Perimeter
2/1/2011
12:08 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

ShmooCon Panel Discusses Ease, Speed Of Password Cracking

Panel of security professionals discussed new tools and techniques to accelerate password cracking, highlighting need for multifactor authentication

On Jan., 28, approximately 1,300 information security professionals and hackers converged on Washington, D.C., for the annual ShmooCon conference. The topics ranged from data security models and hacking printers to Android phone security and analyzing malware.

A panel on password cracking, "The Past, Present, and Future of 'Something You Know'," highlighted recent tools being developed, and a DEFCON contest focused on cracking passwords. The panel was made up of four security professionals with experience cracking passwords during security audits and penetration testing. Each panelist spoke shortly about his or her recent experiences with password cracking, followed by a question-and-answer session.

We've all known for a long time that passwords alone are insufficient for high-security environments and protection of sensitive data. The panel's examples of new tools, some accelerated by graphics cards, really drove that point home.

One of the panel members, Martin "purehate" Bos, is a member of Team Hashcat and won the "Crack Me If You Can" contest run by Kore Logic at DEFCON. He stated during the panel that people most often create pattern-based passwords, many of which are driven by the company or website's password policy. If the policy requires mixed case, numbers, and a special character, then the passwords often end up with the first letter being capitalized followed by a date and a special character at the end.

I've mentioned the usefulness of the password lists hosted by Ron Bowes on his SkullSecurity blog before, and Martin referenced them during the panel, saying they are a goldmine providing insight into how people choose passwords. Using the wordlists, Martin has been able to refine the HashCat tools and develop password masks that speed up password cracking by using password combinations that match patterns users tend to use, like the example above.

I have to say, I enjoyed the panel and the panelists' humor, especially Bruce Potter's lively moderation. It introduced me to a few tools I hadn't heard of before. If there were any sysadmins in the audience, I imagine the speed and effectiveness of the tools discussed will likely light a fire under them to move forward with a multifactor solution and eliminate single-factor passwords.

It usually takes a couple months, but eventually the videos from ShmooCon will be posted online. Be on the lookout for them at ShmooCon.org.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio