Nothing is Safe 1

Overview  Why Passwords?  Current Events  Password Security & Cracking  Tools  Demonstrations Linux GPU Windows  Conclusions 2

Benefits of Using Passwords  Security …. Is there any other reason? 3

The password landscape is changing. With increased computing power, the time to crack passwords is dropping significantly 4

Password Events  In 2009, three Filipino residents hacked thousands of phone networks for profit by exploiting default passwords left on the private branch exchange (PBX) systems. (washingtonpost.com)  June 2011, LulzSec hacked FBI affiliate Infragard. Stolen passwords included plaintext passwords which were reused on other services and websites, leading to a wider-scale hack. (naked security)  Dec 2012, a 25-GPU cluster was developed with the power to check 350 billion guesses/sec. It can crack any 8 character Windows NTLM password in less than 6 hours. (ars technica)  Jan 2013, Google has been researching password-replacing technology. Currently this includes authentication via finger rings, USB cryptographic cards, and could potentially include wireless verification in the future. (wired) 5

 In 2012, a Verizon analysis revealed that 90 percent of intrusions were the result of either weak passwords, default passwords, reused passwords, or stolen credentials. (knowledge miner) 6

Password Security  Windows recommendation: 7

Password Security  University of Idaho’s Password Requirements: A-Z, a-z, 0-9, symbols Password (expires in 90 days) 8 characters+ No dictionary words over 3 letters long Passphrase (expires in 400 days) 15+ characters Dictionary words allowed 8

Brute Force Crack Times  Class D: 10,000,000 Passwords/sec, Fast PC, Dual Processor PC.  Class E. 100,000,000 Passwords/sec, Workstation, or multiple PC's working together.  Class F. 1,000,000,000 Passwords/sec, Typical for medium to large scale distributed computing, Supercomputers. (lockdown) 9

Cracking Helpers  Dictionaries: Wordlists containing cracked passwords Also contain dictionary words May also have custom word lists for foreign languages  Rainbow Tables: A table of hashed passwords Computationally expensive to produce Password lookup is quick once the table is generated 10

Password Salting  A salt is random data that is added in a unique way to a password to make decrypting passwords from hashes more difficult.  Salts are usually generated at the time of account creation and stored in a database table separate from the password hash.  When a user logs onto a system, their stored salt is added to the typed in password and then hashed to compare to the stored password hash for verification. 11

Tools – John the Ripper  Attempts to crack hashed passwords from almost all commonly used hashing algorithms using user characteristics, word lists, and brute force modes.  JTR has three modes: -single -wordlist -incremental Default behavior is to run through each mode, in that order. (backreference) 12

Tools – Cain & Abel  “Allows easy recovery of various kinds of passwords by: sniffing the network, cracking encrypted passwords using dictionary, brute-force and cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords, and analyzing routing protocols.” (oxid) 13

Tools - Hashcat  Hashcat is a multi-platform password cracking tool that can take advantage of your GPU and can run on up to 128 GPU’s. It has 4 variants that can be used depending on your needs. 14

Tools – Hashcat Attack Modes: Combinator Dictionary Fingerprinting Mask Permutation Rules-based Table-based Toggle-case 15

Demonstrations  John the Ripper  Cain & Abel  Hashcat 16

Conclusions  Many password cracking utilities are free and readily available.  With technological advances (Moore’s Law), password cracking is becoming faster and easier.  Because of increases in password cracking technology, alternate authentication technologies are being developed. 17

Summary  Why Passwords?  Current Events  Password Security and Crack Times  Cracking Demonstrations 18

References     s_led_to_55_mi.html  affiliate-hacked-by-lulzsec/   htm  ripper/     standard-windows-password-in-6-hours/ 19