-: We've spent a lot of time on hashes already
but in this lesson I want to focus on just two things
and they're both attacks.
It's the Pass the Hash attack and the Birthday Attack.
As we've previously discussed
in our hashing lesson, passwords
are stored on the server in their hashed format.
Pass the Hash is a hacking technique
that allows the attacker to authenticate
to a remote server or service by using
the underlying hash of a user's password
instead of requiring the associated
plaintext password as you normally
would have to do.
Now, if an attacker is able to sniff that hash
or steal it some other way, they don't need a brute
force to clear text password.
Instead they can simply reuse the hash
of that arbitrary user account
as a go and authenticate against
remote systems and impersonate that user.
In other words, from an attacker's perspective
hashes are functionally equivalent
to the original password that they generated
and it doesn't mean that they need to know
your actual password to use your account
as if they were you.
The Pass the Hash attack is very difficult
to defend against because there are many possible
exploits in Windows as well as the applications
that run on top of it.
And any of these can by used by an attacker
to elevate their permissions and then
be able to pull off credential harvesting
or hash harvesting that they can then use
in a further attack using Pass the Hash.
Also, only one machine in a Windows domain needs
to be miss configured or missing a critical security patch
for a hacker to find their way in
and be able to execute this technique.
There are many penetration tools out there
such as Mimikatz that give you the ability
to automate this process of harvesting
the hashes and conducting the attack.
To prevent the Pass the Hash attack
you should ensure that only trusted
operating systems are allowed to connect
to your servers.
That your Window's domains have their trusts
set up properly and that workstations are all
patched and updated.
That your multifactor authentication
is being used properly in the network
and that user accounts have been set
up to use the concept of least privilege.
Now, the second type of attack that I want
to talk about is called a Birthday Attack.
The Birthday Attack occurs when an attacker
is able to send two different messages
through a hash algorithm and it results
in the same identical hash digest
causing a collision.
This attack gets it's name from something
called the Birthday Paradox, which says
that if you have a random group of people
the chances are that you are going to have
two people in that group with the same birthday.
When I teach this course in person to a group
of 30 people, most of the time, two people
in the class have the same birthday.
At least the same month and day if not also the year.
In fact, even though there are 365 days in a year
you only need 57 people in a room
to get a 99% chance of having two identical birthdays.
With 23 people in a room, your odds are 50/50.
That's why in my classes of 30 students,
more often than not we have identical birthdays.
In the world of hashes, two identical hash digest
would result in a collision.
Now if a hacker can find two identical messages
with the same hash, they can use this
as an attack against your system.
For example, if they found a match to your
passwords hash, they could bypass your
authentication system, even by entering in
the wrong password.
And for this reason we want to make sure
we're using hashes with long output digest
so when we start using things like SHA-256
over MD5 this reduces the amount of collisions
and reduces the effectiveness of a Birthday Attack.