Well we've got some computers in front of this because it's time to talk about cryptographic attacks.
Now when we talk about cryptographic attacks the easier way to interpret this is cracking passwords.
Now don't get too excited and everybody's like you get to finally get to crack some passwords.
Well first of all let's make sure we understand what we're talking about when you talk about password
cracking when you have some kind of server a web server an FPP server or an S-sh server again server.
I don't care what kind of an operating system that is sharing folders.
It doesn't matter what it is you are going to have to have a list of usernames and passwords stored
somewhere on that server system.
Now if you're going to store them well you have to when someone logs in there they're going to type
in a username and password and then come to that server so you have to store the password.
So how do you store it.
Well you could just store in clear text.
You mean you literally have a list somewhere on your hard drive that says Mike comma and then whatever
his password is and Bob Khama and whatever his password is.
Janet common whatever her password is.
And we could do that.
But the downside is is that if a bad guy gets to that server he could get easy access to our password.
So traditionally what we do with a password is that when we create a new user and have to type in a
password the password is never stored on the hard drive.
We just hash it.
So we just make a hash of the password.
Now if we've got a hash of the password sitting on the server and somebody who's a client wants to log
in what they're going to do is that the search is going to say Please type in your username and password
so they type in the username and password on their side and then that is hashed.
So the hash comes over the internets and then gets to the server the server compares the hashes and
that's how it logs in.
So we we would really never use clear text except in the most primitive of situations.
The important thing to understand here is if you want to get into cryptographic attacks if you want
to have passwords what you're really doing is hacking hashes.
So there's a couple of things that come into play here.
Number one you have to be able to get to those list of hashes.
First of all so the one of the hardest jobs of cryptographic attacks is to how do you get to that server
and how do you grab those usernames and passwords.
You don't know what the passwords are but how do you at least get the list that varies for every single
thing that's out there if you want to get your Windows system it has its own set of passwords and hashes
if you want to get to an empty server depends on the brand.
They have their own usernames and passwords.
The biggest part of cryptographic attacks really isn't the hacking the hashes.
The biggest part is getting to that and I'm not covering that in this section because there are huge
groups of people who spend all kinds of time with all kinds of different stuff to figure out how to
get to these different things.
The second thing we need to talk about is that if the password is stored in a hash there is no way for
you to reverse that hash to figure out what the password is.
It's just not going to happen.
So what we're going to do instead is we're going to generate hashes until we get the hash that we have
a copy of.
And now what we have the copy we know with this hash is because we generated it ourselves and that we
know what the password is.
So what we're talking about cryptographic attacks and in particular we're going to talk about brute
force attacks and dictionary attacks and rainbow tables and all that kind of stuff.
Keep in mind what we're doing more than anything else is generating hashes and making it compared or
when we compare the right ones.
Then we find we can say we have the password.
So I want to go through this process a little bit.
And the best way to do this is to pick an arbitrary server to attack.
So in this case I'm going to use a program called Free S-sh and I've got it right here.
So this is free S S H S S H is a wonderful little S S H and telnet server I've been using this thing
for years and years.
Nothing special about it but one of the things is kind of fun is that it's got these user accounts so
I'm going to add a user and I'm going to add a user called Timmy and there's all these different ways
I can store stuff I can use inti which is the Windows operating system that's on or in this case I'm
going to use passwords stored as a shield one hash and I'm going to give it a dangerously simple password
and I'm going to call it am I ok.
All lowercase.
Do not try such a small password at home.
All right.
And then what do I want this guy to be able to do with this particular S-sh tool.
So here we go.
Now I got this Timmy in here and I want to go ahead now and I want to first of all I have to figure
out where is this Timmy password.
So to do that
OK.
All I've done there is actually got free S-sh to save that particular one.
So now I want you to watch this.
So I had to do a lot of research for this old program but I dug and dug and I finally found some documentation
that says all the passwords with the shotgun hash are stored in this little file right here so I could
open this file up and scroll it around here I can see some other user accounts I have on here.
But here's the Timmy account right here.
So that is the actual hash that is storing that password of M I K E.
Now now that I have the hash that's great but I need some tool that I can take this hash value and throw
it in and say Keep running a bunch of hashes until you find one that matches that.
And that process which we call a brute force attack can be done all kinds of different ways.
Now for this one particular example I'm going to use an old program called Cain and Abel Let me show
you that guy.
