Perimeter
2/1/2011
12:08 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

ShmooCon Panel Discusses Ease, Speed Of Password Cracking

Panel of security professionals discussed new tools and techniques to accelerate password cracking, highlighting need for multifactor authentication

On Jan., 28, approximately 1,300 information security professionals and hackers converged on Washington, D.C., for the annual ShmooCon conference. The topics ranged from data security models and hacking printers to Android phone security and analyzing malware.

A panel on password cracking, "The Past, Present, and Future of 'Something You Know'," highlighted recent tools being developed, and a DEFCON contest focused on cracking passwords. The panel was made up of four security professionals with experience cracking passwords during security audits and penetration testing. Each panelist spoke shortly about his or her recent experiences with password cracking, followed by a question-and-answer session.

We've all known for a long time that passwords alone are insufficient for high-security environments and protection of sensitive data. The panel's examples of new tools, some accelerated by graphics cards, really drove that point home.

One of the panel members, Martin "purehate" Bos, is a member of Team Hashcat and won the "Crack Me If You Can" contest run by Kore Logic at DEFCON. He stated during the panel that people most often create pattern-based passwords, many of which are driven by the company or website's password policy. If the policy requires mixed case, numbers, and a special character, then the passwords often end up with the first letter being capitalized followed by a date and a special character at the end.

I've mentioned the usefulness of the password lists hosted by Ron Bowes on his SkullSecurity blog before, and Martin referenced them during the panel, saying they are a goldmine providing insight into how people choose passwords. Using the wordlists, Martin has been able to refine the HashCat tools and develop password masks that speed up password cracking by using password combinations that match patterns users tend to use, like the example above.

I have to say, I enjoyed the panel and the panelists' humor, especially Bruce Potter's lively moderation. It introduced me to a few tools I hadn't heard of before. If there were any sysadmins in the audience, I imagine the speed and effectiveness of the tools discussed will likely light a fire under them to move forward with a multifactor solution and eliminate single-factor passwords.

It usually takes a couple months, but eventually the videos from ShmooCon will be posted online. Be on the lookout for them at ShmooCon.org.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0702
Published: 2015-04-20
Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.

CVE-2015-0703
Published: 2015-04-20
Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.

CVE-2015-1235
Published: 2015-04-19
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVE-2015-1236
Published: 2015-04-19
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a cr...

CVE-2015-1237
Published: 2015-04-19
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages ...

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.