Who needs software vulnerabilities when you can find lame passwords?

Most criminals don't need to target software to infiltrate a network and get at sensitive data:getting credentials will do the job just fine.