Scribd Logo
Upload

Welcome to Scribd!

  • 85 views

    2023 10 10 Passwords Personal Protection Karampelas

    Uploaded by

    jcsaldanha
    This document discusses password security and cracking. It begins by discussing the importance of using strong, unique passwords and not reusing passwords across accounts. It then explains how passwords are stored securely as hashed values rather than plaintext. It also discusses how data breaches make passwords vulnerable if they are weak or reused. The document examines common password cracking methods like brute force attacks, dictionary attacks, and rainbow tables. It provides examples of analyzing large sets of cracked passwords to understand weaknesses. Finally, it emphasizes the importance of long, random, unique passwords and outlines best practices for strong password creation.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    2023 10 10 Passwords Personal Protection Karampelas

    Uploaded by

    jcsaldanha
    85 views38 pages
    This document discusses password security and cracking. It begins by discussing the importance of using strong, unique passwords and not reusing passwords across accounts. It then explains how passwords are stored securely as hashed values rather than plaintext. It also discusses how data breaches make passwords vulnerable if they are weak or reused. The document examines common password cracking methods like brute force attacks, dictionary attacks, and rainbow tables. It provides examples of analyzing large sets of cracked passwords to understand weaknesses. Finally, it emphasizes the importance of long, random, unique passwords and outlines best practices for strong password creation.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses password security and cracking. It begins by discussing the importance of using strong, unique passwords and not reusing passwords across accounts. It then explains how passwords are stored securely as hashed values rather than plaintext. It also discusses how data breaches make passwords vulnerable if they are weak or reused. The document examines common password cracking methods like brute force attacks, dictionary attacks, and rainbow tables. It provides examples of analyzing large sets of cracked passwords to understand weaknesses. Finally, it emphasizes the importance of long, random, unique passwords and outlines best practices for strong password creation.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    85 views38 pages

    2023 10 10 Passwords Personal Protection Karampelas

    Uploaded by

    jcsaldanha
    This document discusses password security and cracking. It begins by discussing the importance of using strong, unique passwords and not reusing passwords across accounts. It then explains how passwords are stored securely as hashed values rather than plaintext. It also discusses how data breaches make passwords vulnerable if they are weak or reused. The document examines common password cracking methods like brute force attacks, dictionary attacks, and rainbow tables. It provides examples of analyzing large sets of cracked passwords to understand weaknesses. Finally, it emphasizes the importance of long, random, unique passwords and outlines best practices for strong password creation.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 38

    International Air Force Semester

    2020-1-EL01-KA203-079068

    Cyber Warfare
    Defensive Cyberspace Operations
    Panagiotis Karampelas
    Hellenic Air Force Academy

    02 November 2022
    Contents
    01 Personal Defence
    01 Personal Defence
    Let’s talk about passwords

    How many
    passwords do
    you have?
    Let’s talk about passwords

    How do you
    remember all
    your
    passwords?
    Let’s talk about passwords

    Do any of the following apply to you?


    • I use the same password for multiple
    websites, or software.
    • I save my passwords in my browser.
    • I have some passwords that are very
    short (eight or less characters).
    • Someone else in my life knows all of
    my passwords.
    What happens when we create a
    password?

    • Usually, the password is stored as a hash value


    • A hash is a value that gets calculated from math
    formulas and sets of rules (i.e., an algorithm)
    • There are many different hashing algorithms

    HAFA_lms*123
    MD2
    Hash
    Function
    be4daea02481783dfa672580c0ac0627
    HAFA_lms*124 17e35d0ad3f405223bea4fbb9c31b97d
    What happens when we create a
    password?
    • There are many different hashing algorithms
    ▪ md2, md4, md5
    ▪ sha1, sha224, sha256, sha384, sha512
    ▪ ripemd128, ripemd160, ripemd256, ripemd320
    ▪…
    • Hashes cannot be decrypted

    HAFA_lms*123
    MD5
    Hash
    Function
    c49ecabfa583f84c2c9b43dc490d000a
    HAFA_lms*124 b855c8420964af368e811731f0bf030c
    How do we login into a system
    then?
    • We enter the same password as before
    • It goes through the same hashing algorithm as
    before
    • It simply compares the new hash value with what
    was stored when you created your account

    HAFA_lms*123
    MD5
    Hash
    Function
    c49ecabfa583f84c2c9b43dc490d000a
    HAFA_lms*124 b855c8420964af368e811731f0bf030c
    If that is the case then how?

