Walk into a module and identity theft or the methods and techniques for stealing user credentials from
systems
let's begin by attempting a classification what subtypes can credentials stealing attacks be divided
into.
We refer to it as indication credentials and not passwords since we are now aware that operating systems
except for poorly designed systems don't store user passwords.
The first type is an online credential stealing attack having accessed or gathered some credentials
and attacker might attempt to recover a user's actual password from them.
This sort of attack is very vicious and quite notorious if you hear that the database of Company X or
Y has been leaked.
Don't expect it to contain any plain text passwords.
These type of databases are obsolete now.
The leaked files will instead contain credentials or hashes generated from passwords.
There is still the risk of course that having obtained the credentials and attacker can reverse a hash.
We'll talk about how to do this in a minute.
But attackers don't have to do it at all since they have credentials that are capable of authenticating
them in a system passwords are irrelevant in this scenario.
What's important are the L-N and the enty hashes and the TGT ticket.
If an attacker has a TGT or a Hash user passwords are no longer a prerequisite.
You can make good use of the credentials he got ahold of
second class credentials stealing a tax or passive online attacks that intercept credentials send over
a network after a successful interception.
Their credentials are used to obtain a user's password or to impersonate the user in a system interception
is a time consuming process.
That doesn't always go well.
That's why the man in the middle attacks or replay attacks are usually used to run it.
We'll talk about one replay technique in particular soon
active online attacks rely on cracking passwords and attacker doesn't have to have any cryptographic
resources.
He only knows something about the user.
And we'll try to guess or determine that user's password if this knowledge proves insufficient the user
for example has a secure password.
It's very easy to detect and block an active online attack
an effective countermeasure in that case is to enforce locking an account after a limit of failed logging
attempts has reached
the fourth category of credential attacks or strictly social engineering attacks.
Why would anyone want to lose a days or weeks or a months time cracking a password if it's enough to
politely ask a user to share it with you.
How are online attacks constructed.
What methods are used a brute force attack is one of the potential threats here.
This is an exhaustive key attack that relies on checking all combinations of characters as you remember
from the previous module.
A successful brute force attack on enty land manager protocol takes from 10 to 20 with power to tend
to the 600 the power operations depending on the strength of a user's password.
This would take a lot of processing dictionary attacks or at the other side of the scale there is a
list of potential or common passwords and each entry is checked one by one this check doesn't take long.
There's little computing here.
Remember then offline attack requires the possession of some cryptographic resource such as an entry
or a LAN Manager hash.
It's impossible even today to generate a list of all possible passwords and store it locally in the
case of secure protocols
possibly with land manager a good server would be able to store an exhaustive password database.
Why did Microsoft decide to implement this protocol at all.
Twenty years ago when Windows enty and Windows 95 operating systems were being developed nobody assumed
that the solutions then used would still be implemented in 2012.
Even 10 years ago hardware and software was evolving so fast that two new architectures were released
in a year a year old computer was already outdated and unable to support many functionalities or run
many applications.
Nobody thought 20 years ago that the solutions then created will be in use for this length of time.
The Year 2000 problem was the perfect example of this many programmers simply did not expect their code
to remain in use for systems for so long.
Coming back to online attacks we already know that calculating all possible combinations consumes a
lot of computational power.
And that's storing all calculated combinations is infeasible as it would require massive storage resources.
Let's try to strike a balance.
The tradeoff is provided by Rainbow timbales developed by Phillip Oaks Slinn
instead of saving all possible hashes somewhere.
You can only save some of them what hashes should be selected though.
We don't know what would be the efficiency of a rainbow table.
The trick is using a reduction function this function should be as random as possible.
We don't base here on some arcane knowledge of hash generation or on user data we'd like to use a function
that maps a hash to a corresponding password more or less randomly.
The reduction function is the opposite of a hash function such as the M.D for empty five or shall one
functions
receive a first password in a rainbow table.
Let's track a single chain.
The first value is a password followed by a function that generates the hash from the password.
For example a land manager or anti-landmine in your hash.
Next we have a reduction function that is used to recover a password from the hash as we said.
This is supposed to be random so the extracted password will not be the same password that was first
entered.
Regenerate a hash from a newly created password and next using a second reduction function.
Regenerate a password from the hash and so on.
This creates a single rainbow table chain instead of serving all combinations into the table.
We only save and then point we save the starting password and the last computed hash to increase the
chance of all possible passwords being contained in the rainbow table.
There has to be a lot of chains in it.
We had a second reduction function to improve the odds if each reduction function was displayed in a
diagram in a different color.
It would look like Rambo.
Hence the name the rainbow table we took the best of the previous attack techniques.
We have some things pre-computed and saved.
The first password and the last hash but the data doesn't take too much space and can be stored on a
standard hard disk.
Now computing is simply reversing individual chains by comparing a password being cracked against the
values returned by transformations that reverse the direction of the arrows in the chart.
If there is a match we have found the password.
If the values don't match it seems that we're not successful and the password is not contained in the
chain in the rainbow table.
We had to apply some computing power and use up some storage but overall this solution looks extremely
effective.