Cracking

Cracking

• Brute-force attack that guesses repeatedly

Cracking

• Brute-force attack that guesses repeatedly
• The attack could literally try to login to the application repeatedly (if no checks prevent it)

Cracking

• Brute-force attack that guesses repeatedly
• The attack could literally try to login to the application repeatedly (if no checks prevent it)
• Or guessing are repeated against known hashed passwords from a data breach (more on that next)

Rainbow Table Attacks

Rainbow Table Attacks

• See slide from Hasing and Salting

Your Data has been Leaked

• https://haveibeenpwned.com/

Fortune Favors the Hackers

Fortune Favors the Hackers

• The deck is currently stacked in the attacker's favor

Fortune Favors the Hackers

• The deck is currently stacked in the attacker's favor
• Enterprise software vendors haven't moved to stronger hash types

Fortune Favors the Hackers

• The deck is currently stacked in the attacker's favor
• Enterprise software vendors haven't moved to stronger hash types
• Moore's law has helped attackers tremendously

Fortune Favors the Hackers

• The deck is currently stacked in the attacker's favor
• Enterprise software vendors haven't moved to stronger hash types
• Moore's law has helped attackers tremendously
• Existing defenses (password policies) have lead to exploitable predictability

Fortune Favors the Hackers

• The deck is currently stacked in the attacker's favor
• Enterprise software vendors haven't moved to stronger hash types
• Moore's law has helped attackers tremendously
• Existing defenses (password policies) have lead to exploitable predictability
• pass-the-hash attacks, which can make password cracking unnecessary

Strong Passwords

Strong Passwords

• The oldies but goodies
• At least 1 uppercase character (A-Z)
• At least 1 lowercase character (a-z)
• At least 1 digit (0-9)
• At least 1 special character (punctuation) — do not forget to treat space as special characters too
• Not more than 2 identical characters in a row (e.g., 111 not allowed)

Strong Passwords P2

Strong Passwords P2

• At least 10 characters
• At most 128 characters (don't have a small max)

Strong Passwords P2

• At least 10 characters
• At most 128 characters (don't have a small max)
• Long passwords can increase cracking time from hours to billions of years

Strong Passwords P2

• At least 10 characters
• At most 128 characters (don't have a small max)
• Long passwords can increase cracking time from hours to billions of years
• Check passwords against a list of known weak passwords (don't allow if found)

Password Topology

Password Topology

• Predictable user behavior is BAD for security
  • WeakSauce@2018 -> WeakSauce@2018!
  • Oct0b3r! -> N0v3mb3r! -> D0c3mber!

Password Topology

• Predictable user behavior is BAD for security
  • WeakSauce@2018 -> WeakSauce@2018!
  • Oct0b3r! -> N0v3mb3r! -> D0c3mber!
• Attackers can reduce cracking time by focusing on known user behaviors and patterns

Password Topology

• Predictable user behavior is BAD for security
  • WeakSauce@2018 -> WeakSauce@2018!
  • Oct0b3r! -> N0v3mb3r! -> D0c3mber!
• Attackers can reduce cracking time by focusing on known user behaviors and patterns
• Ban commonly used password topologies

Password Topology

• Predictable user behavior is BAD for security
  • WeakSauce@2018 -> WeakSauce@2018!
  • Oct0b3r! -> N0v3mb3r! -> D0c3mber!
• Attackers can reduce cracking time by focusing on known user behaviors and patterns
• Ban commonly used password topologies
• Force users to change topologies with each new password

Failed Logins

Failed Logins

• Failed login messages should NOT indicate which part of the login was incorrect

Failed Logins

• Failed login messages should NOT indicate which part of the login was incorrect
• Limit the amount of failed logins during a certain time frame

Further Suggestions

Further Suggestions

• Two Factor Authentication
  • Absolutely use it when possible

Further Suggestions

• Two Factor Authentication
  • Absolutely use it when possible
• Password Managers
  • Security comunity is mixed
  • if they lead to longer, safer, less predictable passwords then they are ok

The End

• Now let's all go change our passwords