[WEIRD COMPUTER SOUNDS]
[MUSIC PLAYING]
Welcome to the Hacker House hands-on hacking
passwords theory module.
This is the 12th and final module in our course,
where we're going to look at how passwords are stored,
and how information that you might elicit from a network
can be leveraged in a kind of password analysis
tax on others.
So we're going to cover some theoretical background
on passwords now.
And it's important to understand what is a password?
What is the anatomy of a password?
Well, it is a word that is appointed to distinguish
your friend from your foe--
1798.
And effectively passwords are my best friends.
They're certainly every hacker's best friend,
because they can be stolen, they can be copied,
and they can be reused.
And they're a little bit like keys.
They'll let you into systems.
So without the passwords, often it's quite annoying
to get into them.
So passwords, you kind of need to make a collection of them.
And they're still, of course, selected by people most often.
People generally choose their passwords.
And that's often the weakest link in security.
You'll find people will choose favorite football
teams, favorite food, daughter's name, things like that.
Hashing and symmetric encryption are the ways in which
we might store passwords.
So plain text passwords, or what you see is what you get,
is when you have a function that's
like "password," and your password is "password."
It is the password.
It's what you see is what you get.
So we have what's known as a hash function,
or a hashing function.
There's a one-way hashing function.
That is, you can put something through it.
And you'll get a hash or a value that represents that number.
But if you can't take that number
and turn it back into the clear text,
the what you see is what you get, so it's just a hash.
So you're only able to see what that number is.
You can't do that in reverse.
It's a one-way function.
And secure hash functions are meant to generate unique values
for every provided input.
So if I give it the word "password" once,
the second time I should get unique values
for the unique provided input when it's being used securely
with a per-input salt.
If you give two password password,
password, password, you'll get the same hash,
unless you use a salt, which will cause the hash
to be different.
So the idea is a secure hash function
should generate unique values for each provided input.
Password one shouldn't equal the same hash as password two.
So symmetric encryption, however, uses an encryption key
to apply a reversible function to generate the ciphertext,
or encrypted form.
So it uses an encryption key.
So for instance, things like DES--
Data Encryption Standard-- which will use an encryption key.
But once you have that encryption key,
you can then reverse back the ciphertext and get the plain.
So common hash types that are in use, we see things like bcrypt,
used by Ruby on Rails, OpenBSD, scripts
for various cryptocurrencies, SHA-1, SHA-2, MD5.
I mean, you can see here we've got some collisions
that I mentioned-- very popular collisions found.
And these collisions, when a collision is found,
it's considered that a hashing algorithm is perhaps broken,
and it no longer fits the purpose.
So we have seen collisions in MD5.
We've seen them in SHA-1, and we're still
waiting for SHA-2 collisions.
And we've seen, again, things that are not even hashes,
like CRC32, or CRC16, a checksum,
which shouldn't be being used as a hash,
but sometimes might be for some reason.
And also there's a concept known as key-stretching,
which is designed to create a derived key to increase
the cost of complexity to an attacker
when trying to crack passwords.
So we've got a hashing example.
As an example here, we've got the plain text
of HackerHouse2017.
If you were to feed that through MD5, you'd
get this hash-- this hash of a SHA-1, this hash is 256,
this is if it's 512.
And you see the hashes get incrementally bigger.
And this is useful, because you can actually usually
sometimes tell what a hash is based on how long it is.
By spotting these kind of lengths,
you might be able to see, let's say it's 40 characters.
Therefore, maybe it's MD5, because it uses 40 characters.
And that's how we were able to tell in our web module
that that was MD5, because we looked
at the length of that hash.
So saying pass salted hash, this is when you supply the hash.
But this time we give it a salt. And if you see here,
the values have now changed, instead
of giving HackerHouse2017.
So if we gave HackerHouse2017 again,
we would get the same hashes.
So an attacker would simply generate all of the hashes
for lists of passwords, and then compare those hashes
with yours, to find out which one matched.
