Password Cracking Attacks | Privia Security

Passwords exist as plaintext and are defined as sensitive data that must be kept secret in the world of cybersecurity. Passwords are set by the user. When registering on a system or creating an authorised account, passwords are defined according to pre-established procedures and formats. These procedures specify requirements such as the use of upper and lowercase letters, digits, minimum character length, and similar criteria. These security rules, defined in advance on the system, enable a proactive security policy to be followed against password cracking attacks. Encryption, on the other hand, prevents our critical data — the password itself — from being read by converting it into a new format via an algorithm. This means that if a cyber attacker somehow gains access to the system, they are met with hashes rather than the plaintext password.

Example Password: PriviaSecurity

Encrypted in MD5 format: b96a1265a4a1cdea5c5cb2f6708863c2

Password cracking attacks are among the most critical areas in security. Because once your password is identified, cracked, or obtained by any means, all other security measures in place on the system become irrelevant. The attacker then accesses the system using that password and appears as a regular user.

In password cracking attacks, brute force attacks — also known as exhaustive key search attacks — are the most commonly used method for guessing passwords. As a general countermeasure, system administrators can implement account lockout policies (Lockout Policy) after a certain number of failed attempts, and configure SIEM systems to generate alerts on password-guessing activity.

However, at many organisations and institutions, the necessary precautions against these attacks remain insufficient.

Inadequate internal password policies,
Absence of a SIEM solution,
Lack of account lockout policies,
Use of weak passwords,
Reuse of the same password across multiple services…

…are among the mistakes that can lead to serious damage. Ransomware / crypto attacks in particular can succeed at this point, and an attacker who gains entry to a system can escalate their privileges to take over the entire infrastructure. Password cracking attacks are generally divided into two categories.

Active Attacks:

Brute Force Attacks
Password Spraying Attacks

Passive Attacks:

Hash Crack Attacks
Rainbow Table Attacks

Password Cracking Tools

John The Ripper

John the Ripper is a popular password cracking tool used by both network administrators and hackers alike. Originally developed for the Unix operating system, it today supports more than ten platforms in the modern technology landscape.

John The Ripper is command-line based and has no Windows graphical interface. It allows users to select text files containing wordlists in order to attempt to crack passwords. Although John The Ripper operates via the command line, it has been around for a long time and is actively used across the security community and hacker circles alike.

Rather than attempting to crack live passwords on a target system, John The Ripper works with password files. Passwords are typically encrypted and stored in a file on the operating system. Hackers frequently copy this file from the system they have compromised, download it to their own machine, and attempt to crack it using John The Ripper. Each operating system stores this file in a different location:

On Linux, /etc/passwd and /etc/shadow are used.
On Windows 2000 and later, a hidden .sam file is used.

After downloading John The Ripper, it can be run by typing john followed by the file you want to crack at the command line:

john passwd
john --wordfile:/usr/share/wordlists/rockyou.txt --rules passwd

Rainbow Tables

A rainbow table — also known as a rainbow lookup table — is a precomputed table used to reverse cryptographic hash functions. Rainbow tables were invented by Philippe Oechslin. In 1980, Martin Hellman described a time-memory trade-off technique for reducing cryptanalysis time using precomputed data stored in memory. In essence, these types of password crackers work with precomputed hash values for all passwords within a specified character space, such as “az”, “a-zA-Z”, or “a-zA-Z0-9”.

Another approach to cracking passwords is to search for a match. The attacker takes the hash value and begins searching for a match in the table. This technique is called rainbow tables. If a match is found, the original plaintext for that hash is recovered. Popular hacking tools such as Ophcrack rely on these rainbow tables.

Brute Force Attacks

This method involves trying every possible key or character combination. Success is theoretically guaranteed, but the time required to crack the password can be extremely long. For example, cracking a Caesar cipher requires trying only 26 possible keys, which can be done in a very short time. However, when you consider AES encryption with the smallest key size of 128 bits, trying all possible combinations at a rate of one trillion keys per second would take 112,527,237,738,405,576,542 years. In theory, the password will eventually be cracked. In practice, however, time and resources will run out due to the password length, character set, encryption algorithm, and similar security policies.