reasoning analytically about password cracking software
play

Reasoning Analytically About Password-Cracking Software Enze Alex - PowerPoint PPT Presentation

Nov 15, 2023 •1.66k likes •2.25k views

Reasoning Analytically About Password-Cracking Software Enze Alex Liu, Amanda Nakanishi, Maximilian Golla, David Cash, and Blase Ur November 26, 2019 | PasswordsCon | Stockholm, Sweden People Choose Weak Passwords Johnny14! 2 November 26,

  1. Reasoning Analytically About Password-Cracking Software Enze “Alex” Liu, Amanda Nakanishi, Maximilian Golla, David Cash, and Blase Ur November 26, 2019 | PasswordsCon | Stockholm, Sweden

  2. People Choose Weak Passwords Johnny14! 2 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  3. What Makes a Password “Weak”? Weak Passwords Frequency Fr Pas asswords 3 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  4. What Makes a Password “Weak”? Weak Passwords Frequency Fr Pas asswords Guess # 1.3 x 10 9 Guess #1 Guess #387 123456 qwerty1 nx71!iceCream 4 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  5. Guess Number = Approximate Strength Example: Johnny14! Guess #: 390,000 5 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  6. Application 1: Strength Meters Strength Meter 6 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  7. Application 2: Proactive Checking Password123! 7 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  8. Application 2: Proactive Checking “No!” 8 November 26, 2019 | PasswordsCon | Stockholm, Sweden Per Thorsheim, founder of PasswordsCon

  9. Application 3: Academic Research 9 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  10. Guess # Depends on Model We don’t think in “cracks,” we think in guess numbers! RNN != != != PCFG Guess #: Guess #: Guess #: Guess #: 1,928,730,033 8,346,290,721 inf. 390,000 Password Cracking: Guess Number: Johnny14! - cracked Depends on “trained” model 10 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  11. Goals For Guess Numbers 1. Compute guess numbers efficiently 2. Configure guessing method systematically 3. Approximate real-world attack Password Guess Efficient Number Configuration Real-World 11 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  12. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 12 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  13. Password-Cracking Methods Probabilistic Models Software Tools 13 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  14. Probabilistic Models Markov Models [Narayanan and Shmatikov, CCS 2005] Probabilistic Context-Free Grammars [Weir et al., S&P 2009] Neural Networks [Melicher et al., USENIX Security 2016] Guess # Configuration Real 14 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  15. Password-Cracking Methods Probabilistic Models Software Tools 15 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  16. Software Tools John the Ripper Hashcat 16 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  17. Guess Number by Enumeration 123456 1. password 2. monkey Does Not Scale !!! 3. letmein 4. p@ssw0rd 5. Johnny14! 6. 17 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  18. Software Tools John the Ripper Hashcat Guess # Configuration [S&P 2019] Real 18 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  19. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 19 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  20. Mangled Wordlist Attack Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go 20 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  21. Mangled Wordlist Attack Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 21 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  22. Example Wordlists and Rulelists Wordlist Rulelist Linkedin (≈ 60,000,000) Korelogic (≈ 5,000) 10 9 – 10 15+ HIBP (≈ 500,000,000) Megatron (≈ 15,000) guesses Generated2 (≈ 65,000) + Professionals’ private word/rule lists 22 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  23. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 23 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  24. Is This Password in the Guesses? Guesses Super1 Password1 Chic4go Chicago1 Super P4ssword Chic4go super password chicago 24 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  25. Is This Password in the Guesses? Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 25 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  26. Insight We can work backwards! 26 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  27. Insight “Rule Reversal” Marechal (PasswordsCon 2012) Kacherginsky (PasswordsCon 2013) and many others 27 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  28. Inversion Process Rulelist Password Append “1” Chic4go 1. Replace “a” → “4” 2. Lowercase all 3. 28 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  29. Inversion Process Preimages Rulelist Password Append “1” Chic4go Chicago 1. Replace “a” → “4” Chic4go 2. Lowercase all 3. 29 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  30. Count Guesses Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 30 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  31. Count Guesses Wordlist Rulelist Guesses Super Append “1” Super1 1. 3 3 Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 31 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  32. Count Guesses Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 32 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  33. Approach Invert each password for each rule • Identify the first rule, if any, that guesses it • Sum guesses made by previous rules • Count guesses per rule (JtR) / word (Hashcat) • Do this once per wordlist / rulelist combo • 33 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  34. Why is this non-trivial? 34 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  35. Inverting Passwords 35 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  36. Approach to Inverting Passwords Chic4go Represent preimages as ≈ regex • Few: [ {C} {h} {i} {c} {a,4} {g} {o} ] • Many: 4444 → [ {a,4} {a,4} {a,4} {a,4} ] • (“Purge 1” reversed): [ {1}* {C} {1}* {h} {1}* {i} • {1}* {c} {1}* {a,4} {1}* {g} {1}* {o} {1}* ] Represent wordlist as trie • 36 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  37. Counting Guesses For Each Rule Wordlist Rule Guesses Super Reject if no “a”; 2 Password Replace a→ 4 Chicago Replace e→ a Super 3 Reject if no “a”; Password Chicago Replace a→ 4 37 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  38. Advantages and Disadvantages Method is preferable: • Few target passwords • Need guess number quickly • Not preferable: • Many target passwords • 38 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  39. Fast Guess Number Estimation LinkedIn + SpiderLabs Guesses Enumeration Our Approach Size ~ 3 PB ~ 10 GB Preprocessing > 2 years < 1 day Mean Lookup ??? < 1 second 39 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  40. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 40 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  41. Software Tools Depend On Contents of the wordlist Order of words Contents of the rulelist Order of rules 41 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  42. Insight: Data-Driven Configuration Rulelist Password Set Wordlist New configuration 42 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  43. Data-Driven Configuration Contents of the wordlist Order of words Contents of the rulelist Order of rules 43 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  44. Rule Ordering Should the rules be in a different order? Key idea: Order by # cracks per guess Append “1” Replace “a” → “4” 1. 1. Replace “a” → “4” Lowercase all 2. 2. Lowercase all Append “1” 3. 3. 44 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  45. Rule Ordering Results Ideal Data-driven Original 45 45 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  46. Word Completeness Should other words be in the wordlist? Key idea: Add frequent preimage “misses” Preimages Rulelist Passwords Append “1” Dagarna1 1. Dagarna Replace “a” → “@” D@g@rn@ 2. Lowercase all dagarna 3. 46 November 26, 2019 | PasswordsCon | Stockholm, Sweden

