Hacking

Ethical hacking: How to crack long passwords

Introduction

They serve as the keys to your financial, social and entertainment worlds online and they are one of the most commonly used tools to verify your identity, but, for the most part, passwords remain relatively easy for hackers to crack. In fact, according to one survey, the average user has at least 27 discrete online passwords that they need to remember, meaning that most users keep their passwords simple, similar to one another and memorable. Fortunately, as an ethical hacker, you may only need to crack just one to get where you need to go.

However, as cyberhygiene increases, password requirements get more complex and cybersecurity awareness training continues to become a regular part of employee training, white-hat hackers will soon find themselves increasingly facing longer, more complex passwords as they perform their craft. 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

But, as the saying goes, when there is a will, there is a way. In this article, we will cover the tools and techniques available to help crack or get around longer passwords. You, however, will have to supply the will.

When traditional tools fall short

While Microsoft requires passwords to meet certain complexity requirements, such as a minimum password length of at least eight characters, Google also recommends passwords be at least 8 characters long. 

Although these are just two large players in the industry, it represents a larger trend where users are moving to larger, more complex passwords. Of course, this is occurring because companies know that hackers can use automated tools to break anything with seven characters or less. However, as more characters are added combined with more complex characters, it could easily take a century for these same tools to crack them. In fact, it exponentially grows as more characters are added:

• 5 characters = 10 seconds
• 6 characters = 1,000 seconds
• 7 characters = 1 day
• 8 characters = 115 days
• 9 characters = 31 years
• 10 characters = 3,000 years

Obviously, other factors such as complexity and unpredictability play a role in determining a password’s strength. But the length of the password can be the biggest hurdle for hackers to overcome.

Additionally, the method used to attempt to crack the password can also have an impact on the success rate. For example, for rainbow table and dictionary attacks (where pre-computed passwords, hashes or wordlists are compared against user passwords) to work, the target’s password has to be in the database. If it isn’t, it will not be able to be cracked. And, as seen above, brute force can easily take an almost inconceivable amount of time to break a password.

Attempting to crack longer passwords

Once passwords move beyond seven characters, they can be characterized as being long, with many of the common tools not strong enough to cope with the number of variables on their own. When this is the case, attackers need to begin to make assumptions about the target password and add them to the tools used. For example, a dictionary attack can be supported with knowledge of common words, phases, digits, dates, names or other potential characters of interest to the target. 

If this does not work, password cracking tools like John the Ripper, Ophcrack and Cain & Abel can be tuned to crack the hashes generated by well-known systems. For example, instead of using wordlists, John the Ripper can be formatted to use Windows NT or LAN Manager hashes of the passwords. While this can take multiple iterations, if an attacker is able to gain access to a domain, dump all of the users on a domain and run John the Ripper over several iterations along with some data clean-up, they can eventually reveal access to a workable password. 

Other tools, namely L0phtCrack, are designed specifically to attempt to crack Windows password hashes.  While this may not be a hacker’s original target or goal, finding the weakest of all of the available targets could enable an attacker to find an alternate way in.

Finally, password cracking can also vary by the type of system targeted. For example, tools like THC Hydra were created to crack network log-on passwords, including a range of protocols from Cisco, HTTP and VMware, while Brutus focuses on POP2, FTP, SMB and Telnet services.

Find another way

As you have seen, brute-forcing long passwords with common tools, techniques and computing resources is not a feasible or reliable technique. Fortunately, an attacker has other avenues to explore when it comes to getting access to a system. In other words, does an attacker actually have to crack a password, or just get around the prompt? 

If it’s the latter, then an attacker has several options. The first is social engineering, which as the 2019 Verizon Data Breach Investigations Report suggests, is a very common and fruitful method of hackers. In particular, of the 2,013 data breaches analyzed in the Verizon study, phishing was involved in 32 percent of breaches and 78 percent of cyber-espionage incidents. A well-placed phishing or spearphishing email or a very patient attacker can often use human error as a way to collect the credentials that they need. 

A second, more complex method is collecting a physical image of the target machine. However, this required physical access to a victim’s computer or laptop. One approach involves using launching a computer with a bootable thumb drive, such as the very fast Arch Linux. From here, using one of a variety of vulnerabilities, an attacker can obtain access to the Windows image of the device and copy specific files or the entire directory, depending on their goals and the amount of time that they have. While this is designed to help recover access to a computer legally and legitimately, it can also be used by attackers.

Conclusion

As with many other facets of a cyberattack, hackers must be comfortable with using a wide range of tools and techniques against their targets’ digital and human vulnerabilities. However, as password requirements cause users to generate longer, more complex passwords, hackers will have to evaluate if the cost of cracking a password is really worth the benefit — especially when less technical or other system or program-based attacks could be more fruitful.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

 

Sources

1. Survey Says: People Have Way Too Many Passwords To Remember, BuzzFeed News
2. Password must meet complexity requirements, Microsoft Docs
3. Create a strong password & a more secure account, Google Account Help
4. 2019 Data Breach Investigations Report, Verizon
5. John the Ripper password cracker, Openwall
6. Download Cain & Abel, Softpedia