Password Security, Threats and Measures

Summary

This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper".

Password Security

Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or its entropy. Besides the quality and entropy of a password, factors like personal data or known passwords have to be considered.

The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality. The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

Hashing

To minimize security risks, it is not only crucial to choose strong passwords but also to implement effective security measures.

One of the most important ways to securely store passwords is by using cryptographic methods like hashing, which is a core element of modern password security.

Passwords are transformed into a non-reversible, fixed-length string of characters known as hash values using a mathematical algorithm. Cryptographic hash functions must meet certain criteria, such as being one-way (irreversible), collision-resistant, efficient, and deterministic.

While both cryptographic hash functions and PBKDFs (Password-Based Key Derivation Functions) are used to securely process passwords, they operate differently. A cryptographic hash function, such as SHA-256, converts an input into a fixed-length hash value, which is typically computed quickly. In contrast, PBKDFs (e.g., PBKDF2, bcrypt, scrypt) use multiple iterations and additional salt values to deliberately slow down attackers, particularly in brute-force attacks.

Salt and Pepper

Salting: Salting is a technique used to enhance password security by adding a random, unique value (the "salt") to a password before hashing it. This protects against attacks like Rainbow-Table attacks, as identical passwords will generate different hash values due to the unique salt. Salting makes it harder for attackers to quickly crack passwords using precomputed tables.

Peppering: Peppering adds another layer of security by appending a secret, constant value (the "pepper") to the password. Unlike the salt, the pepper is not stored in the database but is kept secret on the server side.

Password Managers

Password managers can store the passwords, guide the creation and provide security when sharing passwords. Password managers can include aid in the cases of long, complex and important passwords as they store the passwords of the user and provide a certain level of security. These managers often consist of several authentication steps in order to achieve this certain level of security. The functionality can differ as there are different types of managers.

Types of password managers:

• Cloud-Based Password Managers
• Local Password Managers
• Browser-Based Managers
• Enterprise Managers
• Hardware Password Managers

Vulnerabilities and Threats

Passwords are mostly created by humans and are therefore a subject to vulnerabilities. Humans seek simplicity and comfort and they try to create easy to remember passwords. They often use personal information in order to provide a memorable word. Most of them use the same passwords on multiple websites and neither do they change them frequently. Close to two thirds of users do not use special characters in their passwords.

These factors create many vulnerabilities as they make the passwords predictable, of low quality or entropy and therefore easier to crack.

Threats

These weakly created passwords are often the victim to different threats. Most of these threats require some sort of fraud or deception.

Some of these threats are:

• Phishing

Is trying to gain login credentials by impersonating a person or faking a website.

• Keylogging

Is recording the keystrokes which a user puts in.

Attacks

These attacks vary and can be successful at compromising the victims password. Different attacks require different computational power, memory and time when cracking passwords.

Some of these attacks are:

• Brute-Force

Systematic testing of every possible combination of characters until the password is found.

• Dictionary Attack

Test passwords from a prepared list of common or frequently used passwords.

• Hybrid Attack

A hybrid attack combines the concepts of dictionary and brute force attacks. It starts with a list of known passwords and expands these with systematic combinations.

• Rainbow-Table Attack

Use of pre-calculated tables containing plaintext passwords and their hashes to quickly crack passwords.

• Social Engineering Attack

Social engineering uses psychological manipulation to trick people into disclosing confidential information or performing unsafe acts.

Security Measures

In order to prevent attackers from gaining unauthorized access, developers have came up with different security measures. These measures can provide further steps of authentication and achieve more security.

These are some security measures which can help to withstand most of the named threats:

• Two-Factor Authentication

This measure requires and additional step of authentication on system access.

• Security Questions

Security questions also require an additional step of authentication by requiring the answer to personal questions.

• Account Policies

Account policies force the user to frequently change the password or to lock the account if the password is entered wrong multiple times.

• Activity Monitoring

The monitoring of suspicious activity like a login attempt of a new devices can alert the user to pay attention to a certain account and maybe change the login credentials.

Password Cracking Tools

These are only some of the cracking tools which can be used to attack a victims account:

• John The Ripper

A widely used open-source password cracking tool that supports various hashing algorithms and can crack passwords using dictionary, brute force and hybrid attacks. John the Ripper (JtR) offers various modes: The Single Crack Mode uses personal information such as user names to guess passwords efficiently. The Wordlist Mode uses prefabricated word lists to test known terms or patterns. Incremental mode relies on brute force attacks in which all possible character combinations are systematically tried out. In external mode, users can develop their own methods for cracking passwords.

This tool will be used later in this documentation to present a password cracking process.

• Hashcat

Hashcat is a powerful open-source password cracking tool that runs on Linux, Windows and macOS and supports a variety of hashing algorithms and attack methods including brute force, dictionary, hybrid and mask attacks. Hashcat combines CPU and GPU-based calculations in a single application. A highlight is the ability to create customised rules to flexibly adapt attacks to known vulnerabilities or patterns.

• RainbowCrack

RainbowCrack is a password cracking tool that uses the Rainbow Table technique to crack passwords efficiently, based on the time-memory trade-off concept. It supports common hash algorithms such as LM, NTLM, MD5, SHA1 and SHA256 and uses the reduction function to save memory space.

• OPH Crack

Implements the rainbow table attack.

• Medusa

Medusa is a parallel brute force tool that can attack multiple network protocols (such as SSH, FTP, HTTP) to crack passwords. Thanks to its modular structure, protocols can be flexibly adapted, and parallel processing enables up to 2000 password attempts per minute.

Requirements

• Operating system/Platform: Kali Linux
• Packages: git openwall/john

Cracking a password

The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".

• NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.

Step 1

Create a .zip password secured archive.

sudo apt-get install zip

sudo nano document.txt

zip -e archive.zip document.txt

You will be prompted to enter a password.

Step 2

Now the hash of the password needs to be achieved.

zip2john archive.zip > hash.txt

This command saves the hash of the password which is used to secure the archive.zip archive in a hash.txt file.

Step 3

Now the hash can be cracked. The crack is only successful if the password is in the password list that john uses to compare the hashes.

john hash.txt

The passwordlist in this case is the default password list of john. However, different password lists can be used by specifying the file they are saved as.

john --wordlist=/tmp/password-list.txt hash.txt

This way john will try to crack the password with the password-list.txt password list file.

• In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.

References

• https://www.overleaf.com/project/64fc39ddb97b168fb7bd033d
• https://www.openwall.com/john/
• https://www.kali.org/tools/john/
• https://www.kali.org/
• https://ieeexplore.ieee.org/document/6234434
• https://ieeexplore.ieee.org/document/8936178
• https://doi.org/10.1145/359168.359172
• https://ieeexplore.ieee.org/document/9023888
• https://ieeexplore.ieee.org/document/9609778
• https://ieeexplore.ieee.org/document/8400211
• https://ieeexplore.ieee.org/document/10127057
• https://hashcat.net/hashcat/
• https://ieeexplore.ieee.org/document/8500257
• https://ieeexplore.ieee.org/document/9821858?signout=success