CSCI 530 Lab Passwords

Overview Authentication Passwords Hashing Breaking Passwords Dictionary Hybrid Brute-Force Rainbow Tables Detection

Authentication Authentication is verifying the identity of a particular person Example: Logging into a system. You enter your username and password. It’s an authentication system. Different from Authorization Authorization states what he/she can do on a system Example: Administrators can install programs, while guests cannot.

Authentication How do we authenticate: Something they know Password Something they are Retina Fingerprint DNA Something they own Smart Card Somewhere they are Login only works at certain terminals

How much authentication is needed? We can use either one or a combination of all the above Client systems Normally just a login Military top secret security base Name Badge Passcode Credit card purchases Driver’s license  Name  Picture

How can authentication be broken? For security purposes, we need to know how authentication can be broken so we know how to prevent against it Passwords Can be Guessed Can be Cracked Smartcards Can be copied or stolen Fingerprints Can be copied by using scotch tape

Passwords A secret code for verifying the identity of a person logging into a system They are not stored as plaintext on a system This would be a very bad thing!!! Passwords are stored as hashes based on the type of system Windows: LM Hash, NTLM Unix/Linux: DES, MD5

Hashing Process of processing data through a mathematical formula, and producing a new set of data (called the hash). Process is one-way (you cannot get the original data from the hash. There should be few collisions (two sets of data producing the same hash). Ideally there should be no collisions. Examples: MD5, SHA-1, LM Hash

Windows Hashing Uses an algorithm called Lan Manager Hash (LM Hash) Less than 15 characters long Supported in all versions of Windows up to Windows ME. Supported in Windows 2000, XP, and 2003 for “backwards compatibility”  It can be turned off, but it’s on by default!!!!!!!!!!!!!!!!

LM Hash process If the password is longer than 14 characters, the rest are cut off All lower case characters are converted to upper case Password is split to form two 7-character strings Strings are used as keys for a cryptographic algorithm called Data Encryption Standard (DES) – Programs are able to break DES in less than 24 hours 2002 – DES has been abandoned for Advanced Encryption Standard (AES) Both strings are put back together and form the stored password This process is repeated when the user enters in his password for the first time (for storing), and every time he uses the system

Linux Passwords MD5 passwords Take the entire password string, send it through the MD5 algorithm, and store that as the password in the /etc/shadow file When the user logs in, the password entered is sent through the MD5 algorithm, and if the strings are the same, then the user is authenticated

Password Breaking Dictionary attack List of dictionary words that are tried one after another Very quick If the password is not an exact match to a word on the list, then it will fail Hybrid attack Uses a dictionary list but can detect slight variations to words, or combinations of words. Example: if the word hello is in the database, but the password is Hello, a dictionary attack will not break the password, but a Hybrid attack will Generally finds many more words than a Dictionary attack Not as quick as Dictionary attack

Password Breaking Bruteforce attack Will try every character combination until it finds the password EXTREMELY SLOW Will always find the password These techniques can either be used against a system or a file containing the passwords

Rainbow Tables Philippe Oechslin Uses a reduce function to attempt to map a hash to a password Uses chains to determine the exact password For a good primer on Rainbow Tables, see: Pros Can break any password in a matter of minutes Cons Must have specific Rainbow Table for a particular hashing function Can be defeated using Salts

Detecting someone trying to break into a system Auto-logout If the user enters the wrong password n times, disable their account for a certain period of time Protect your password list on your system Make sure the administrator has access and no one else, so a normal user cannot copy it onto another system

This week’s lab We’re going to use ophcrack, which is an implementation of Rainbow Tables You’re going to set up user accounts on a Windows 2000 system, and are going to practice using Rainbow Tables to break them REMEMBER: Wednesday we are having a guest speaker