 |
 Passwords: Common Attacks and Possible Solutions
by Dancho Danchev,
Frame4 Security Systems
Overview
Making sure authorized users have access to either sensitive company information or
their personal e-mail can be a daunting task, given the fact that an average user has to remember
at least 4/5 passwords, a couple of which have to be changed on a monthly basis. The majority of
users are frustrated when choosing or remembering a password, and are highly unaware of the consequences
of their actions while handling accounting data.
This article will provide you with an overview of how important, yet fragile,
passwords security really is; you will be acquainted with different techniques for creating and
maintaining passwords, and possible alternative methods for authentication, namely Passphrases, Biometrics and Public Key Infrastructure(PKI).
Dangers posed by passwords
While the majority of organizations and almost 99% of home users still rely
heavily on passwords as a basic form of authentication to sensitive and personal resources, the insecure
maintenance, creation, and network transfer could open the front door of any organization or
personal asset to a malicious attacker.
Management staff with outdated mode of thinking still believes that passwords are the
most essential, user-friendly way to identify a user on their network or database, while
the fact remains that users are frustrated with the reality that they need to change their password,
create a "secure" password, or follow instructions on how to keep it as secret as
possible. The results are a large number of crackable passwords, the same passwords on multiple
systems, and "post it" notes with passwords on them even including login names.
On any given system, certain users have privileges that the others don't and shouldn't
even have. By identifying yourself on your computer or any given web site, you are
granted with access to your work environment and personal data, data which you define as
sensitive and data you wouldn't want to make public. It is similar to the way a company doesn't want to give a competitor an access to its intranet, for instance. Abusive scenarios posed by exposing accounting data are:
- identity theft
Identity theft might occur once your accounting data is somehow known to another
person using it to impersonate you in order to get a hold of you digital identity. This might
result in both financial damages, as well as personal ones.
- sensitive data exposure
The content of your e-mail correspondence, personal projects, documents and photos,
could be exposed to a malicious hacker or someone especially targeting you as an individual.
- company data exposure
Unethical intelligence by getting sensitive confidential internal information
through a badly maintained and kept accounting data would have an enormous impact on the
company you're working for. I doubt you would like to be the one who reveals the next 6 months'
marketing and advertising plans to a competitor.
- involvement in a criminal activities
The use of your account could be used in various criminal activities if not well
maintained and kept secret. Remember, the trace leads back to your account.
The Most Common Password Exposure Scenarios
- physical security breach
A physical breach onto your computer will completely bypass a majority of sophisticated authentication methods, even the most secure encryption ones.
A keylogger, both software and hardware, might be installed, your secret PGP key might
as well be exposed, making all your accounting and encrypted data compromised.
It doesn't matter how long, or secure your password is, as physical security breaches are one of the most critical ones.
- unintentionally shared
A user might share his/her accounting data without even realizing that with such exposure the risk of a potential break-in increases. A password is usually shared with friends, bosses,
family under certain circumstances. A "benefit" considered by some users is the convenience for
two persons or more, to know certain accounting data in order to gain access to a certain resources.
Passwords might also be shared in an informal talk with coworkers discussing the latest company's password policy, or the way they choose their password to be maintained, and in some cases how the management will never find out about their secret ways of storing the accounting data. One of the most critical and easily achievable way of obtaining sensitive data is simply asking for it, both in a direct or an indirect way, which is what social engineering is all about.
- cracked
Sometimes in case of a partial break-in, the encrypted password file of a company
might be exposed to a malicious attacker. If this happens, the attacker will start cracking a password
file, namely trying all the possible combinations with the intention to find the weakest passwords and
gain privileges later on. In case the company discovers that its passwords' file has been compromised, it should immediately instruct all employees to change their passwords, so even if weak passwords are exposed, they wouldn't be valid anymore. However, if the company is not aware of its password file exposure, it should
constantly try to crack its password file just like an attacker would do and filter out the weakest passwords.
- sniffed
Are you aware how many employees are accessing sensitive data through their already
breached computers or the ones of their friends? Having strong password doesn't guarantee its integrity when it's not securely transmitted over the Internet. Don't give your employees the ability to choose between plain text or SSL authentication; instead, enforce all network communications in encrypted mode.
Another highly recommended option would be to provide everyone with "last login from.." feature, so that in
case they notice an unauthorized login, they would report it right away.
- guessed
A large number of users are tricking the established password policies by somehow
creating a password that is believed to be strong, while it is actually a weakly constructed or common sense password. Although this method of breach is rarely used nowadays compared to the ones we've already discussed above, it should be kept in mind that certain users are still choosing passwords based on objects or brands surrounding their desk.
The Most Common Password Maintenance Mistakes
- auto fill feature
The majority of applications will allow you to remember your passwords and
accounting data, but unless you're sure that the computer is reasonably protected from possible physical
security breaches, you're strongly advised not to have your passwords remembered in this way.
Make sure this option is not used at public access places like netcafes and etc.
- "post it" notes
Passwords are often written down, and even worse, posted next to the monitor or
around the desk. This could easily be spotted by malicious attackers or insiders, so try to avoid this method of insecure conduct.
- the "secret" place
A lot of people believe that they have found the secret place under the keyboard or
anywhere around the desk as a safe password storage. This way of keeping a password secure is totally unacceptable because such people could be watched upon and a timely glance into their everyday chores would reveal the coveted place where their password is erroneously thought to be kept secret. After that, it is purely a technical matter to distract a targeted person and have their accounting data
leaked out. Even so, a large number of people keep certain accounting data on papers, PDAs, etc., so a
possible strategy till they remember their accounting data and get rid of the note they keep with them all the time would be the following; have at lest 6/7 different and fake passwords around the real one, you might even cross a couple of them, even the actual one. This would be very beneficial keeping in mind that hopefully two/three false logins will lock the account, and in case your note gets exposed, it would be still a matter of luck for the attacker to use the right one. Although this method provides no guarantees, and is not recommended at all, it is a very short solution to remember your password and get rid of your note right away!
How to Choose a Secure Password
Choosing secure passwords consists of knowing what their insecurities are, how
passwords are cracked and what's behind the "at least 8 characters long, consisting of lower and capital
letters, special characters and a number" requirement. Basically, the shorter the password, the more opportunities for observing, guessing and cracking it provides. A password cracker would try to guess all the possible combinations of letters, numbers and characters until he/she finds the right one. Given the number of letters in the alphabet and
the amount of numbers(0/9), the second, namely a numbers' based password, will give the attacker
less opportunities to crack. Another commonly used technique is to use a dictionary file against the encrypted passwords database, so that the
weakest and most obvious passwords in terms of words listed in a dictionary will get exposed; this is why a longer
password consisting of letters, numbers and characters would make it a little bit time consuming for an attacker attempting to crack the stolen passwords file. Whenever you create a password, consider the following:
- make it at least 7 characters long, combination between small and capital letters, at least one number and special character like !@#$%^*()_+
- do not simply use a dictionary word or a logical sequence of characters like aaa555ccc, 1234567890 etc.
- try not to use a password you have already used on another system, avoid having the same password on all assets you have access to at any cost
A combination of the following strong, yet easy to remember passwords techniques you might use are:
- choose a dictionary word like success, then reverse it as sseccus
- add numbers at the beginning or at the end of this word like in 146sseccus or sseccus953
- consider adding at least one special character like !@#$%^&*()_+ anywhere
- the use of at least one capital letter would decrease the crackable combinations even more
- replace certain characters with numbers that you associate with them. In such way, security
would become s3cur1ty where 3 stands for e and 1 would replace i
- separate each letter with a number, so security would be s1c3u2r4i6t5y
How to Remember Passwords
Remembering several passwords for different assets is a huge problem for the majority of users. That's why they either ignore remembering and write them down instead, or create weak, but easy to remember passwords. Still, remembering passwords might
not be such a difficult task if the majority of users stop regarding them as a combination of bulk characters, but instead look at passwords as a way to identify themselves, just like they do when withdrawing a money from the ATM cash machine. In this case, it's all their company's and personal data they should try to protect.
- associate them
Association plays an important role in the memorizing process. In a certain
period of time, someone can teach you Japanese
if he/she finds out the way you memorize and, most importantly, associate things. Visualization of the password is another important aspect of memorizing it, and within a short period of time you would be entering it even without thinking what you're entering - a temporary habit, given the fact that the majority of organizations require constant password change.
- explain them to yourself
For instance the password Y13#tiruceS basically represents the word security
backwards, where the first and the last letters
are capital, and the first capital letter is followed by your best friend's birth
date, plus a special character. Instead of representing a bulk of characters like it used
to be, now your password is your own encrypted language.
Possible Solutions
When enforcing authentication methods on both network and security policy levels,
the majority of users proved to be unreliable in storing and creating strong passwords. The service
desk is often too busy to handle "forgotten passwords" requests, and unless the company
doesn't undertake a passwords awareness initiative, the problem will continue to grow.
Passphrases
Passphrases were thought with the idea to be easier to remember, but virtually
impossible to crack. The majority of encryption
software require you to use a passphrase for your private key instead of a
password. Passphrases are usually something that you always remember, either a quote,
favorite sentence and a combination of both numbers and special characters. Although
virtually impossible to crack due to their length, both passwords and passphrases
can be logged through the use of a keylogger, or sniffed if transmitted over
plain text communication channel.
Biometrics
Biometrics is the next generation of authentication methods. Although it's still in
its early implementation period due to the associated costs, and sometimes the
number of false results, biometrics will change the way we authenticate ourselves, hopefully
with 99% accuracy. Simply, biometrics cannot be stolen, cannot be forgotten, neither
can they be given to another person. Biometrics systems may include fingerprint systems, voice
recognition systems, Eye/Retina scanner systems, hand geometry systems and handwriting systems.
Public Key Infrastructure(PKI)
Public Key Infrastructure(PKI) functions give entities, namely employees or servers
the ability to communicate, authenticate, sign and verify identities by creating digital
certificates, each of which containing private and public keys. The public key
is available to anyone wanting to exchange data with the entity and the private key
is the only way for the entity to decrypt, or identify itself properly. PKI is very useful
when communicating over insecure networks like the Internet and both on the internal servers.
Aterword
Although passwords will continue to represent the most common authentication method
for a long time to go, companies and users that have already realized their weaknesses are
slowly switching to other possible alternatives. Encryption will be the next
big thing for the majority of small and middle size companies as well as the
adoption of various biometrics methods.
Other articles by this author
|
|
