Attacks

Abstract

Passwords are a common user authentication method, and must be safeguarded by effective security measures. However, there are many cases of compromised user credentials in data breaches. This work studies Rock-You2024, a massive data breach that occurred in July 2024 and exposed over 9 billion passwords. We investigate the passwords with regard to their lengths, entropy, use of personal information and common strings, and evaluation from zxcvbn, as well as making a comparative assessment of the results with previous password databases, namely RockYou2021 and RockYou, which was leaked in 2009. This analysis found that the passwords from RockYou2021 and RockYou2024 are significantly more secure than those from RockYou, which suggests an improvement in password creation awareness and policies. It was also noted that RockYou2021 and RockYou2024 have similar statistical distributions in all the analyses conducted. We have also found that the country of origin for most passwords within these databases is most likely to be the United States of America. These datasets were searched for passwords that are often used in industrial systems, which pose potential security risks in critical infrastructure sectors. Finally, we also propose passBiRVAE, a contextualized Bidirectional Recurrent Neural Network, used to generate passwords based on the RockYou2024 database. Future works should make further improvements to the results obtained from this model. However, there is a risk of threats to the validity of these analyses.