    Lecture 05
    How was my password cracked?

    • The password was • The password was


    leaked in a data entered in a
    breach malicious website
    • The database of a • The hacker installed
    service/vendor was a keylogger in my PC
    acquired by a hacker • The hacker retrieved
    • The hacker managed the password file
    to guess the from my PC and
    password cracked it
    Data Breaches
    Lecture 05
    • 32 million emails and passwords
    • 10% could be used as they were in PayPal
    Major data breach in 2009
    *numbers in millions
    Xylogiannopoulos, Konstantinos F., Panagiotis Karampelas, and Reda Alhajj. "A password creation and validation system for
    social media platforms based on big data analytics." Journal of Ambient Intelligence and Humanized Computing (2019): 1-21.
    World's Biggest Data Breaches & Hacks, https://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
    COMB

    • On Tuesday, February 2, 2022, COMB was leaked on


    a popular hacking forum
    • It is a database called COMB or Compilation of
    Many Breaches and contains more than 3.2 billion
    unique pairs of cleartext emails and passwords
    • The user credentials come from past leaks from
    Netflix, LinkedIn, Exploit.in, Bitcoin and more
    • It is the biggest breach of all time (data for almost
    70% of the Internet users worldwide)
    Defensive Cyberspace Operations
    https://cybernews.com/news/largest-compilation-of-emails-and-passwords-leaked-free/
    Has my password leaked?

    Lecture 05
    Tools to use to find if my password
    has been compromised
    • I can check whether my password has leaked
    • I can see in which list my password is
    ▪ https://haveibeenpwned.com

    • I can check whether my email has been included in


    any of the data breaches
    • I can also see the available password
    ▪ https://www.proxynova.com/tools/comb/

    Defensive Cyberspace Operations


    How was my password
    cracked?
    Lecture 05
    People are predictable
    • Family names, pet
    names, etc.
    • Same or derived from
    username
    • Application name
    • Keyboard sequences
    • English common words
    • Common non-English
    words
    • Words with capitalization
    (PaSsWorD) and
    substitutions (0 for O)
    Lecture 05
    We analyzed
    5,604,506
    leaked
    passwords
    found in a
    hackers
    website

    Xylogiannopoulos, Konstantinos F., Panagiotis Karampelas, and Reda Alhajj. "A password creation and validation system for
    social media platforms based on big data analytics." Journal of Ambient Intelligence and Humanized Computing (2019): 1-21.
    Password length
    Percentage of passwords per length

    Xylogiannopoulos, Konstantinos F., Panagiotis Karampelas, and Reda Alhajj. "A password creation and validation system for
    social media platforms based on big data analytics." Journal of Ambient Intelligence and Humanized Computing (2019): 1-21.
    Most frequent password
    Most frequent patterns in passwords with length 10

    Xylogiannopoulos, Konstantinos F., Panagiotis Karampelas, and Reda Alhajj. "A password creation and validation system for
    social media platforms based on big data analytics." Journal of Ambient Intelligence and Humanized Computing (2019): 1-21.
    Most frequent password
    Most frequent number patterns in passwords with length 5

    Xylogiannopoulos, Konstantinos F., Panagiotis Karampelas, and Reda Alhajj. "A password creation and validation system for
    social media platforms based on big data analytics." Journal of Ambient Intelligence and Humanized Computing (2019): 1-21.
    Most frequent password
    Most frequent keyboard patterns and numbers in passwords

