2.4 Password attacks

Question 1

Plaintext / unencrypted passwords

Answer 1

• Some applications store passwords “in the clear”
  –No encryption. You can read the stored password.
  –This is rare, thankfully
• Do not store passwords as plaintext
  –Anyone with access to the password file or
  database has every credential
• What to do if your application saves passwords
  as plaintext:
  –Get a better application

Question 2

Hashing a password

Answer 2

Hashes represent data as a fixed-length string of text
–A message digest, or “fingerprint”
* Will not have a collision (hopefully)
–Different inputs will not have the same hash
* One-way trip
–Impossible to recover the original message
from the digest
–A common way to store passwords

Question 3

A hash example

Answer 3

• SHA-256 hash
  –Used in many applications

Question 4

The password file

Answer 4

Different across operating systems and applications
–Different hash algorithms

Question 5

Spraying attack

Answer 5

• Try to login with an incorrect password
  –Eventually you’re locked out
• There are some common passwords
  –https://en.wikipedia.org/wiki/List_of_the_most_
  common_passwords
• Attack an account with the top three (or more)
  passwords
  –If they don’t work, move to the next account
  –No lockouts, no alarms, no alerts

Question 6

Brute Force

Answer 6

• Try every possible password combination until the
  hash is matched
• This might take some time
  –A strong hashing algorithm slows things down
  –The hash
• Brute force attacks - Online
  –Keep trying the login process
  –Very slow
  –Most accounts will lockout after a number of
  failed attempts
• Brute force the hash - Offline
  –Obtain the list of users and hashes
  –Calculate a password hash, compare it to a stored hash
  –Large computational resource requirement.