14.10. Cracking Passwords

There are two methods of picking passwords: by using a dictionary and by trying all possible combinations. In addition, passwords can be cracked remotely or locally.

14.10.1. The Dictionary Method

First, a file with words most commonly used for passwords is prepared. Next, a password-picking program tries each of the words in the file against the login password.

The advantage of this method is that if the password is in the dictionary, it can be found quite quickly. If the password is a simple word that can be found in any English dictionary, the number of possible passwords will not exceed 20,000, the approximate number of the most often used words in the English language.

The hacker's task is to prepare the dictionary using the most effective potential passwords. First, all possible information about the administrator is collected: his or her name ; the names of his or her spouse, friend, relatives, and pets; hobbies; favorite music and movies; and so on. Passwords built based on this information are placed in the beginning of the dictionary. Practice shows that most people use passwords of this type, and most often those related to their hobbies.

But the chance that a strong password, which is made up of digits and symbols in addition to letter and uses both uppercase and lowercase characters , will be included in the dictionary approaches zero; consequently, the time spent picking the password using a dictionary will be wasted . In this case, the enumeration, or brute-force, method is resorted to.

14.10.2. The Brute-Force Method

The program goes through all possible combinations of letters , digits, and symbols in both uppercase and lowercase. There are billions of possible combinations, the exact number depending on the password length. The longer the password, the more possible combinations there are and the more time needed to pick it.

The method is 100% successful. But this method is time-consuming ; it can take weeks to months, if not years , to crack a really strong password. Moreover, if passwords are changed monthly, when a hacker cracks a password, it may no longer be valid.

14.10.3. Cracking Remote Passwords

A hacker tries to crack the password when logging into a system remotely. This is the most dangerous method for the hacker, because each unsuccessful attempt is recorded in a security log. If the administrator at least occasionally inspects the log, the break-in attempt will be discovered in the early stages and nipped in the bud by prohibiting connections from the hacker's IP address.

Another problem with remote password cracking is that the password discovered will be to a certain service only and there is no guarantee that another service will use the same password. To make password cracking more difficult, most services are configured to limit the number of password entry attempts, for example, to three. If no correct password is supplied within three attempts, the connection is broken off and has to be established again. Establishing a connection takes extra time, which also increases the time necessary to crack the password using the dictionary method.

To make password cracking a lengthy process, some services insert a delay after an incorrectly-entered password before allowing another login attempt. A good example of this is the operating system. When an incorrect login or password is supplied when logging into the system, the verification process takes longer than when the correct parameters are provided. The delay may seem insignificant when you simply mistype a parameter once, but it adds up when you are going through thousands of variations.

The delay is easy to bypass by launching several threads of a password-cracking program, which will connect to the server and try to crack the password in parallel.

The most effective method to prevent multithread cracking is to configure the firewall to prohibit connections to the server from this IP address.

14.10.4. Cracking Local Passwords

Because it is so difficult to crack passwords remotely, hackers strive to obtain a copy of the /etc/shadow file so that they can work on breaking the passwords it contains on their own machines. In this case, the process is much faster for the following reasons:

The real names of the users registered on the server are known.
The server-protection mechanisms against password cracking are no longer effective.
Because passwords in the file are encrypted, each possible password also has to be encrypted before it is compared with the password stored in the file. The encryption process adds to the overall time necessary to crack a password; however, its negative effects depend on the number of passwords in the file. Instead of trying all possible password combinations against one encrypted password, each combination is first tried against all entries in the password file. The greater the number of password entries in the file, the higher the chances that the combination will fit one of them.
Also, the larger the password file is, the greater the chances are that at least one of the users chose the account name for the password.

Local password cracking is much faster and safer for the hacker than the remote method. But it has its own problem, which is obtaining the /etc/shadow file. The only user that has the read and write rights to this file is the administrator, with the rest of the users having no rights to it.

14.10.5. Protecting Against Password Cracking

In principle, there is not, and can't be, 100% protection against password cracking. If a hacker obtains access to the /etc/shadow file, you can take it for granted that at least one password will be broken. But you can make password cracking more difficult or prevent its negative effects by following these rules:

Change passwords monthly. If hackers are cracking passwords remotely, this can make hitting the right combination impossible . If hackers are cracking passwords locally, by the time they pick a password it may already have been changed.
Check your passwords for resistance against the dictionary method. Make users change passwords vulnerable to picking.
Use strong passwords to make password picking by the dictionary method impossible.
Protect the /etc/shadow file by all possible means. Although all users have to have read access rights to the /etc/passwd file to be able to use numerous utilities, they have no need for the /etc/shadow file.
Regularly examine the security log for an abnormal number of failed system logins.

Following these rules, you will lower the chances of your system being broken into by the brute-force method of password cracking.

In Section 2.6 , I mentioned the importance of choosing strong passwords and offered some recommendations on how to create them. Now I want to offer another interesting method using encryption. It works as follows :

Create a file named, for example, pass.txt, and enter into it the text to be used as the password. For example: echo "password" >> pass.txt .
Encrypt the file by executing the following command: openssl des -in pass.txt -out pass.txt.s . The key to be used for encrypting does not matter; you can enter any word.
The text saved in the pass.txt file will be encrypted and saved in the pass.txt.s file. Open this file, choose readable characters, and build a password from them. This password cannot be cracked using the dictionary method; the brute-force method has to be used.

An excellent method for protecting against remote password breaking can be using PAMs, considered in Section 3.3 . One such module is /lib/security/pam_tally.so. It blocks access after a certain number of unsuccessful login attempts. Consider using the module on an example of Linux login authorization. The login configuration settings are stored in the /etc/pam.d/login file. To limit the number of attempts on entering the password to five, add the following entry to the file:

 account required /lib/security/pam_tally.so deny=5 no_magic_root

Five is the optimal number. Giving users fewer chances may cause problems for especially forgetful users. But unless a user suffers from amnesia, if the correct password is not entered after five tries, there is a good chance that password breaking is taking place.

14.10.6. John the Ripper

Now it's time to consider some practical password-cracking techniques. This is necessary to understand how passwords are cracked and to be able to do this yourself to test the passwords of your users for meeting the strong-password criteria.

John the Ripper is the most popular password-cracking program among most hackers and administrators. The program supports the main encryption algorithms: MD5, DES, and Blowfish.

The password-cracking process is started by executing the following commands:

 unshadow /etc/passwd /etc/shadow > pass.txt john -incremental pass.txt

The first command matches user names with their corresponding passwords and stores the pairs in the pass.txt file. You could do this manually, but for a large number of users this task is better left to the program, unless you have masochistic tendencies.

The second command starts John the Ripper. If you want to use your own dictionary file, specify it using the following command:

 john -wordfile:filename pass.txt

Here, filename is the name of the dictionary file. Linux has a built-in dictionary, stored in the /usr/share/dict/words file. At the dawn of the Internet, the famous Morris worm broke into the largest, at the time, number of computers using only the UNIX dictionary (there was no Linux yet). The Linux built-in dictionary is specified by executing the following command:

 john -wordfile: /usr/share/dict/words pass.txt

A large collection of dictionaries that you can use to test your password for meeting the security criteria can be found on the www.packetstormsecurity.org site. If you can crack any of your passwords using one of these dictionaries, hackers can also do this.

While John the Ripper is hard at work, pressing any key will display information about the status of the process. To interrupt the program, press the <Ctrl>+<C> key combination. To resume work, execute the following command:

 john -restore

The file with the cracked passwords can be viewed by executing the following command:

 john -show pass.txt