Recommend

Reasoning Analytically About Password-Cracking Software Enze Alex Liu , Amanda Nakanishi,

Reasoning Analytically About Password-Cracking Software Enze Alex Liu , Amanda Nakanishi,

Reasoning Analytically About Password-Cracking Software Enze Alex Liu , Amanda Nakanishi, Maximilian Golla, David Cash, Blase Ur Chic4go 2 Attack Model 80d561388725fa74f2d03cd16e1d687c 3 Attack Model 80d561388725fa74f2d03cd16e1d687c

822 views • 81 slides
Distributed GPU password cracking Alexander Kasabov &amp; Jochem van Kerkwijk System and

Distributed GPU password cracking Alexander Kasabov &amp; Jochem van Kerkwijk System and

Distributed GPU password cracking Alexander Kasabov &amp; Jochem van Kerkwijk System and Network Engineering { akasabov | jkerkwijk } @os3.nl February 2, 2011 Outline Introduction Password cracking Graphics processing unit Distributed

501 views • 16 slides
Measuring password strength by simulating password-cracking algorithms Saranga Komanduri Patrick

Measuring password strength by simulating password-cracking algorithms Saranga Komanduri Patrick

Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms Saranga Komanduri Patrick Gage Kelley, Michelle L. Mazurek, Richard Shay, Tim Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor,

1.88k views • 85 slides
Password Cracking Sam Martin and Mark Tokutomi CS466/566: Computer Security April 22, 2012 Sam

Password Cracking Sam Martin and Mark Tokutomi CS466/566: Computer Security April 22, 2012 Sam

Introduction Lets Attack A Time-Memory Trade-Off The LanManager Hash Physical Attacks Password Cracking Sam Martin and Mark Tokutomi CS466/566: Computer Security April 22, 2012 Sam Martin and Mark Tokutomi Password Cracking

1.49k views • 76 slides
Honeywords Making Password-Cracking Detectable By Ari Juels and Ronald L. Rivest Presented by

Honeywords Making Password-Cracking Detectable By Ari Juels and Ronald L. Rivest Presented by

Honeywords Making Password-Cracking Detectable By Ari Juels and Ronald L. Rivest Presented by Nunzio Cicone and Hans-Peter Hllwirth Setting Password Attacks Passwords are a notoriously weak authentication mechanism One significant

422 views • 20 slides
Password Cracking Prof. Tom Austin San Jos State University How should you store users'

Password Cracking Prof. Tom Austin San Jos State University How should you store users'

CS 166: Information Security Password Cracking Prof. Tom Austin San Jos State University How should you store users' passwords? Reverse-lookup tables A cryptographic hash is irreversible. However, you can make a table of common hashes.

