reasoning analytically about password cracking software
play

Reasoning Analytically About Password-Cracking Software Enze Alex - PowerPoint PPT Presentation

Nov 15, 2023 •1.66k likes •2.25k views

Reasoning Analytically About Password-Cracking Software Enze Alex Liu, Amanda Nakanishi, Maximilian Golla, David Cash, and Blase Ur November 26, 2019 | PasswordsCon | Stockholm, Sweden People Choose Weak Passwords Johnny14! 2 November 26,

  1. Reasoning Analytically About Password-Cracking Software Enze “Alex” Liu, Amanda Nakanishi, Maximilian Golla, David Cash, and Blase Ur November 26, 2019 | PasswordsCon | Stockholm, Sweden

  2. People Choose Weak Passwords Johnny14! 2 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  3. What Makes a Password “Weak”? Weak Passwords Frequency Fr Pas asswords 3 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  4. What Makes a Password “Weak”? Weak Passwords Frequency Fr Pas asswords Guess # 1.3 x 10 9 Guess #1 Guess #387 123456 qwerty1 nx71!iceCream 4 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  5. Guess Number = Approximate Strength Example: Johnny14! Guess #: 390,000 5 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  6. Application 1: Strength Meters Strength Meter 6 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  7. Application 2: Proactive Checking Password123! 7 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  8. Application 2: Proactive Checking “No!” 8 November 26, 2019 | PasswordsCon | Stockholm, Sweden Per Thorsheim, founder of PasswordsCon

  9. Application 3: Academic Research 9 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  10. Guess # Depends on Model We don’t think in “cracks,” we think in guess numbers! RNN != != != PCFG Guess #: Guess #: Guess #: Guess #: 1,928,730,033 8,346,290,721 inf. 390,000 Password Cracking: Guess Number: Johnny14! - cracked Depends on “trained” model 10 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  11. Goals For Guess Numbers 1. Compute guess numbers efficiently 2. Configure guessing method systematically 3. Approximate real-world attack Password Guess Efficient Number Configuration Real-World 11 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  12. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 12 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  13. Password-Cracking Methods Probabilistic Models Software Tools 13 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  14. Probabilistic Models Markov Models [Narayanan and Shmatikov, CCS 2005] Probabilistic Context-Free Grammars [Weir et al., S&P 2009] Neural Networks [Melicher et al., USENIX Security 2016] Guess # Configuration Real 14 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  15. Password-Cracking Methods Probabilistic Models Software Tools 15 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  16. Software Tools John the Ripper Hashcat 16 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  17. Guess Number by Enumeration 123456 1. password 2. monkey Does Not Scale !!! 3. letmein 4. p@ssw0rd 5. Johnny14! 6. 17 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  18. Software Tools John the Ripper Hashcat Guess # Configuration [S&P 2019] Real 18 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  19. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 19 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  20. Mangled Wordlist Attack Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go 20 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  21. Mangled Wordlist Attack Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 21 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  22. Example Wordlists and Rulelists Wordlist Rulelist Linkedin (≈ 60,000,000) Korelogic (≈ 5,000) 10 9 – 10 15+ HIBP (≈ 500,000,000) Megatron (≈ 15,000) guesses Generated2 (≈ 65,000) + Professionals’ private word/rule lists 22 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  23. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 23 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  24. Is This Password in the Guesses? Guesses Super1 Password1 Chic4go Chicago1 Super P4ssword Chic4go super password chicago 24 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  25. Is This Password in the Guesses? Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 25 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  26. Insight We can work backwards! 26 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  27. Insight “Rule Reversal” Marechal (PasswordsCon 2012) Kacherginsky (PasswordsCon 2013) and many others 27 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  28. Inversion Process Rulelist Password Append “1” Chic4go 1. Replace “a” → “4” 2. Lowercase all 3. 28 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  29. Inversion Process Preimages Rulelist Password Append “1” Chic4go Chicago 1. Replace “a” → “4” Chic4go 2. Lowercase all 3. 29 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  30. Count Guesses Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 30 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  31. Count Guesses Wordlist Rulelist Guesses Super Append “1” Super1 1. 3 3 Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 31 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  32. Count Guesses Wordlist Rulelist Guesses Super Append “1” Super1 1. Password Replace “a” → “4” Password1 2. Chicago Lowercase all Chicago1 3. Super P4ssword Chic4go super password chicago 32 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  33. Approach Invert each password for each rule • Identify the first rule, if any, that guesses it • Sum guesses made by previous rules • Count guesses per rule (JtR) / word (Hashcat) • Do this once per wordlist / rulelist combo • 33 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  34. Why is this non-trivial? 34 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  35. Inverting Passwords 35 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  36. Approach to Inverting Passwords Chic4go Represent preimages as ≈ regex • Few: [ {C} {h} {i} {c} {a,4} {g} {o} ] • Many: 4444 → [ {a,4} {a,4} {a,4} {a,4} ] • (“Purge 1” reversed): [ {1}* {C} {1}* {h} {1}* {i} • {1}* {c} {1}* {a,4} {1}* {g} {1}* {o} {1}* ] Represent wordlist as trie • 36 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  37. Counting Guesses For Each Rule Wordlist Rule Guesses Super Reject if no “a”; 2 Password Replace a→ 4 Chicago Replace e→ a Super 3 Reject if no “a”; Password Chicago Replace a→ 4 37 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  38. Advantages and Disadvantages Method is preferable: • Few target passwords • Need guess number quickly • Not preferable: • Many target passwords • 38 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  39. Fast Guess Number Estimation LinkedIn + SpiderLabs Guesses Enumeration Our Approach Size ~ 3 PB ~ 10 GB Preprocessing > 2 years < 1 day Mean Lookup ??? < 1 second 39 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  40. Outline State of the art 1. How software password-cracking tools work 2. Our efficient techniques for guess numbers 3. Our techniques for systematic configuration 4. 40 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  41. Software Tools Depend On Contents of the wordlist Order of words Contents of the rulelist Order of rules 41 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  42. Insight: Data-Driven Configuration Rulelist Password Set Wordlist New configuration 42 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  43. Data-Driven Configuration Contents of the wordlist Order of words Contents of the rulelist Order of rules 43 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  44. Rule Ordering Should the rules be in a different order? Key idea: Order by # cracks per guess Append “1” Replace “a” → “4” 1. 1. Replace “a” → “4” Lowercase all 2. 2. Lowercase all Append “1” 3. 3. 44 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  45. Rule Ordering Results Ideal Data-driven Original 45 45 November 26, 2019 | PasswordsCon | Stockholm, Sweden