And if we add a salt, they have to do that
every time for every user, which increases
that cost of complexity.
Makes it more difficult for them to do.
So cryptanalysis and brute force attacks.
Cryptanalysis, the goal of finding stop conditions,
or various others, is what Turing and his researchers
were famous for-- the Enigma-cracking process.
And it's the concept of doing cryptanalysis.
It's generating or brute forcing or cracking encryption schemes.
So cracking the process of generating hashes,
cracking is that comparison we've just discussed--
comparing- two hashes.
You know the plain text of one hash.
You have a hash.
You don't know what its plain text is.
You hash lots of words, and compare those hashes
until you find the right one.
Password hash cracking.
So you can generate hashes.
And also you could maybe use weaknesses
in the encryption ciphers.
Maybe there's some vulnerabilities
that certain characters are encrypted a certain way.
Or, if you encrypt certain things, you can decrypt it.
There are crypt ciphers--
weaknesses in the algorithms themselves--
that we could maybe exploit to speed up our attempts.
As an example, looking at wireless WEP
due to the use of RC4 and various other things,
are susceptible to cryptanalysis,
that you could actually just watch enough of the traffic,
and a key would come out, because you
could expose the key by getting enough information
from the air.
So that was an example of cryptanalysis being
used to break a security model.
So hash collision attacks-- collisions
occur when two inputs provided to a hashing algorithm
both result in the same output.
So as an example here, two Chinese researchers in 2010
demonstrated that if you supply this string to an MD5 hashing
number, and this string to an MD5 hashing algorithm,
you can see that they're almost identical,
with the exception of one digit has changed,
and they both generate the same hash.
So two different inputs generating the same hash
is a collision, because that means
you have two separate passwords that
will let you into the system.
You now have a collision.
You have no-- no uniqueness of it.
There's a potential for two.
So this means if you had a binary,
and you said this binary is MD5.
It's secured.
And then somebody else made another evil putty.exe binary,
and that had the same MD5 hash, how
would you be able to tell the difference, right?
If you couldn't tell that these were different files,
you would run one thinking it was the other.
So there was lots of problems there
once a collision is found.
So we move people away from these algorithms
once they're broken.
So currently, SHA-2, recommended best practice.
Also, we've got PDKDF2, which is the key-stretching process.
And this basically means that when you hash a password--
and what we would do is we would hash it many times.
We do some key-stretching.
We take that password that you've given,
and you create a derived key by hashing many, many times
through things like key files or whatever,
so that it would be quite fast for you on your computer,
but it adds an extra overhead to an attacker.
It means that they have to do that same key stretching
process, which slows them down.
It makes it more expensive to build a machine
to crack things.
Pseudo-hashing.
Please excuse the not-so-friendly-for-work image
there.
But it's Cisco Systems, which I do
believe it looks a little bit like the San Francisco--
the bridge, or similar that they have.
But I do believe it's two middle fingers being raised instead.
But embedded hardware, embedded developers
often sometimes take shortcuts.
They might think, well, you know,
it's kind of a lot of space to put in an encryption algorithm.
So what we'll do is we'll just make
it look like it's encrypted as a pretend encryption, which
is what Cisco did.
They created something called type 7 encryption, which
was actually just XOR with a hard-coded key.
And if you encrypted your passwords for a Cisco device,
it was very trivial to reverse it back to the plain text.
So even if it looks like encrypted data,
don't assume it is.
It could be something like pseudo-hashing,
whereby they haven't implemented proper hash types at all.
Again, the Unix /etc/shadow file,
which is where those hashes are stored for uses in Unix
systems, it's a Unix-based system for storing passwords
in encrypted format.
You can get more information from the crypt man page.
But as an example, there is DES 56-bit key, which
has a seven character limit.
And amusingly, Debian used to ship with DES as the default
encryption standard.
So lots of hackers were installing
DES believing that they were then
setting really strong passwords, but were unaware that it
was a seven-character limit.