So this is Cain and Abel but I need to warn you a couple of things about Cain and Abel before we get
started with this.
First of all Cain and Abel is a very very powerful tool but it's very dated.
So even though I'm running a modern Windows system here there's a lot of features of Windows 10 that
really just don't come into play anymore.
The other thing is that anytime we talk about cryptographic tools like this is that they're not instantly
easy to use.
It would be kind of like someone saying Hey let's go ahead make an accounting spreadsheet and I hand
you excel sure it's a good tool but you really have to understand what's going on.
So there's a lot of steps in here that simply because I'm familiar with the tool.
You get to do a little experimentation on yourself.
So here we go.
So we take a look at this and there is a crack or function right here you'll see that and it says what
do you want to crack.
So it's like these are all these different kinds of hashes because that's mainly what we're hatching
in this world.
So I know this is a shy one hash because that's how the Frias as a store stuff.
So here's my shot one hash tool so what I'm going to have to do first of all is go over
and I'm going to grab this hash.
So I'm just doing a regular old copy and now I need to put it into the cracker
and what I've done now is I've inserted this shot one hash into it.
So now let's go ahead and start cracking.
So what we're going to do first off is we're going to do brute force.
We're basically going to say look Cain and Abel I want you to start with the letter A make a Shaolin
hash make a letter B make a short one hash go through all those then do a then do a b then do ab cd
get the idea that this could take a little bit of time.
Well it absolutely does.
So let's watch what happens.
So what we're going to do is a brute force attack.
Now you'll notice that I've got a lot of options here and all of these crackers have some type of tool
like this.
So it's going to say just use lowercase and numbers.
Now for the sake of brevity what I'm going to do here is I'm going to make it even simpler than that
and I'm just going to say just use lower case letters.
Now what I want you to watch right here is the key space.
So right now I'm in the thousands millions billions trillions gazillions.
The number of permutations that would have to go through to do every possible combination just using
the 26 letters of the alphabet as you can see is huge.
But there are a few other things we know and again I'm cheating here folks simply because I know that
the password is very very short.
What I'm going to do here now I want you to watch the keyspace.
I'm going to reduce the possible password length.
So watch what happens that keyspace.
As I keep making the number shorter and shorter.
So one of the reasons why people always say use long passwords as you just saw it right there.
The longer the password the more difficult it is for me to crack it in a brute force scenario.
If you used complicated passwords with upper and lower case numbers and all that stuff it starts going
into the months days years kind of a thing.
So what I've done here is I've got it knocked down to a maximum of eight characters and let's go ahead
and start it and see what happens.
So if you take a look right here it was pretty much instantaneous but you'll see it found the password
is Mike.
So that is one example of brute force.
Now keep in mind one more time with brute force is doing it's literally generating based on the predefined
character set that I set up for it.
I said to start with just the letters of the alphabet and just lowercase and a ground through them so
you can see that it went through just about a trillion iterations and in a very very short amount of
time.
So imagine for a minute let's take a look at this one more time and imagine this time let's say I had
a big complicated password.
So what I want to do now is let's change this.
So let's change it.
So it's going to be lowercase alphabet uppercase alphabet and numbers.
You see that right there.
So I got to reset them here a little bit he still thinks I'm working on the old one here OK.
Now watch the keyspace as I start to bring it up.
You see that I'm already up to exponential notation so that is a really good example of why we use complex
passwords we use complex passwords to make cryptographic attacks harder.
Period.
OK.
So that's one example.
In this particular example what we did is we simply ran a brute force attack.
Now brute force attacks as you can see when things get complicated can become incredibly onerous.
Now this is just a regular middle of the road desktop system if I wanted to I can buy computer systems
or build all myself that use graphics processors and all this extra power and they can calculate a lot
faster.
But it still becomes very very difficult.
So what we want to do is I want to go ahead do an attack but let's make some assumptions.
One of the things we know about people was that I don't think I've ever met anybody who used a password
that was 1 2 x f 9 L ampersand to write what we do as human beings as we tend to use dictionary words.
Mike 47 and Timmy 22 and one Johnny Five and we heard all the O's and two zeros and you know all that
stuff.
Well if we know that we can do another kind of attack called a dictionary attack.
Now a dictionary attack starts by using a text file that is filled with dictionary words.
It will take those dictionary words and then it will manipulate them.
