Authentication in Information Security Part 4

Attacks on Passwords • Password Spraying • A password spraying attack selects one or a few common passwords (Password1 or 123456) • and then enters the same password when trying to login to several user accounts. Because this targeted guess is spread across many accounts, instead of attempting multiple password variations on a single account, it is much less likely to raise any alarms or lock out the user account from too many failed password attempts Brute Force Attack • every possible combination of letters, numbers, and characters is attempted to determine the user’s password. The attack is not done in a random fashion but instead uses a particular approach to create the passwords. Online brute force attack • Unlike a password spraying attack, in which one password is used on multiple accounts, in an online brute force attack, the same account is continuously attacked (called pounded) by entering different passwords. However, an online brute force attack is rarely used by attackers because it is impractical. Even at two or three tries per second, it could take thousands of years to guess the right password. In addition, most accounts can be set to disable all logins after a limited number of incorrect attempts (such as five), thus putting an end to the threat. Offline brute force attack • An offline brute force attack begins with a stolen digest file. An attacker loads this file onto a computer and then uses password cracking software to create candidate digests of every possible combination of letters, numbers, and characters. The candidates are matched against those in a stolen digest file to find a match. This is the slowest yet most thorough method. Rule Attack • Uses rules to generate possible password variations from part of a user name or from modifying pre-configured mask words in the input. • rule attack conducts a statistical analysis on the stolen passwords. The results of this analysis is then used to create a mask of the format of the candidate password. A mask of ?u ? l ?l ?l ?l ?d ?d ?d ?d (u 5 uppercase, l 5 lowercase, and d 5 digit) would tell the password cracking program, Use an uppercase letter for the first position, a lowercase letter for the next four positions, and digits for the remaining four positions. Using a mask will significantly reduce the time needed to crack a password. • There are three basic steps in a rule attack: • 1. A small sample of the stolen password plaintext file is obtained. • 2. Statistical analysis is performed on the sample to determine the length and character sets of the passwords, • 3. A series of masks is generated that will be most successful in cracking the highest percentage of passwords. Dictionary Attack • A dictionary attack begins with the attacker creating digests of common dictionary words as candidates and then comparing them against those in a stolen digest file. A dictionary attack is shown in Figure. Dictionary attacks are successful because users often create passwords from simple dictionary words. • A dictionary attack that uses a set of dictionary words and compares it with the stolen digests is known as a preimage attack, in that one known digest (dictionary word) is compared to an unknown digest (stolen digest). Dictionary Attack Rainbow Tables • Rainbow tables make password attacks easier by creating a large pregenerated data set of candidate digests. A rainbow table is a compressed representation of passwords that are related and organized in a sequence (called a chain). • Although generating a rainbow table requires a significant amount of time, once it is created, it has three significant advantages over other password attack methods. A rainbow table can be used repeatedly for attacks on other passwords; rainbow tables are much faster than dictionary attacks; and the amount of memory needed on the attacking machine is greatly reduced. Password Collections • Using stolen password collections as candidate passwords is the foundation of password cracking today, and almost all password cracking software tools accept these stolen “wordlists” as input. Websites host lists of these leaked passwords that attackers can download along with important statistics and masks for a rule attack. These sites also attempt to crack submitted password collections. One website boasts more than 1.45 trillion cracked hashes.