And you only ever needed the first seven characters there.
Super-secure password.
Which of course was trivial to brute force.
So triple DES, 128 or 192 bits, that
has a slightly-- it's like DES times 3.
And it increases the amount of keys.
But this is a symmetric encryption.
And then you have these dollar ones.
When you see the /etc/shadow entry,
and you see these dollars, it's signifying which hashing
algorithm is being used in the shadow file.
So $1 for MD5, SHA-256, SHA-512, and Blowfish.
And they're recommended.
I mean, if you want the ultimate, SHA-512 or Blowfish,
either of those two might be the stronger ones to have.
So if you then look at Microsoft hashes, and SAM dumping,
you can also see in that hash dump
that we saw before, that process of dumping the SAM
would contain those two hashes, which we used with PS exec
to log in.
One is an NTLM hash.
One is what's known as a LANMAN hash.
LANMAN hashes can store up to seven characters.
So if you had a Windows password that was 14 characters or less,
it would store it as two LANMAN hashes.
It would actually store that up to seven characters
in uppercase as a LANMAN hash, which
made Windows passwords case-insensitive,
and caused a bit of a problem.
And it was, of course, not very secure in terms
of cryptanalysis attacks.
So they moved to NTLM, which is a much more secure alternative.
However, LANMAN is significantly broken.
If you find networks or environments that still enable
LANMAN, or they have migrated from 2000 to 2003, 2008,
as they've been doing these migrations--
they haven't got rid of LANMAN, they've kept LANMAN hashes--
then these are very trivial to reverse and get back
to plaintext.
So the art of password cracking.
Password cracking is a bit of an art, really.
You'll need to be able to do things, like I said,
like compile lists.
So to give you some ideas, what I would do
is I would do something like crawl a website.
Crawl a website for all the words on a website.
Let's say I wanted to break into Hacker House.
I'd crawl every website associated with Hacker House,
download every word from that website,
and store those words in files, because it will contain things
like products, business use, names of the company,
employees, things like that.
And I would use those words.
And then I would mutate them using a password mutation
system, like John or something else.
So I change "password" from "password" to "p4ssword."
You know, I'd swap the letters around,
and swap zeros with ones, and things like that.
Mutate that list-- that big word list you're creating.
And of course I would also steal passwords.
I'd steal passwords from other organizations,
and steal passwords from organizations
in the same space, or the same industry as them,
maybe people using the same software as them.
And maybe you reuse some of those passwords again.
So password cracking is a little bit of an art form.
And you'll find some people are quite passionate about it--
people who build big machines for cracking passwords
quite often.
Advanced cracking.
Moving away from just doing some list-type stuff
is the process of kind of accelerating password cracking.
You could do that through things like rainbow tables,
GPUs, field programmable gates arrays, ASIC hardware.
You could maybe use something like Cracking-as-a-Service,
cloud cracking, or you can even use GPUs of things like Amazon.
And just on the slide show there,
you can actually see an example of a cryptanalysis,
or some advanced tracking being done.
You've got an FPGA on the desk there.
That's actually running away, and trying
to do cryptanalysis, accelerating password cracking
attacks.
And the reason is because GPUs, FPGAs, et cetera,
they're really good at doing kind of the parallel-- that
pipelining.
The way that they run instructions,
they can do multiple things at once.
And therefore they're really good at doing stuff
like cryptanalysis, trying lots of things out at once,
and getting lots of responses.
However, building big machines is costly.
It's expensive.
And your average person isn't going
to really want to spend the several thousand
pounds that are necessary to build such a rig.
If you wanted to break DES, for instance,
some researchers built a machine which exhausted the DES heat
space in under seven days.
But the price tag on their machine for development
to build it was $40,000.
To buy it from them is $100,000.
So it can be profitable depending on what kind
of systems you are building.
But I would recommend, you know, maybe
make use of cloud cracking.