For example if I put the word Mike in the dictionary I could tell the cracker to go don't you just might
but do capital M I K E and then make Mike 1 Mike to Mike 47.
All that type of stuff so a dictionary attack will always always start with a text file that's full
of dictionary words so let's try a dictionary attack.
All right so let's go ahead and grab that hash one more time.
And I'm going to go ahead and plug it in here.
So there's my hash.
Now the whole idea behind a dictionary attack is we have to feed the attacking tool a dictionary so
I have a very simplified one.
If you take a look right here I've made a little file called dictionary.com TXI.
And you can see that I have all of about what nine words in there.
Keep in mind that you can download dictionaries from the internet that have hundreds and hundreds and
hundreds of thousands of different words in there so dictionaries can be massive massive devices.
Again I'm cheating for the sake of brevity.
And so we got that dictionary ready to go.
So let's go ahead and do the dictionary attack so I'm going to go and like dictionary attack this time
and you'll see that I've already pre-selected that text file.
Now this is a pretty handy tool because he always remembers where you left off and I've done attack
before.
He remembers them at the end of the file so I got to go through this little process.
And say go back to the beginning and what I'm going to do is start it and boom you could see he pretty
much almost instantly got the answer.
Now I made this one easy because the password is just four characters and they're all lowercase alphas
So again for brevity it works out real well but let's take a look a little bit more detail here.
You'll notice that you tell these crackers how to deal with the particular type of word.
So for example here's one where it says here if the upper case is a lowercase then do it also upper
case or if the word in the dictionary is all uppercase.
Do it in lower case.
Here I can say Do case permutations.
Now watch if I click that it actually turns a couple of these off because now it's saying change just
the second letter to capitals change the third letter.
However that might be.
And the other one right here at the bottom might be familiar to some of you guys.
Add two numbers to the end so whatever the word is you know.
So if it's my new bike one my to my three Mike for all the way up to Mike Ninety-Nine And I wonder how
many you guys out there set to go.
Yeah the thing would probably crack my password based on that.
So dictionary attacks are fantastic and they speed the process up simply because they take advantage
of the fact that human beings tend to use words they're familiar with as part of their password.
So at the top of every one of these dictionaries is password and one two three and one two three four
so don't even bother with those.
I'll have you hacked in milliseconds.
Literally.
Now both of these methods we've talked about so far brute force and dictionary attacks basically require
the cracking program to generate hashes and compare generate hashes and compare.
So for smaller passwords that can be a relatively good way to do things.
But a lot of people use much more complex passwords and in that case we need to speed up the process
and probably the best way to speed up the process is what's known as a rainbow table.
Now a rainbow table is a pre-generated bunch of hashes.
Now you need to be careful here.
A hash table is nothing more than all these different words with a hash in it.
A rainbow table is kind of like it's almost like an indexed hash table.
If you've ever worked with databases where it will have indexes so that searching can take place a lot
faster.
It uses what's known as a reduction formula to allow these really big files that allow us to look at
a bunch of hashes.
But the important thing is is that a rainbow table already has the hashes in it so it eliminates that
whole part of the process.
So what we're going to do is one more time we're going to go through this process.
Except this time we're going to use a rainbow table now.
I need to warn you about something rainbow tables are massive massive.
Even the smallest rainbow table is going to be in the tens of gigabytes and really serious like work
for a living like trying to crack bad guy passwords types or rainbow tables can be in the terabytes
upon terabytes.
So usually what you end up doing is you go look I need to generate hash is based on just lowercase Alfas.
Go ahead and generate my own rainbow table and that's what I've done in this particular case.
You can download them there are companies that will sell you rainbow tables they will deliver a six
terabytes set a hard drive to your front door filled with massive rainbow tables so rainbow tables are
going to be used when the passwords are more challenging and it's a little bit harder to do.
So let's go ahead and do.
Rainbow tables using Cain and Abel.
So just for fun this time I picked.
There were three users I just grabbed another password just for fun.
So what we're going to do here we're going to Right-Click on this and we're going to go ahead and do
a rainbow table attack here and you'll notice that here's my rainbow table if you take a look over here
this is the actual rainbow table.
And I generated this one myself.
It's a tool set that came with the same guys who make Cain and Abel.
So if you just take a look at for example properties you'll see this when 610 megabytes.
