Authentication and Account Management Notes

Authentication Credentials

  • Types of authentication credentials:
    • Where you are (e.g., military base).
    • What you have (e.g., key fob).
    • What you are (e.g., facial recognition).
    • What you know (e.g., password).
    • What you do (e.g., behavioral biometrics).

Passwords

  • Usernames are used to identify the user and passwords are used to authenticate the user.
  • Passwords are the most common type of authentication but only provide weak protection.
  • Actions can be taken to strengthen passwords.

Password Weaknesses

  • Humans can only memorize a limited number of items.
  • Long and complex passwords are most effective but difficult to memorize.
  • Users must remember passwords for many different accounts, each of which should be unique.
  • Security policies mandate passwords expire, requiring users to repeatedly memorize passwords.
  • Users often take shortcuts, using weak passwords such as common words, short passwords, or personal information.
  • When creating stronger passwords, users generally follow predictable patterns like appending letters, numbers, or punctuation in a pattern, or replacing characters in predictable patterns.
  • Commonly used weak passwords include "123456", "password", and sequences of numbers or letters.

Attacks on Passwords

  • Social engineering (phishing, shoulder surfing, dumpster diving).
  • Capturing (keyloggers, protocol analyzers, man-in-the-middle and replay attacks).
  • Resetting (attacker gains physical access and resets password).
Offline Attacks

  • Offline attacks are the most common method used by password attacks today.

  • Attackers steal a file of password digests and compare them with their own digests.

  • Types of offline attacks:

    • Brute force: Trying every possible combination of letters, numbers, and characters. This is the slowest but most thorough method.

    • Mask attack: A targeted brute force attack that uses placeholders for characters in certain positions of the password, considering parameters like password length, character set, language, and patterns.

    • Rule attack: Conducts a statistical analysis on stolen passwords to create a mask for breaking a larger number of passwords.

    • Dictionary attack: Attackers create digests of common dictionary words and compare them against the stolen digest file.

      • Pre-image attack: A dictionary attack that uses a set of dictionary words and compares it with the stolen digests.
      • Birthday attack: The search for any two digests that are the same.

    • Rainbow tables: Uses a large pregenerated dataset of candidate digests.

      • Steps for using a rainbow table:
        • Creating the table: chain of plaintext passwords, encrypt initial password, feed into a function that produces different plaintext passwords, repeat for a set number of rounds.
        • Using the table to crack a password: Run encrypted password through same procedure used to create initial table. Results in initial chain password. Repeat, starting with this initial password until original encryption is found. Password used at last iteration is the cracked password.
      • Rainbow table advantages over other attack methods.
        • Can be used repeatedly.
        • Faster than dictionary attacks.
        • Less memory on the attacking machine is required.

    • Password Collections

      • Attackers use large collections of real-world passwords obtained from breaches to gain insight into how users create passwords.
Pass the Hash Attack
  • An attacker who steals the digest of an NTLM (New Technology LAN Manager) password can pretend to be the user and send that hash to the remote system to be authenticated.

Password Security

  • Securing passwords depends on both the user and the enterprise.
  • For the user: properly managing passwords.
  • For the enterprise: protecting password digests.
Managing Passwords
  • The most critical factor in a strong password is length.
  • Recommendations:
    • Do not use passwords that consist of dictionary words or phonetic words.
    • Do not repeat characters or use sequences.
    • Do not use birthdays, family member names, pet names, addresses, or any personal information.
    • Use non-keyboard characters (created by holding down the ALT key while typing a number on the numeric keypad).
Password Managers
  • Technology used for securing passwords.
  • Three basic types:
    • Password generators.
    • Online vaults.
    • Password management applications.
Protecting Password Digests
  • Use salts (random strings used in hash algorithms) to protect passwords by adding a random string to the user’s cleartext password before it is hashed.
    • Makes dictionary and brute force attacks much slower and limits the impact of rainbow tables.
  • Use key stretching, a specialized password hash algorithm intentionally designed to be slower.
    • Two key stretching algorithms are brypt and PBKDF2
  • Recommendation for enterprises using salts and key stretching:
    • Use a strong random number generator to create a salt of at least 128 bits.
    • Input the salt and the user’s plaintext password into the PBKDF2 algorithm that is using HMAC-SHA-256 as the core hash.
    • Perform at least 30,000 iterations on PBKDF2.
    • Capture the first 256 bits of output from PBKDF2 as the password digest.
    • Store the iteration count, the salt, and the password digest in a secure password database.

Tokens, Cards, and Cell Phones

  • Multifactor authentication: Using more than one type of authentication credential.
  • Single-factor authentication: Using just one type of authentication.
  • Most common items used for authentication: tokens, cards, and cell phones.

Tokens

  • Used to create a one-time password (OTP), an authentication code that can be used only once or for a limited time.
  • Hardware security token: a small device with a window display.
  • Software security token: Stored on a general-purpose device like a laptop or smartphone.
  • Two types of OTPs:
    • Time-based one-time password (TOTP): Synched with an authentication server. Code changes every 30-60 seconds.
    • HMAC-based one-time password (HOTP): “Event-driven” and changes when a specific event occurs.
  • Advantages over passwords:
    • Token code changes frequently.
    • Attacker would have to crack code within time limit.
    • User may not know if password has been stolen.
    • If token is stolen, it becomes obvious and steps can be taken to disable the account.

Cards

  • Smart card: Contains an integrated circuit chip that holds information.
    • Contact card: A “pad” that allows electronic access to chip contents.
    • Contactless cards (proximity cards): Require no physical access to the card.
  • Common access card (CAC): Issued by the US Department of Defense. Includes a bar code, magnetic strip, and bearer’s picture.
  • The smart card standard covering all U.S. government employees is the Personal Identity Verification (PIV) standard.

Cell Phones

  • Increasingly replacing tokens and cards.
  • A code can be sent to a user’s cell phone through an app or via SMS.
  • Allow a user to send a request via the phone to receive an HOTP authorization code.

Biometrics