Application Security // Database Security
7/24/2013
06:31 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Moving Away From Rash Hashing Decisions

Black Hat talk will discuss shortcomings of the latest technical evolution of hashing passwords for safe storage in databases, propose a competition to design something better

The past few years have been a bonanza for password breaches as poor deployment or nonexistent encryption practices combined with database and Web application vulnerabilities to SQL injection continue to catch up with organizations. Some organizations are storing passwords in the clear. Others encrypt their passwords but hash them in ways that they're easily brute-forced by attackers who stumble into hash repositories via SQLi attacks or other means.

Click here for more of Dark Reading's Black Hat articles.

Take LinkedIn, for instance. Prior to last year'sbreach of more than 6 million passwords at the site, one would expect such a high-profile service to protect user passwords in a pretty reasonable way, says Jean-Philippe Aumasson, principal cryptographer at Kudelski Security in Switzerland and a well-regarded expert in cryptography and cryptanalysis.

"Actually, that was not the fact. They used a very weak password protection method. They used SHA-1," he says, referring to the hash function algorithm that has been advised against due to its crackability for some time now, but which is still in wide use. "They used it in a very simplistic way, and the result of this is out of the 6 million passwords hashes leaked, due to weaknesses of the protection, state-of-the-art cracking techniques could recover the passwords of all the users tied to those hashes."

Sure, there are alternatives out there for salting hashes and making them difficult to crack. Aumasson says that the traditional approach from cryptographers hearing about cases like LinkedIn is to blame the developers for failing to implement the most advanced encryption technology in a competent way. The knee-jerk reaction is to think app developers or database security pros are too stupid to implement them. But the truth is that the encryption methods out there are not elegant and they're not easy to implement without specialized knowledge, he says. DBAs and developers are smart, but their specialty is somewhere else outside of cryptography.

In an upcoming talk at Black Hat next week, Aumasson will propose that it's time to stop the blame game. Together with an industry coalition of 19 other experts in cryptography, he's announcing a new competition in search of a more user-friendly means of password hashing that uses the theoretical principles behind the most advanced means of hashing available today without all of the complicated baggage that makes it hard for normal IT practitioners, like developers and DBAs, to implement.

"If we think about it, why do we end up in these situations where many high-profile services use weak protections?" Aumasson says. "The experts know how to get this right, but for a normal developer it is very difficult to figure out what to use and how to use it in a secure way."

Created in the same vein as competitions run by NIST to come up with the impending SHA-3 algorithm for hash functions, the Password Hashing Competition puts it out to the technical community at large to develop the best possible scheme for thwarting cracking techniques like rainbow tables and the use of graphical processing units to brute-force password hashes. Aumasson says that simple salting of hashes can be defeated, but advanced tools that implement salted hashes with an eye toward requiring a greater computational cost for brute forcers are either ineffective in preventing GPU computational crunching or ungainly to use. For example, he holds scrypt as the most evolved method thus far, which was designed to counter the efficiency of cracking code by imposing the use of large amounts of memory.

"The motivation behind this is the hardware of the attackers -- the graphic cards and programmable hardware -- becomes much less efficient if they have to use that amount of memory. That's design in direct response to the attacker," Aumasson says,"but the design of scrypt is not optimal."

As he explains, scrypt requires things like implementing another layer of hashing function as a subroutine of the system, and that it is difficult to parameterize.

"If I'm not a cryptographer and I'm creating a new Web service, I have no guidance or recommendation on how to use this system," he says, explaining that's why it is so rarely used. This is where the competition comes into play. "We want to solve the problem altogether by creating something that embodies these ideas of something slower and more difficult for the attacker, but that is much easier to implement, much easier to use. We don't want to just fix the existing algorithm. We want to learn from it and to design something much better."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.