This is literally the smallest rainbow table I could possibly generate so this will see what happens
here a lot of times because I said make a rainbow table based on one and just do lowercase characters
and then generate all this big Super-Duper multiple indexed rainbow tables so let's go ahead and put
it in so we got it loaded up.
I've already selected it.
And what I'm going to do here is hit start cross our fingers Oh didn't work in this particular case.
Now as a good cryptanalysis person that is not that big of a deal for me.
I picked a password that probably had numbers in it or upper and lower case and then these types of
processes I would just go ahead and generate a much more complex rainbow table and just keep trying
it again because that's what takes place in these types of scenarios.
Now I need to warn you about something and that is well I've been lying to you a little bit and I'll
show you what I mean right now.
So what I'm going to do is I'm going to go ahead and add that hash back in now watch really close what
happens.
So I'm just going to hit paste now when I hit OK.
Look at this.
It says the length of the shot one hash must be exactly 20 bytes long each byte is 8 bits a SHA one
hashes 160 bits.
Yes.
Wait a minute Mike you just cut and pasted that hash from that I and I file.
So what's going on.
What's happening here is most good password storage do something to make it a little bit harder.
In this case what we're seeing is this particular tool just adds two characters to the end of the hash
it just kind of arbitrarily puts two characters in.
And if I were to cut and paste that you can see it kind of slows me down from cryptanalysis standpoint.
Now again because I did some research online and because I experimented a little bit I just took the
first 20 characters deleted those last two out put it in and everything ran great.
So what we're trying to do here is the free S-sh tools trying to obfuscate things a little bit.
Now that's an incredibly simplistic way to do it.
What we do tend to see more common is something called assault S-A LTE.
So in a assault situation it kind of goes something like this.
So let's put a a password here so I've got a password of Tibe.
OK.
Now normally we would just hash that and generate a hash value.
But a salt is a value that's an arbitrary value it tends.
There's a lot of ways to solve the one of the ways that you have a fixed value.
Back in the Linux systems you would have a.
When you installed a new Linux system it would all have a thick salt.
We're going to say the salt is some four characters here.
Who cares what it is.
So what we do is we take Tibe and can candidate those four characters at the end.
And then we hash it.
So that's what's known as a salted hash table salted hash tables as you might imagine are a lot harder
to crack a lot harder.
You would be hard pressed with the exception of some old applications like this free as S-sh to find
situations where people do not salt their hashes.
Now again this tool has functions that can deal with it but they take forever and it becomes an unattractive
way to do things.
Now what I want to do now is show you one other situation we run into and I'll bet you've seen this
before yourself.
So what we're going to do now is we're going to take a look at my little home router I've got right
here and what I want to show you is that you'll see that I've got an SS ID right here.
OK.
But I'm going to go to wireless security now.
Wireless security I'm using WPA too personal and I'm going to go ahead and type in a shared key now
this is a kind of a nice little feature on the CD Desch w r t is I can actually show it to you.
So I'm going to type in Fred.
Now the problem we have here is that with wireless we're not going to be passing the word Fred through
our just through the air.
So what we're going to have to do is we're going to go out have to hash that thing.
But a lot of people would be able to hack that Fred fairly easily so one of the things we'd like to
do is type in big long complicated past codes which is one thing that could be helpful but the other
thing we do and this is just one example where we see this all over the place is something called Key
stretchy.
So we're going to go over to Wireshark and let me show you how to do all this stuff.
So what I'm going to do is type in Fred
and then I'm going to type in hopes that are going to type in the GPS as ID
and watch what happens here.
That is really what your personal shared key is on there.
This is one example of what we call key stretching in a key stretching scenario we take you know you
type in your little word or whatever it might be.
But it takes some other values and generates a very very complicated key which can then be passed through
the ether or whatever or hash or whatever.
And it's much much harder for the bad guys to do this.
So if you take a look on the screen you'll see here it says PBK DFI two there are two types of key stretching
that you see a WPA for wireless.
It uses the PBK DFI to algorithm which is a great one.
The other one you'll see a lot is called Big crypt and all these do is take some kind of key and not
just hash it not just solve it.
They stretch it out and they make it very very complicated simply because it's really really hard to
crack these.
In fact proper key stretching is in today's world pretty much uncrackable if you do all this stuff right
in use longer passwords and you use key stretching you can save all your passwords and hashed encrypted
formats on your hard drives and nobody is ever ever going to mess with them.
In.