Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

RSAC 2015: RSA Conference (Day 4)

Steve Ragan | April 24, 2015
Today's the final day for a majority of the action at RSAC. There's plenty happening tomorrow, but the expo halls close today, so most of the crowd will be heading home soon.

Today's the final day for a majority of the action at RSAC. There's plenty happening tomorrow, but the expo halls close today, so most of the crowd will be heading home soon.

Over the last few days, as I walked from meeting to meeting, I noticed the same thing repeatedly — people using a device to access information of some kind. In order to do this, all of them required authentication of some sort, and that means there were passwords involved.

Passwords are a necessary evil in the workplace. True, there's 2FA and biometrics, but the majority of the world protects their data with a single password. The problem is, technology has rendered most passwords useless.

The old advice, 8 characters, with a mix of upper and lower case letters, a number and random character, just doesn't cut it these days when someone can use a GPU and make millions of guesses per second.

So the next step was to create longer passwords, but people can't remember those so they extended an existing password by adding guessable content, such as the current year or a pattern on the keyboard. These days, length doesn't help like it used to. Randomness does, but humans can't do random all that well.

Last week, a researcher from Praetorian Labs discussed how statistics could be used to crack a password, proving that the number of guesses per second is secondary when it comes to protecting or even compromising passwords.

"Throwing away money in attempt to eventually improve the rate of hash generation is not worth the cost. Therefore, implementing a methodology and a streamlined process using statistics and tools as a means of attack can facilitate the cracking of passwords," the report said.

But until everyone starts doing passwords better, the cracking rigs that do large volume guesses will win each time they come into play.

Yesterday, I spent some time with Trustwave. They were running demos of their password cracking tools, which are part of their managed security service. The setup they use is impressive.

The rig has four (soon to be eight) ATI Radeon R9 290x GPUs; 32GB RAM; two six core Intel E5 processors; and a 2TB RAID array. In all, it's able to 47.708 Billion hash guesses per second. They used four dictionaries, each one custom built in-house, with a combined total of 6,316,324,295 entries. All of the password cracking tools and rules they use are commonly available and in a lot of cases open source (e.g. Hashcat, etc.)

The conversation focused on the problems with passwords, and how long, random passwords were better than easily guessed phrases or predictable password policies. For example, I gave them hashed passwords (MD5), which follow some of the more common policies on the Web and in the office. All but one were cracked in less than five minutes.

 

1  2  Next Page 

Sign up for CIO Asia eNewsletters.