Password Attacks

Why do many network intrusions occur?

A threat actor simply obtains credentials to access the network

What do threat actors often try to do after gaining access via an on-path or malware attack?

Escalate privileges to gain access to other targets on the network by harvesting credentials for administrative accounts

How can a plaintext password be captured?

By obtaining a password file or by sniffing unencrypted traffic on the network

What happens if a protocol does not use encryption?

The threat actor can simply read the password string from the captured frames

Why are passwords usually stored and transmitted as hashes?

A cryptographic hash makes a fixed-length string from the user's input using a one-way function so the plaintext should not be recoverable from the hash

What is a cryptographic hash algorithm?

A one-way function that produces a fixed-length string from a variable-length string

Why is Base64 not the same as cryptographic hashing?

The password value can easily be derived from the Base64 string

What can a threat actor obtain from the local system to attack passwords?

A database of password hashes

How can a threat actor capture a password hash during authentication?

By using an on-path attack

What are the two basic techniques used by password-cracking software?

Dictionary and brute force

What is a dictionary attack?

Matching the hash to those produced by ordinary words found in a dictionary

What kinds of information might a dictionary include for password attacks?

User and company names, pet names, significant dates, or any other data that people might naively use as passwords

How can organizations help protect against dictionary attacks?

Enforcing strict password requirements and educating users on password protocols, such as not using any personal information

What is recommended instead of passwords?

Passphrases

What is a brute force attack?

Trying to match the hash against one of every possible combination it could be

How does password length and complexity affect brute force attacks?

Longer and more complex passwords increase the time the attack takes to run, and the computational power needed increases exponentially

How can an attacker speed up brute force cracking?

By using any information they know about the password, such as exact length or known characters, as masks

What is the only way to determine the original plaintext from a hash in the reference?

Try every possible combination until the hash is matched