Perimeter
2/1/2011
12:08 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

ShmooCon Panel Discusses Ease, Speed Of Password Cracking

Panel of security professionals discussed new tools and techniques to accelerate password cracking, highlighting need for multifactor authentication

On Jan., 28, approximately 1,300 information security professionals and hackers converged on Washington, D.C., for the annual ShmooCon conference. The topics ranged from data security models and hacking printers to Android phone security and analyzing malware.

A panel on password cracking, "The Past, Present, and Future of 'Something You Know'," highlighted recent tools being developed, and a DEFCON contest focused on cracking passwords. The panel was made up of four security professionals with experience cracking passwords during security audits and penetration testing. Each panelist spoke shortly about his or her recent experiences with password cracking, followed by a question-and-answer session.

We've all known for a long time that passwords alone are insufficient for high-security environments and protection of sensitive data. The panel's examples of new tools, some accelerated by graphics cards, really drove that point home.

One of the panel members, Martin "purehate" Bos, is a member of Team Hashcat and won the "Crack Me If You Can" contest run by Kore Logic at DEFCON. He stated during the panel that people most often create pattern-based passwords, many of which are driven by the company or website's password policy. If the policy requires mixed case, numbers, and a special character, then the passwords often end up with the first letter being capitalized followed by a date and a special character at the end.

I've mentioned the usefulness of the password lists hosted by Ron Bowes on his SkullSecurity blog before, and Martin referenced them during the panel, saying they are a goldmine providing insight into how people choose passwords. Using the wordlists, Martin has been able to refine the HashCat tools and develop password masks that speed up password cracking by using password combinations that match patterns users tend to use, like the example above.

I have to say, I enjoyed the panel and the panelists' humor, especially Bruce Potter's lively moderation. It introduced me to a few tools I hadn't heard of before. If there were any sysadmins in the audience, I imagine the speed and effectiveness of the tools discussed will likely light a fire under them to move forward with a multifactor solution and eliminate single-factor passwords.

It usually takes a couple months, but eventually the videos from ShmooCon will be posted online. Be on the lookout for them at ShmooCon.org.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web