Password Cracking and Hashing

• Password attacks

  • How can you break a password?

    • Brute-force login (online attack, unlikely!)

    • Hack the server, steal passwords (still unlikely!)

    • Hack the server, steal and crack the hashes (offline attack, more likely!)

    • Social engineering (flawless!)

  • Brute force – try as many passwords as you can

    • Medusa

    • Hydra

    • JohnTheRipper

    • Hashcat

    • Charsets vs dictionary vs hybrid

    • Takes a huge amount of time, especially with complex passwords

    • Easily detected (ban, backoff, lockout policies)

  • Password hashes

    • A one way cryptographic function.

    • A summary of the contents of a piece of text

    • Irreversible

    • Collision = 2 inputs generating the same hash

    • Birthday paradox

      • How many people do you need in a room for a 50% chance of 2 of them to share the same birthday? 23. 30 people is 70%. 70 people its 99.9%

  • Rainbow tables

    • Files with precomputed hashes.

    • Search instead of compute

    • Huge. Gigabytes and terrabytes of storage.

    • Download or generate on our own.

    • Mitigation?

      • Long passwords

      • Password salting. Password + random salt.

  • Horizontal Brute-Force

    • Exploits password reuse

    • Two types:

      • Password spraying: choose one password, try different usernames

      • Credential stuffing: Try the same user/pass combination on multiple services.