You can actually rent GPUs these days.
You can rent them from Amazon.
They're a bit more or less expensive.
And you can use the cloud.
So if you have a particular hash, and you want to crack it,
don't spend thousands building a machine.
Use some servers in the cloud, and send that hash up there,
and just spend the money that you
want to spend getting that one password.
Don't just go and build massive machines--
unless that's part of your business, and something
you're going to do frequently.
Likewise, there's been a number of things
that are broken per Pseudo Random Number Generators,
or PRNGs, which are used for generating entropy.
And this is a classic example from 2008,
where Debian had a PRNG which was seeded with no values.
These were the process IDs of the system.
So actually, the PRNG only ever had 65,536 states,
which meant that there was only 65,536 keys around that
could ever be used, that were ever generated
by Debian to log in via SSH.
And it was a bit of a joke, because it was almost
like if you were asking a computer for a random number,
it was chosen by a fair dice roll, the answer will be 4.
So that could have been used to log into SSH.
Indeed, it was used to access NASA and various other places.
But these SSH keys, they're blacklisted now.
It's less of a problem.
But it's a good vulnerability to study
is when crypto goes wrong, when random numbers go wrong,
when attackers can predict numbers,
the devastation it can cause.
A tool you might use for cracking passwords--
we've seen it a little bit earlier on--
was John the Ripper.
John the Ripper is a tool for shredding of passwords,
for doing analysis on passwords, and trying to crack them,
and doing password acceleration.
As an example there in the background,
we can see it's using a GPU.
It's just connected to a GPU device.
And it's trying to do some password acceleration,
trying to brute force using a GPU.
You can get more increase of speed for how many passwords
it can try a minute.
Cain and Ophcrack are two Windows-based passwords.
Utilities Ophcrack runs on a live CD.
And you can use these tools to do the same kind
of cryptanalysis as John.
But they're a little bit more focused on Windows and Windows
environments.
So what would you go in your password cracking tool box?
John the Ripper, Ophcrack, L0phtcrack, Cain & Abel,
hash-identifier-- a tool for identifying hashes--
Hashcat, some scripting languages.
You might want to write a little tool to test some things out.
And I would use this tool called cewl,
which is a wordlist builder by an individual called
Robin, I believe, or Rob.
And he allows you to crawl a website,
and actually generate wordlists specific from a website.
And also you're going to need some wordlists.
As I said, it's really important that you start collecting
lists, password lists.
I've collected something like several terabytes
worth of lists over my career.
I know that these are really useful for me.
And I try them in different situations.
So you'll want to build up a collection
of your own wordlists as well.
Rainbow tables are an alternative.
This is when we use pre-computed hashes, we take MD5,
and we feed a dictionary through for all the passwords
from A to AAAAAA, or whatever, at some kind of length.
We generate all the possible passwords without a salt.
And you have them in a table.
And that way you don't have to generate them again.
So you are saving the time.
You're doing a memory trade-off.
You'll generate the password list one time,
and then you increase the way that you can do the brute force
attacks.
But it then requires a lot of storage,
because you have to then keep all
of these encrypted passwords lay around somewhere.
So LANMAN and MD5, rainbow tables
worth having, because if you come across a LANMAN hash,
getting the plaintext from a rainbow table
should be a matter of seconds.
And, in fact, they're bundled with Ophcrack.
So if you download the Ophcrack tool,
you'll have those rainbow tables in there.
And you could use that password data from our last lab module,
and try it with Ophcrack.
So for this practical module you will basically
be given a series of passwords, files
that's downloaded from our server in the pwdlab.tgz file.
And if you go to your computer--
I'll download it from here--
you can actually download this file onto your laptop
into your environment from static.hacker.ho
use/stuff/pwdlab.tjz.
And I will now pause here.
And I will go through some of the practical elements
for this module just so we can run through and see
some of those tools in action.
Thank you for listening, and I hope you've
enjoyed the course so far.