Cyberstudy
PDF p.354 In progress

Password Attacks

Open PDF at p.354 16 flashcards

Summary

PDF p.354

Password attacks exploit weaknesses in password selection and management to recover plaintext passwords and compromise accounts. These attacks can be online, where the attacker interacts directly with the authentication service, or offline, where the attacker works with a database of password hashes.

Detailed explanation

PDF p.354
  • Online Attacks
    • Definition: Attacker interacts directly with the authentication service (e.g., web login, VPN gateway).
    • Indicators: Repeated failed logins followed by a successful login, or logins at unusual times/locations.
    • Mitigation: Use strong passwords, restrict login attempts, block known bad IP addresses.
    • Vulnerability: Can lead to denial of service attacks by locking out valid users.
  • Offline Attacks
    • Definition: Attacker obtains a database of password hashes (e.g., SAM, NTDS.DIT, /etc/shadow).
    • Indicators: File system audit logs showing access to password files, presence of attack tools.
    • Methods: Packet sniffers to capture client responses, exploiting protocol weaknesses.
  • Brute Force Attacks
    • Definition: Attempts every possible combination to match a captured hash.
    • Output Space: Determined by the algorithm's bit size (e.g., 128-bit MD5, 256-bit SHA256).
    • Constraints: Time and computing resources, effective for short passwords.
    • Distributed Attacks: Use multiple hardware components to crack longer passwords.
  • Dictionary and Hybrid Attacks
    • Dictionary Attack: Uses a dictionary of likely plaintexts to generate hash values and match them.
    • Hybrid Attack: Combines dictionary and brute force attacks, targeting naive passwords with limited variations.
  • Password Spraying
    • Definition: Horizontal brute force attack using common passwords with multiple usernames.
    • Examples: Using passwords like "password" or "123456" across many accounts.

Important terms

taken from the text above
Online Attacks
Attacker interacts directly with the authentication service (e.g., web login, VPN gateway).
Offline Attacks
Attacker obtains a database of password hashes (e.g., SAM, NTDS.DIT, /etc/shadow).
Brute Force Attacks
Attempts every possible combination to match a captured hash.
Output Space
Determined by the algorithm's bit size (e.g., 128-bit MD5, 256-bit SHA256).
Constraints
Time and computing resources, effective for short passwords.
Distributed Attacks
Use multiple hardware components to crack longer passwords.
Dictionary Attack
Uses a dictionary of likely plaintexts to generate hash values and match them.
Hybrid Attack
Combines dictionary and brute force attacks, targeting naive passwords with limited variations.
Password Spraying
Horizontal brute force attack using common passwords with multiple usernames.

What I should remember

Key Points PDF p.354
  • Online Attacks
    • Direct Interaction: With authentication service.
    • Indicators: Failed logins, unusual login times.
    • Mitigation: Strong passwords, restrict attempts.
  • Offline Attacks
    • Database Access: Password hashes.
    • Indicators: Access logs, attack tools.
    • Methods: Packet sniffers, protocol weaknesses.
  • Brute Force Attacks
    • Combination Attempts: Match captured hash.
    • Constraints: Time, resources.
    • Distributed: Multiple hardware components.
  • Dictionary and Hybrid Attacks
    • Dictionary: Likely plaintexts.
    • Hybrid: Dictionary + brute force.
  • Password Spraying
    • Common Passwords: Across multiple usernames.