Password Authentication Methods

Attacks on Passwords

• The conventional login method involves entering a username and its paired password.
• The system checks the entered information against the stored password in the server's database.
• The system accepts the user request if a match occurs; otherwise, the system rejects it.

Plain Password Authentication

• Older systems stored passwords as plain text, easily accessible to attackers who gained system access.

Hashed Password Authentication

• Hashed passwords are kept within the database.
• The system hashes a user's password before comparing it to the stored hashed password when logging in.
• Access is granted if there is a match; otherwise, the request is denied.
• A one-way hash algorithm is used to create a message digest (hash) of the plaintext password to prevent data access.
• When a user logs in, a digest is created from the entered password, compared against the stored digest, and the user is authenticated if both digests match.

Salted Hashed Password Authentication

• Salted hashes involve adding a dynamic random text (salt) towards the beginning of a user's password when authenticating.
• Salted hashes are used for passwords.
• The database stores both the plain salt and the hashed password salt combination.
• When a user logs in, the system combines their entered password with the stored plain salt before hashing it.
• The result is compared to the stored digest value, and if it matches, the user is authenticated.

Password Spraying

• The attack selects a few common passwords like "Password1" or "123456".
• The selected password is used when logging into several user accounts.
• Because this targeted guess is spread across many accounts, it is much less likely to raise alarms or lock out the user account from failed password attempts.

Brute Force Attack

• The user's password is discovered by attempting every possible combination of letters, numbers, and characters via a non-random approach.

Online Brute Force Attack

• It is unlike a password spraying attack where one password is used on multiple accounts.
• This attack involves continuously attacking the same account (called pounded) by entering different passwords.
• The method is impractical because it could take thousands of years to guess a password.
• Most accounts disable logins after a limited number of incorrect attempts, often five, ending the threat.

Offline Brute Force Attack

• The attack begins with a stolen digest file loaded onto a computer and a password cracking software.
• Candidate digests of every possible combinations of letters, numbers, and characters are created.
• The generated candidates are matched against those in the stolen digest file to find a match.
• It is the slowest yet most thorough method.

Rule Attack

• This attack uses rules to generate password variations from a username or pre-configured words in the input.
• Rule attacks conduct statistical analysis on stolen passwords to formulate a mask representing the candidate password format.
• The mask can be used by the program (u uppercase, I lowercase, d digit) to crack a password in less time.
• Three basic steps of a rule attack:
  • A small sample of the stolen password plaintext file is obtained.
  • Statistical analysis is performed on the sample to determine the length and character sets of the passwords.
  • A series of masks is generated that will be most successful in cracking the highest percentage of passwords.

Dictionary Attack

• The attack starts with the attacker creating digests of common dictionary words as candidates.
• The digests are compared to those in a stolen digest file.
• The method works because users often create passwords from simple dictionary words.
• A dictionary attack with a set of dictionary words compared to stolen digests is a preimage attack.
• A pre-image attack involves a known digest (dictionary word) compared to an unknown digest (stolen digest).

Rainbow Tables

• Rainbow tables facilitate attacks with pregenerated candidate digest datasets.
• A rainbow table is a compressed password representation ordered within a sequence, a chain.
• Creating the table can take a while but provides advantages,
• Rainbow tables can be used for repeated attacks, faster than dictionary methods, and requires less memory on the attacking machine.

Password Collections

• Stolen collections are the foundation of password cracking today.
• Almost all cracking software tools accept stolen "wordlists”.
• Websites host lists of leaked passwords and stats/masks for rule attacks.
• Websites attempt to crack submitted password collections, with one having over 1.45 trillion cracked hashes.