    Xylogiannopoulos, Konstantinos F., Panagiotis Karampelas, and Reda Alhajj. "A password creation and validation system for
    social media platforms based on big data analytics." Journal of Ambient Intelligence and Humanized Computing (2019): 1-21.
    How these passwords were
    cracked?
    • Brute Force attack
    ▪ Try all combinations, e.g. aaa, aab, aac, …
    ▪ Often aided with a Rainbow Table -> pre-computed hash
    values for all possible combinations of an “alphabet”

    Defensive Cyberspace Operations


    How these passwords were
    cracked?
    • Dictionary attack
    ▪ Note that the “dictionary” could be any list of words,
    including a list of known passwords
    ▪ Words are also tried with common letter-to-number or
    letter-to- symbol substitutions, e.g. cat, {at, (at, <at,
    c@t, …
    ▪ It is common now to also try combinations of dictionary
    words, e.g. catdog, dogcat

    Defensive Cyberspace Operations


    How these passwords were
    cracked?
    • Mask (Pattern, Rule) attack
    ▪ Takes advantage of human naming conventions
    ▪ Try all combinations with a few restrictions
    ▪ First letter capital
    ▪ All other letters lowercase
    ▪ Following a series of letters is a series of numbers
    - e.g. Fall2022, Andrew2000

    Defensive Cyberspace Operations


    Rainbow Tables

    • We can speedup cracking by using a hash table


    ▪ Dictionary of passwords with associated hashes
    ▪ Contains passwords from charset within length range
    • Problem: hash tables require huge storage space

    Defensive Cyberspace Operations


    Password Cracking Tools

    • L0phtCrack
    • John the Ripper
    • Ophcrack
    • Burp Suite
    • CeWL
    • Hashcat
    • THC-Hydra

    Defensive Cyberspace Operations


    Let’s crack a password

    Lecture 05
    MD5 hashed password

    • We will create the MD5 hash for the password


    Andrew2000
    ▪ https://www.tools4noobs.com/online_tools/hash/

    • We will then use rainbow tables to crack the


    password
    ▪ https://crackstation.net

    • Repeat the same process with SHA1 or SHA512


    Defensive Cyberspace Operations
    Password creation rules

    • Password should be 10 characters long or longer


    ▪ Makes it difficult to brake
    • It must be unique for each site and system used
    ▪ If one password is exposed, the rest remain safe
    • It should be kept safe and secure
    ▪ Prevents others from seeing or using it

    Defensive Cyberspace Operations


    Cracking a password

    • We need to calculate the possible combination of


    the alphabet
    • For each character in a password:
    ▪ Lowercase letters: 26 possible characters.
    ▪ Adding numbers to the above: 36 possible characters (26
    + 10 [0 through 9]).
    ▪ Adding uppercase letters to the above: 62 possible
    characters (26 + 10 + 26).
    ▪ Adding symbols to the above: 96 possible characters (26
    + 10 + 26 + 34).
    Defensive Cyberspace Operations
    Cracking a password

    • The formula for the total number of possible


    character combinations for a password is 96x,
    where x is the length of the password
    • If the password length is 8 then we have:
    ▪ 968 = 7,213,895,789,838,336

    • How much time is needed to crack the password?


    ▪ Depends on the available infrastructure

    Defensive Cyberspace Operations


    Time needed to brute force a
    password in 2022

    https://www.hivesystems.io/password-table
    Questions?

    Defensive Cyberspace Operations


    Defensive Cyberspace Operations
    02 November 2022

    International Air Force Semester


    2020-1-EL01-KA203-079068

    The European Commission support for the production of this publication does not
    constitute an endorsement of the contents which reflects the views only of the
    authors, and the Commission cannot be held responsible for any use which may be
    made of the information contained therein.

    Defensive Cyberspace Operations

    You might also like