1 / 18

Password Cracking

Password Cracking. Lesson 10. Why crack passwords?. Where are the passwords stored?. In the security database in NT. Sometimes referred to as the SAM (security account manager). In Windows-directory system32configSAM

afi
Download Presentation

Password Cracking

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Password Cracking Lesson 10

  2. Why crack passwords?

  3. Where are the passwords stored? • In the security database in NT. Sometimes referred to as the SAM (security account manager). • In \Windows-directory\system32\config\SAM • File is usually world readable, however it is not accessible when the system is running because it is locked by the system kernel. • Copy of it may usually be found in Windows-directory\repair\SAM._ • (rdisk run with /s argument) • then expand it • expand sam._ sam For UNIX/Linux, passwords stored in /etc/passwd or /etc/shadow. Passwords should always be stored in encrypted format, why? What are the steps then in validating a correct password?

  4. NT Password cracking • SAM file has two separately hashed versions of the password -- the LanMan version and the NT version. • LanMan is the weak method and can easily be cracked. It separates the password into two 7 character parts. Thus you really only have to crack two separate 7 character passwords instead of a 14 character password. • It also converts lower case characters to upper case. • Because of poor hashing technique, for NT, a 10 character password is actually potentially less secure than a 7 character • the second half (last 3 characters) will quickly be cracked and then may provide clue for first part, ex: *******890

  5. So what’s the problem with splitting it in two? • Let’s assume lower case characters and numbers only (thus 36 possibilities). If the password can be only 7 characters then • (36 Characters) 7 characters in length = 7.8X1010 choices • If we instead had 14 character passwords • (36 Characters) 14 characters in length = 6.1X1021 choices • Or, if split in two 2* (7.8X1010)=1.56X1011 choices

  6. (cont) • If I can try 1,000,000,000 passwords per day: • With two 7 character passwords it would take 156 days to crack any password • With one 14 character password it would take 6.1X1012 days or 1.67X1010 years to crack any password.

  7. Salts • Another issue with NT passwords is the fact that “salts” are not used. • A salt is a random string that is combined with a password before it is encrypted. • Used because two people who have the same password would normally have them encrypted to the same value. • When the user enters a new password, the system first combines the password with the salt and then computes the hashed value. • The system stores both the hash and the salt with the ID • When a user attempts to authenticate, the system looks up the salt, combines it with the password entered, hashes it, then compares it with the stored value. • Without a salt, the hacker only has to compute the hash once for any given password and then compare it with the stored values.

  8. Programs to crack NT passwords • L0phtcrack • NTSweep • NTCrack

  9. UNIX password cracking • Generally harder than NT to crack. • 3-step process used by cracking programs • create file of possible passwords (dictionary file) • Encrypt file of possible passwords • Compare results with encrypted form of passwords • Obvious why it is harder to guess if you don’t use simple words. Dictionary created must include combinations of words with various connectors • There are different dictionaries for different environments/countries.

  10. UNIX Password Encryption • UNIX uses an encryption algorithm called crypt to encrypt passwords. • Crypt is a hash algorithm that performs a one-way transformation. • There is thus no way to decrypt a password that has been encrypted with crypt • Each encrypted password is 11 characters and is combined with a 2-character salt.

  11. UNIX Password Crackers • CRACK • John the Ripper • XIT • Slurpie

  12. Comparison of NT crackers

  13. Comparison of UNIX crackers

  14. Passwords Cracked

  15. Success based on… • Password cracker’s ability • Dictionary chosen • Rules selected

  16. Where can I go to get a cracker?

  17. Protecting against Cracking • Have a good password policy • Change them on regular basis (how regular?) • Lock account after 3 failed attempts • Password should contain 1 alpha, 1 number, and one special character. • Don’t allow users to reuse previous (5?) passwords. • Password should not be word found in a dictionary. -Consider using pass-phrase. • Consider use of one-time passwords (most common form is smart-card).

  18. Password Cracking Lab • Two password files, one for NT, one for Unix. • Linux shadow file • NT Sam file • Needed to locate, choose, and download password crackers • Needed to install programs and let them run • You will probably did not get all of the passwords cracked.

More Related