Applied Cryptography: Password Crackers

The process of recovering scrambled passwords. It can be used to help a user get back a forgotten password or to help a system administrator check for weak passwords

01 Introduction

What are password crackers and what are they used for?

According to the Oxford Dictionary “password is a secret word or phrase that must be used to gain admission to something”. Passwords are meant to be unique to you and not shared, which means with your passwords, you can have access to your contents/resources physically or digitally without it being altered by anyone other than you. But sometimes that’s not the case, adversaries are always on the lookout for how to gain unauthorized access for different reasons. If a compromised account has any form of privilege, the adversary can easily penetrate the system or network without being noticed.

Most passwords are stored in hashes which are irreversible, but due to the weakness of most passwords, adversaries have found various ways and tools to crack these passwords stored in hashes to gain unauthorized access.

Password cracking (also called password hacking) is an attack vector that involves hackers attempting to crack or determine a password for unauthorized authentication. Most threat actors have the time, tools, techniques, and resources needed to crack down on weak passwords.

02 Types of Passwords Attacks

There are various types of password attacks which include:

Password guessing- simply means a technique where the attacker keeps guessing different passwords until access is granted.

Dictionary attack - In its simplest form, a dictionary attack is a type of brute force attack where hackers try to guess a user’s password to their online accounts by quickly running through a list of commonly used words, phrases, and number combinations

Password Spraying – This is when an attack tries the same password on multiple accounts to gain access

Credential stuffing - Credential stuffing is a cyber-attack in which credentials obtained from a data breach on one service are used to attempt to log in to another unrelated service. (Cloudflare)

Man-in-the-middle – This is an attack where the attacker secretly hides between network communication between 2 parties unknown to them and steals data which may contain passwords

Keylogger - A keylogger or keystroke logger/keyboard capturing is a form of malware or hardware that keeps track of and records your keystrokes as you type. It takes the information and sends it to a hacker using a command-and-control (C&C) server.

Shoulder surfing: This is simply looking over one's shoulder when they are typing in their credentials and trying to steal the information

Pass the Hash attack: is a technique where an attacker captures a password hash (as opposed to the password characters) and then passes it through for authentication and lateral access to other networked systems