Password Cracking COEN 252 Computer Forensics

Social Engineering Perps trick Law enforcement, private investigators can ask. Look for clues: Passwords frequently use SSN, names of boyfriend, girlfriend, dog, sled, …

Dictionary Attacks Passwords need to be memorizable. Most Passwords based on actual words. Dictionary attacks uses a dictionary: Try all words in dictionary. Try all words in dictionary with slight changes. Typically very fast.

Brute Force Just try out all combinations possibilities for a UNIX password. But only if all letters are equally likely. Not feasible on a single machine. But possibly in a P2P system. Using technology.

Keystroke logging / sniffing Surveillance of suspect can yield passwords. Keystroke loggers can be set up to automatically reveal typed in passwords. Same for network sniffers.

Default Passwords Many applications come with a default password. VMS used to have a default super-user password. Often, the default password is the same as the default user name. In principle, the sys-ad changes the default password. Recently, applications are no longer shipped with default passwords.

Bios Password Stored in CMOS Remove power from CMOS and CMOS is reset. Looses valuable forensic data such as the system clock. Some BIOS can be programmatically cleaned. Looses valuable forensic data such as the system clock.

Windows 9x Windows 9x stores the login password in.pwl file in the c:\windows directory in encrypted form. Obtain the password from the file. Use an offline password cracker that attacks the weak encryption.

Windows 9x Windows screen saver password is stored in user.dat file in c:\windows. Password is in simple ASCII encryption. The screen saver password is very often the system password.

Windows NT and up Unix Only hash of password is stored. Computationally impossible to calculate password from the hash. Can use the hash for a dictionary or brute force attack.

Windows NT and Up Some applications need administrator’s password Passwords are stored in a protected area of the registry Local Security Authority Can be dumped

Various Applications Some applications store the password in clear text in a hidden location. Registry in Windows. Some file attached to the application. Or using easily breakable encryption of password in known place.

Multiple Passwords Since few users can remember many passwords, any password for a given application might also unlock other passwords.