>

Continue from Are Passwords Dead? Part 1.

Distributed hash cracking
Over the years, password policies have become more sophisticated. Users may be forced to have passwords of at least eight characters, use non-alphanumeric characters, and use a password that is not a derivation of an English word. For example, the password b0b5d0g! is not a good password because numbers are used in a common substitution for letters (“5” for an “s”) and it’s simply followed by an exclamation point.

These password policy restrictions are due in part to the fact that password cracking has become so much more advanced. Tools such as L0phtcrack and John the Ripper do more than guess simple passwords. They are able to do many types of substitutions of letters and permutations of dictionary words to guess more complicated passwords. Obviously, the more substitutions and permutations the tools perform, the more passwords they may have to guess before finding the right one and the longer the process takes.

Many modern password cracking tools can now be run in a distributed fashion. Rather than have one machine guess passwords for 10 days, 100 machines can be configured to guess the same number of passwords in 2.4 hours. For perspective, a 2GHz Intel machine may be able to guess about 5,000 password values in a second. 100 machines will do half a million. Even complex passwords will fall relatively quickly when an attacker is trying 42 billion passwords a day.

Read The Full Article»

Over the last 30 years of information security, there has been one constant protection mechanism deployed on systems all over the world: passwords. Be it your four digit automatic teller machine PIN, your eight character Windows workstation password, or the WEP key protecting your wireless network, the idea of “something you know” has been the one factor of authentication everyone can live with. But have we reached a point where passwords are obsolete?

Over the years, passwords and how they are handled have changed. On UNIX systems, the cryptographic hashes of passwords used to be stored in a world readable file. However, as attackers became more savvy and computers got faster, these cryptographic hashes could be used to perform offline brute force password guessing. So on modern UNIX systems, the passwords are in files that are only readable by the superuser.

Also, Cisco routers used to be considered so secure that passwords were stored in the clear in the configuration file. Then, as network engineers became more security minded, Cisco developed a simple Caesar cipher to obscure the password. This was only marginally better than the cleartext password as hackers were able to ‘unobscure’ the text in milliseconds. Now Cisco devices have the capability to store passwords as cryptographic hashes in a similar manner to what is used in most UNIX systems.

Read The Full Article»