But first… some key terms…  Hash – Output string from a cryptographic hashing function that is hopefully impossible to go backwards to original input string.  Crack – To recover the original string that hashes to the hash string.  Key space – All possible keys (strings) to test.

Passwords to Other People  Secret phrase that keeps their stuff safe, and allows only that person that knows it admission to something.  The problem is that, just because something has a password doesn’t mean it is necessarily safe.

Exploiting that Mindset…  Passwords can give a false sense of security.  Leading to relaxed password complexity Short passwords Dictionary words  Following the same password patterns around the web. …The perfect place to look…

Are the patterns!  Rockyou Database Length 8 – 20% Length 7 – 17% Length 9 – 15% Lower alpha num – 42% Lower alpha- 25%

Understanding a Mask  ?d – Digits  ?l – lower case alpha  ?u – uppercase  ?s – symbols  ?h – hex 0xc0 – 0xff  ?D-German alphabet  ?F-French alphabet  ?R-Russian alphabet

Password Mask Topologies  The top 5 patterns usually cracks around % of all passwords  The top 100 patterns usually cracks around %  Examples:  ullllldd  ulllllldd  ullldddd Hank Leininger – Password Topology

What even is a password cracker?  A password cracker is used to translate a hashed password back into the original string.  This is done by hashing multiple strings and comparing if the hash matches the one you have on file.  Examples: MD5(noob) -> 9cb4afde731e9eadcda4506ef7c65fa2 MD5(your) -> 62cc0b4ebb0b57b c38 MD5(password) -> 5f4dcc3b5aa765d61d8327deb882cf99 MD5(sucks) -> 9bbf7382baad324c5a97e18387f932d7

What does distributed mean?  A distributed password cracker splits up the key space amongst multiple worker nodes, to further parallelize the workload.

Server Design

How does the cracker hold up?  Class F speed ( greater than 1 Billion a second)  9 ?d – close to instant  9 ?u or ?l – 1.5 hours  9 ?u+?d – 28 hours  8 ?a (96 chars) – 83 days  School network (rm 315)  Some GPUs get over 2 billion now days

Why we need longer passwords Cpu vs. GPU speeds

How do we fix our passwords?  Increase your length! 8 characters is no longer strong enough Aim for 14+ characters. ?a space  Don’t follow the most predictable patterns! Stay away from minimal password changes  Consider using password managers (LastPass, KeePass)