359 views • 11 slides
Potential of Milky Way Potential of Milky Way given analytically given analytically XI B

Potential of Milky Way Potential of Milky Way given analytically given analytically XI B

Potential of Milky Way Potential of Milky Way given analytically given analytically XI B Bulgarian- ulgarian-S Serbian erbian A Astronomical stronomical C Conference onference XI 14-18.05.2018. - Belogradchik, 14-18.05.2018. -

248 views • 23 slides
Running a FireSim Simulation: Password Cracking on a RISC-V SoC with SHA-3 Accelerators and Linux

Running a FireSim Simulation: Password Cracking on a RISC-V SoC with SHA-3 Accelerators and Linux

Running a FireSim Simulation: Password Cracking on a RISC-V SoC with SHA-3 Accelerators and Linux https://fires.im @firesimproject MICRO Tutorial 2019 Albert Ou Agenda Configure and launch a simulation runfarm Boot Linux interactively

771 views • 28 slides
Speeding up GPU-based password cracking SHARCS 2012 Martijn Sprengers 1 , 2 Lejla Batina 2 , 3

Speeding up GPU-based password cracking SHARCS 2012 Martijn Sprengers 1 , 2 Lejla Batina 2 , 3

Speeding up GPU-based password cracking SHARCS 2012 Martijn Sprengers 1 , 2 Lejla Batina 2 , 3 Sprengers.Martijn@kpmg.nl KPMG IT Advisory 1 Radboud University Nijmegen 2 K.U. Leuven 3 March 17-18, 2012 Introduction Background Research Results

389 views • 34 slides
Team Password Manager Password Management Software for Groups http://teampasswordmanager.com

Team Password Manager Password Management Software for Groups http://teampasswordmanager.com

Team Password Manager Password Management Software for Groups http://teampasswordmanager.com What is Team Password Manager - Password manager for groups and projects - Uses projects to group passwords - Secure, fine grained password sharing -

712 views • 9 slides
Cracking Platform Dimitar Pavlov Supervisors : Gerrie Veerman Marc Smeets UvA SNE Master

Cracking Platform Dimitar Pavlov Supervisors : Gerrie Veerman Marc Smeets UvA SNE Master

Distributed Password Cracking Platform Dimitar Pavlov Supervisors : Gerrie Veerman Marc Smeets UvA SNE Master Students Michiel van Veen 08-02-2012 1 The project Research Question : How can a scalable , modular and extensible middleware

357 views • 22 slides
Cracking the code Cracking the code Houston, we have a problem. Consanguineous Marriage Tay

Cracking the code Cracking the code Houston, we have a problem. Consanguineous Marriage Tay

Cracking the code Cracking the code Houston, we have a problem. Consanguineous Marriage Tay Brain T2-Hyperintensity Sachs Stem Pelizaeus- B12 Metabolism U-Fibres Merzbacher Hypomyelination T1-Hypointensity CSF Salla LEUKODYSTROPHY

918 views • 62 slides
IAPF TRUSTEE NETWORK EVENT CRACKING THE DC CODE: VALUE FOR MONEY WELCOME Cracking the DC Code:

IAPF TRUSTEE NETWORK EVENT CRACKING THE DC CODE: VALUE FOR MONEY WELCOME Cracking the DC Code:

IAPF TRUSTEE NETWORK EVENT CRACKING THE DC CODE: VALUE FOR MONEY WELCOME Cracking the DC Code: Value for Money Rickard Mills Council Member, IAPF THANK YOU SPONSOR Cracking the DC Code: Value for Money HOUSEKEEPING Cracking the DC Code:

1.04k views • 54 slides
Network Security Topic 3: User Authentication Topic 3: User Authentication 1 Reading for this

Network Security Topic 3: User Authentication Topic 3: User Authentication 1 Reading for this

5/25/2019 Network Security Topic 3: User Authentication Topic 3: User Authentication 1 Reading for this Lecture 5/25/2019 Password Topic 3: User Authentication Password strength Salt_(cryptography) Password cracking

1.03k views • 75 slides
Effect Transition Moment Integral Can be evaluated analytically Often simplified by