  46. Word Completeness Should other words be in the wordlist? Key idea: Add frequent preimage “misses” Preimages Rulelist Passwords Append “1” Dagarna1 1. Dagarna Replace “a” → “@” D@g@rn@ 2. Lowercase all dagarna 3. 46 November 26, 2019 | PasswordsCon | Stockholm, Sweden

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Reasoning Analytically About Password-Cracking Software Enze Alex Liu , Amanda Nakanishi,

Reasoning Analytically About Password-Cracking Software Enze Alex Liu , Amanda Nakanishi,

Reasoning Analytically About Password-Cracking Software Enze Alex Liu , Amanda Nakanishi, Maximilian Golla, David Cash, Blase Ur Chic4go 2 Attack Model 80d561388725fa74f2d03cd16e1d687c 3 Attack Model 80d561388725fa74f2d03cd16e1d687c

822 views • 81 slides
Distributed GPU password cracking Alexander Kasabov &amp; Jochem van Kerkwijk System and

Distributed GPU password cracking Alexander Kasabov &amp; Jochem van Kerkwijk System and

Distributed GPU password cracking Alexander Kasabov &amp; Jochem van Kerkwijk System and Network Engineering { akasabov | jkerkwijk } @os3.nl February 2, 2011 Outline Introduction Password cracking Graphics processing unit Distributed

501 views • 16 slides
Measuring password strength by simulating password-cracking algorithms Saranga Komanduri Patrick

Measuring password strength by simulating password-cracking algorithms Saranga Komanduri Patrick

Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms Saranga Komanduri Patrick Gage Kelley, Michelle L. Mazurek, Richard Shay, Tim Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor,

1.88k views • 85 slides
Password Cracking Sam Martin and Mark Tokutomi CS466/566: Computer Security April 22, 2012 Sam

Password Cracking Sam Martin and Mark Tokutomi CS466/566: Computer Security April 22, 2012 Sam

Introduction Lets Attack A Time-Memory Trade-Off The LanManager Hash Physical Attacks Password Cracking Sam Martin and Mark Tokutomi CS466/566: Computer Security April 22, 2012 Sam Martin and Mark Tokutomi Password Cracking

1.49k views • 76 slides
Honeywords Making Password-Cracking Detectable By Ari Juels and Ronald L. Rivest Presented by

Honeywords Making Password-Cracking Detectable By Ari Juels and Ronald L. Rivest Presented by

Honeywords Making Password-Cracking Detectable By Ari Juels and Ronald L. Rivest Presented by Nunzio Cicone and Hans-Peter Hllwirth Setting Password Attacks Passwords are a notoriously weak authentication mechanism One significant

422 views • 20 slides
Password Cracking Prof. Tom Austin San Jos State University How should you store users'

Password Cracking Prof. Tom Austin San Jos State University How should you store users'

CS 166: Information Security Password Cracking Prof. Tom Austin San Jos State University How should you store users' passwords? Reverse-lookup tables A cryptographic hash is irreversible. However, you can make a table of common hashes.

