Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/20/2012
07:47 PM
50%
50%

Bashing The Hash: IBM X-Force On Password Follies

IBM X-Force Mid-Year Report highlights dangers of authentication and IAM mistakes

As the computing capacity and resources available to encryption-cracking hackers continues to increase, simple password security practices have all but lost their efficacy and are symptomatic of bigger picture identity and access management (IAM) problems. Citing research done on data in-house at IBM and industry statistics, researchers with IBM highlighted the deteriorating state of password security in the IBM X-Force 2012 Mid-year Trend and Risk Report it released today.

"It used to be that the cost to crack passwords with letter, number and punctuation combinations of more than eight characters, with the computing power that was available to the bad guys, was high enough to deter them," says Clinton McFadden, senior operations manager for IBM X-Force research and development.

[How are your web apps bringing databases under fire? See 10 Ways Developers Put Databases At Risk.]

Not so anymore. According to McFadden, IBM tracked market reports and customer stories that show an increasing number of large password stores targeted by thieves, even when the passwords are hashed with encryption mechanisms.

"The problem is getting worse," he says. "And as criminal products, uncracked passwords are worth more now because they're cheaper to crack."

The computational resources at just about any savvy hacker's disposal these days make it imperative to avoid slipshod password storage and encryption, IBM warned in its report. For example, creative use of Graphical Processing Unit (GPU) chips that are designed for first-person shooter games, but more fundamentally for "crunching huge batches of numbers repeatedly in quick succession," has seriously eased the burden of cracking large stores of passwords.

"Password guessing has even gone 'in the cloud,'" the report said. "By using a cloud service provider, it is quite inexpensive to rent an array of GPUs to crunch a task for a few hundred dollars an hour. These types of computations scale very well in parallel."

And other hardware-based products like Field Programmable Gate Arrays (FPGAs) are making it possible to guess over 1.7 million passwords per second, the report observed.

IBM examined the weaknesses of hashing alone, noting the speed with which researchers were able to crack the 6.5 million SHA-1 hashed passwords dumped online this summer from LinkedIn, recovering 90 percent of these in just a few weeks. These hashed passwords were not salted and with no random-added values thrown into the password string before encryption -- the speed with which the password's hashed values could be cracked was increased dramatically as a result.

Crypto experts have for a while now lamented the false sense of security hashing passwords without salts has engendered. Even when organizations do decide to take steps necessary to protect passwords in application environments, they often bungle it in execution, choosing to forgo hash salts.

"Adding a salt to a hash effectively lengthens the password, making it harder to brute-force the hash in order to derive the password; this also applies to brute-forcing multiple hashes at once, as each hash may use a different salt," says Daniel Jacobowitz, senior research engineer for BeyondTrust.

But even when organizations do salt their hashes, they can still go wrong by choosing to store passwords in the same table within a database.

"For additional security, consider storing the salt in a separate table or even a separate database only accessible by the authentication service," suggests Kenneth Pickering, development manager for security intelligence at Core Security.

Beyond the important minutiae that need be considered when it comes to properly storing and encrypting passwords, it is also critical for enterprises to look up from the microscope as well. Many of these issues are symptomatic of larger-scale IAM problems. Poorly executed password encryption could be a red flag of poorly centralized IAM controls. And the lack of multi-factor authentication and the enforcement of frequent credential refreshes to mitigate the risk when passwords are compromised likely betrays a lack of overarching IAM strategies in place.

"We constantly want to have this conversation with customers and with the industry because it's still not fixed," McFadden says, "and as we expose more data to the Web, we're not seeing a healthy adoption of some of these better security practices."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-35419
PUBLISHED: 2021-04-14
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
CVE-2021-28060
PUBLISHED: 2021-04-14
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
CVE-2021-28825
PUBLISHED: 2021-04-14
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with l...
CVE-2021-28826
PUBLISHED: 2021-04-14
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker wi...
CVE-2021-28855
PUBLISHED: 2021-04-14
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).