Effect Transition Moment Integral Can be evaluated analytically Often simplified by

Lecture 14: Anharmonic Oscillator and Raman Effect Transition Moment Integral Can be evaluated analytically Often simplified by symmetry Gives rise to selection rules if recursion formulae exist The chemical bond as a simple harmonic

412 views • 23 slides
twenty six diagonal cracking shear f c http://www.bam.de concrete construction:

twenty six diagonal cracking shear f c http://www.bam.de concrete construction:

A RCHITECTURAL S TRUCTURES : Concrete in Compression F ORM, B EHAVIOR, AND D ESIGN ARCH 331 crushing D R. A NNE N ICHOLS vertical cracking S PRING 2018 tension lecture twenty six diagonal cracking shear f c

137 views • 3 slides
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University

Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University

Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 4 Password Strength &amp; Cracking Roadmap Password Authentication How Passwords are

512 views • 32 slides
Credential Access with Hashcat Dawid Czagan SECURITY INSTRUCTOR @dawidczagan Creator: Jens

Credential Access with Hashcat Dawid Czagan SECURITY INSTRUCTOR @dawidczagan Creator: Jens

Credential Access with Hashcat Dawid Czagan SECURITY INSTRUCTOR @dawidczagan Creator: Jens Steube Hashcat is the no. 1 offline password cracker. It supports different password cracking techniques and many hash algorithms. What's more it

894 views • 19 slides
DATABASE CRACKING: Fancy Scan, not Poor Mans Sort! Hardware Folks Cracking Folks Don Holger

DATABASE CRACKING: Fancy Scan, not Poor Mans Sort! Hardware Folks Cracking Folks Don Holger

DATABASE CRACKING: Fancy Scan, not Poor Mans Sort! Hardware Folks Cracking Folks Don Holger Pirk Eleni Petraki Strato Idreos Stefan Manegold Martin Kersten EVALUATING RANGE PREDICATES COMPLEXITY ON PAPER Scanning: O(n) Sorting:

910 views • 43 slides
PASSWORD SOFTWARE AU PC Mtg Nov. 19 DASHLANE Pros &amp; Cons o Self-learn support

PASSWORD SOFTWARE AU PC Mtg Nov. 19 DASHLANE Pros &amp; Cons o Self-learn support

PASSWORD SOFTWARE AU PC Mtg Nov. 19 DASHLANE Pros &amp; Cons o Self-learn support links o Dashlane Threat Center LASTPASS ROBOFORM DASHLANE PROs &amp; CONs PROs PC Based software app Privacy and

241 views • 7 slides
Cracking Wireless Ryan Curtin LUG@GT Ryan Curtin Cracking Wireless - p. 1 Goals By the end of

Cracking Wireless Ryan Curtin LUG@GT Ryan Curtin Cracking Wireless - p. 1 Goals By the end of

Cracking Wireless Ryan Curtin LUG@GT Ryan Curtin Cracking Wireless - p. 1 Goals By the end of this presentation (if you stay awake), you will: Goals Setting Up Checking Injection Understand the different types of wireless keys

447 views • 13 slides
Hands-On Network Security: Practical Tools &amp; Methods Security Training Course Dr. Charles J.

Hands-On Network Security: Practical Tools &amp; Methods Security Training Course Dr. Charles J.

Hands-On Network Security: Practical Tools &amp; Methods Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Hands-On Network Security Module 4 Password Strength &amp; Cracking Roadmap Password

750 views • 31 slides
Method for analytically calculating BER (bit error rate) in presence of non-linearity Gaurav

Method for analytically calculating BER (bit error rate) in presence of non-linearity Gaurav

Method for analytically calculating BER (bit error rate) in presence of non-linearity Gaurav Malhotra Xilinx Outline Review existing methodology for calculating BER based on linear system analysis. Link model with ISI, Crosstalk,

195 views • 17 slides
Tabled CLP for Reasoning over Stream Data Joaqun Arias 1 , 2 1 IMDEA Software Institute, 2

Tabled CLP for Reasoning over Stream Data Joaqun Arias 1 , 2 1 IMDEA Software Institute, 2

October 18, 2016 Tabled CLP for Reasoning over Stream Data Joaqun Arias 1 , 2 1 IMDEA Software Institute, 2 Technical University of Madrid madrid institute for advanced studies in software development technologies www.software.imdea.org Goal:

401 views • 25 slides

More recommend