359 views • 11 slides
Potential of Milky Way Potential of Milky Way given analytically given analytically XI B

Potential of Milky Way Potential of Milky Way given analytically given analytically XI B

Potential of Milky Way Potential of Milky Way given analytically given analytically XI B Bulgarian- ulgarian-S Serbian erbian A Astronomical stronomical C Conference onference XI 14-18.05.2018. - Belogradchik, 14-18.05.2018. -

248 views • 23 slides
Running a FireSim Simulation: Password Cracking on a RISC-V SoC with SHA-3 Accelerators and Linux

Running a FireSim Simulation: Password Cracking on a RISC-V SoC with SHA-3 Accelerators and Linux

Running a FireSim Simulation: Password Cracking on a RISC-V SoC with SHA-3 Accelerators and Linux https://fires.im @firesimproject MICRO Tutorial 2019 Albert Ou Agenda Configure and launch a simulation runfarm Boot Linux interactively

770 views • 28 slides
Speeding up GPU-based password cracking SHARCS 2012 Martijn Sprengers 1 , 2 Lejla Batina 2 , 3

Speeding up GPU-based password cracking SHARCS 2012 Martijn Sprengers 1 , 2 Lejla Batina 2 , 3

Speeding up GPU-based password cracking SHARCS 2012 Martijn Sprengers 1 , 2 Lejla Batina 2 , 3 Sprengers.Martijn@kpmg.nl KPMG IT Advisory 1 Radboud University Nijmegen 2 K.U. Leuven 3 March 17-18, 2012 Introduction Background Research Results

389 views • 34 slides
Team Password Manager Password Management Software for Groups http://teampasswordmanager.com

Team Password Manager Password Management Software for Groups http://teampasswordmanager.com

Team Password Manager Password Management Software for Groups http://teampasswordmanager.com What is Team Password Manager - Password manager for groups and projects - Uses projects to group passwords - Secure, fine grained password sharing -

712 views • 9 slides
Cracking Platform Dimitar Pavlov Supervisors : Gerrie Veerman Marc Smeets UvA SNE Master

Cracking Platform Dimitar Pavlov Supervisors : Gerrie Veerman Marc Smeets UvA SNE Master

Distributed Password Cracking Platform Dimitar Pavlov Supervisors : Gerrie Veerman Marc Smeets UvA SNE Master Students Michiel van Veen 08-02-2012 1 The project Research Question : How can a scalable , modular and extensible middleware

357 views • 22 slides
Cracking the code Cracking the code Houston, we have a problem. Consanguineous Marriage Tay

Cracking the code Cracking the code Houston, we have a problem. Consanguineous Marriage Tay

Cracking the code Cracking the code Houston, we have a problem. Consanguineous Marriage Tay Brain T2-Hyperintensity Sachs Stem Pelizaeus- B12 Metabolism U-Fibres Merzbacher Hypomyelination T1-Hypointensity CSF Salla LEUKODYSTROPHY

918 views • 62 slides
IAPF TRUSTEE NETWORK EVENT CRACKING THE DC CODE: VALUE FOR MONEY WELCOME Cracking the DC Code:

IAPF TRUSTEE NETWORK EVENT CRACKING THE DC CODE: VALUE FOR MONEY WELCOME Cracking the DC Code:

IAPF TRUSTEE NETWORK EVENT CRACKING THE DC CODE: VALUE FOR MONEY WELCOME Cracking the DC Code: Value for Money Rickard Mills Council Member, IAPF THANK YOU SPONSOR Cracking the DC Code: Value for Money HOUSEKEEPING Cracking the DC Code:

1.04k views • 54 slides
Network Security Topic 3: User Authentication Topic 3: User Authentication 1 Reading for this

Network Security Topic 3: User Authentication Topic 3: User Authentication 1 Reading for this

5/25/2019 Network Security Topic 3: User Authentication Topic 3: User Authentication 1 Reading for this Lecture 5/25/2019 Password Topic 3: User Authentication Password strength Salt_(cryptography) Password cracking

