-: In our previous discussion
about vulnerability assessment tools,
we covered network mapping, vulnerability scanning,
network sniffing tools,
but I put off covering password analysis tools
until this lesson because there's a lot of things
that we need to discuss with the concept
of password analysis tools.
First, what is a password analysis tool?
Well, it's a tool that's used
to test the strength of your passwords
to ensure that your password policies
are being followed properly.
Another name for these is a password cracker.
Now a password cracker uses comparative analysis
to break passwords and systematically guess them
until the password is finally determined.
There's a bunch of different password crackers out there,
but by far the two most well known
are Cain and Abel and John the Ripper.
In fact, in the next video,
I'm going to load up John the Ripper in my lab environment
and I'm going to show you how it can crack the root password
of a Kali Linux machine.
Now, there are four different methods
of doing password cracking and analysis
that can be performed by the various tools
out there on the market.
There's password guessing, a dictionary attack,
a brute-force attack, and a cryptanalysis attack.
With password guessing,
this occurs when a weak password
is simply figured out by a person.
For example, if you happen to know personal information
about somebody, like their dog's name was Fluffy
and their birthday was June 17th,
you might try a few passwords like fluffy0617,
or Fluffy17, or other combinations
to try and guess their password.
If the person chose a weak password
like their dog's name, the name of their high school,
or even the word password,
then password guessing may work for you.
Now although this isn't a technical form of attack
because you're not using algorithms and tools
to crunch it through these
and break up the password,
it can still be quite effective.
I'm sorry to say that I once had a pin number
protecting my smart phone
that my nine year old son was able to guess.
That's right, he went through
and he started guessing numbers,
and eventually he picked the right one,
the right four digit code to get into my phone.
Now again, this is why a good, long, strong password,
or more preferably biometrics,
should be used to secure your devices.
The next method is called a dictionary attack.
In this type of attack, the password cracking program
is going to attempt to use a dictionary
to automatically guess the password
by trying each and every word in that dictionary file.
Now a dictionary attack doesn't just use
common dictionary words, though,
because hackers have created their own dictionaries
that consist of other variations.
Like commonly used passwords,
variations on real dictionary words
using numbers, letters, and special characters,
and other such variations.
When I demonstrate password cracking
with John the Ripper in the next video,
I'm actually going to be using a dictionary attack to do it.
The next type of attack is known as a brute-force attack.
A brute-force attack is where the computer program
attempts to try every single combination of a password
until it can find the right one.
Now this can take a lot of computing processing power,
as well as a lot of time,
depending on how long and strong your password is.
But eventually, it will always find it.
So if I set a four digit pin to protect my smart phone,
you could basically start at zero
and go 0000, and then 0001, and then 0002,
and keep adding one digit each time
until you find my passcode,
which may be something like 8157.
This means you're going to try 8,157 different passcodes
until you land on the correct one
on your 8,158th attempt.
Now, if it took you two seconds to enter each passcode,
this would take you a little over four and a half hours
to determine my passcode.
Assuming you didn't take any breaks
for coffee, a snack, or use the restroom.
Now, as you can imagine,
a computer can try much faster than you can.
In fact, it can do hundreds
or thousands of combinations per second.
So a four digit pin can easily be cracked by a computer
in just a couple of minutes.
Now again, this is why longer, more complex passwords
are critical to your security.
By moving from numbers,
which only have 10 options per digit,
to uppercase, lowercase, numbers, and special characters,
we now have exponentially increased the amount of time
that it's going to take to brute-force this password.
Now the final method covered by SecurityPlus
is called the cryptanalysis attack.
This attack relies on comparing a precomputed,
encrypted password to a value found in a lookup table.
For example, if you store a password in Windows,
it's actually stored as a hash value.
If I had to calculate every hash
of every dictionary word in my dictionary attack
or every possible password combination
in a brute-force attack,
this takes additional computing power.
But if I have a database of all of those values already,
I can just compare the encrypted password
to the values found in the table,
and if I find it, I can then look in the column next to it
for it's unencrypted value.
These tables of precomputed values
are known as a Rainbow Table,
and these files can be massively large.
One of my favorite rainbow tables
is actually found online at CrackStation.net.
Their table contains 15 billion entries
and is a 190 gigabytes in size.
That is a really, really big text file.
Now I said there was only four types of password cracking
you need to know for the security exam, and that's true.
But I wanted to tell you about a fifth option,
which used to be covered by the exam,
but they've taken it out in recent objectives.
Now, if you're not interested, feel free to skip ahead
and just move on from this lecture,
but honestly I'm going to tell you about this
because it was one of my favorites.
Every time I read it in the textbook it just made me laugh.
The fifth method is a very low-tech method,
but it can be effective.
I think they removed it from the textbook
because you're probably not going to use this
in your office environments.
What is it?
Well, it's known as the rubber hose method.
What?
Yes, the rubber hose method.
The rubber hose method was the name they used to call
any kind of password cracking attempt
that was made by the threat or use of physical violence
against the person who actually knew the password.
So if you think back to some of those old military movies
or spy movies, somebody's tied to a chair,
and another big mean guy comes over and punches him
or hits him with a bat and says,
Tell me the password or I'm going to keep beating you!
That's basically the rubber hose attack.
They call it this because you can beat somebody
with rubber hose until they told you the password.
Alright, like I said, it's not necessary information
for the exam, but it always made me laugh
so I thought I'd share it with you
and maybe give you a chuckle, too.
(electronic tones)