1.03k views • 75 slides
Effect Transition Moment Integral Can be evaluated analytically Often simplified by

Effect Transition Moment Integral Can be evaluated analytically Often simplified by

Lecture 14: Anharmonic Oscillator and Raman Effect Transition Moment Integral Can be evaluated analytically Often simplified by symmetry Gives rise to selection rules if recursion formulae exist The chemical bond as a simple harmonic

412 views • 23 slides
twenty six diagonal cracking shear f c http://www.bam.de concrete construction:

twenty six diagonal cracking shear f c http://www.bam.de concrete construction:

A RCHITECTURAL S TRUCTURES : Concrete in Compression F ORM, B EHAVIOR, AND D ESIGN ARCH 331 crushing D R. A NNE N ICHOLS vertical cracking S PRING 2018 tension lecture twenty six diagonal cracking shear f c

137 views • 3 slides
7/13/18 D IV ERSIT Y &amp; IN C LU SIO N Jill Ripper D irector , T alent Acquisition H OW

7/13/18 D IV ERSIT Y &amp; IN C LU SIO N Jill Ripper D irector , T alent Acquisition H OW

7/13/18 D IV ERSIT Y &amp; IN C LU SIO N Jill Ripper D irector , T alent Acquisition H OW D O YO U D EFIN E D IVERSITY &amp; IN C LU SIO N ? DEFINITION W hen it com es to defining diversity &amp; inclusion at w ork, the

76 views • 3 slides
Lecture 3 - Passwords and Authentication CMPSC 443 - Spring 2012 Introduction Computer and

Lecture 3 - Passwords and Authentication CMPSC 443 - Spring 2012 Introduction Computer and

Lecture 3 - Passwords and Authentication CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12 CMPSC 443 Introduction to Computer and Network Security - Spring 2012 - Professor

589 views • 19 slides
Iterative Optimization of Rule Sets Jiawei Du 16. November 2010 Prof. Dr. Johannes Frnkranz

Iterative Optimization of Rule Sets Jiawei Du 16. November 2010 Prof. Dr. Johannes Frnkranz

Iterative Optimization of Rule Sets Jiawei Du 16. November 2010 Prof. Dr. Johannes Frnkranz Frederik Janssen Overview REP-Based Algorithms RIPPER Variants Evaluation Summary 2 REP-Based Algorithms REP I-REP / I-REP2 /

328 views • 18 slides
Mining Airfare Data to Minimize Ticket Purchase Price Oren Etzioni ( UW ) Craig Knoblock

Mining Airfare Data to Minimize Ticket Purchase Price Oren Etzioni ( UW ) Craig Knoblock

Mining Airfare Data to Minimize Ticket Purchase Price Oren Etzioni ( UW ) Craig Knoblock ( USC ) Alex Yates ( UW ) Rattapoom Tuchinda ( USC ) Price change over time for American Airlines flight #192:223, LAX-BOS, departing on Jan.

538 views • 29 slides
End result: C4.5 (Quinlan) Best-known and (probably) most widely-used learning algorithm

End result: C4.5 (Quinlan) Best-known and (probably) most widely-used learning algorithm

Extending ID3: To permit numeric attributes: straightforward To deal sensibly with missing values: trickier Stability for noisy data: requires pruning mechanism End result: C4.5 (Quinlan) Best-known and (probably) most

697 views • 46 slides
Advanced Analytics in Business [D0S07a] Big Data Platforms &amp; Technologies [D0S06a] Supervised

Advanced Analytics in Business [D0S07a] Big Data Platforms &amp; Technologies [D0S06a] Supervised

Advanced Analytics in Business [D0S07a] Big Data Platforms &amp; Technologies [D0S06a] Supervised Learning Overview Regression Logistic regression K-NN Decision and regression trees 2 The analytics process 3 Recall Supervised learning

1.49k views • 74 slides
A Deeper Look into Web-based Classification of Music Artists Peter Knees, Markus Schedl, Tim

A Deeper Look into Web-based Classification of Music Artists Peter Knees, Markus Schedl, Tim

A Deeper Look into Web-based Classification of Music Artists Peter Knees, Markus Schedl, Tim Pohle Department of Computational Perception Johannes Kepler University Linz, Austria Overview Artist Classification with Web-based Data

721 views • 18 slides
ss rts s

ss rts s

ss rts s s rs P sr s t rq ss ,

1.1k views • 46 slides

More recommend