102 lines
6.0 KiB
Plaintext
102 lines
6.0 KiB
Plaintext
H-NET H-NET H-NET H-NET H-NET H-NET H-NET H
|
||
N N
|
||
E ** H-Net Magazine ** E
|
||
T T
|
||
H Volume One, Issue 1, File #09 of 20 H
|
||
N N
|
||
E How to Crack Those PASSWORDS! E
|
||
T T
|
||
H-NET H-NET H-NET H-NET H-NET H-NET H-NET H
|
||
|
||
THE SO-CALLED "UNCRACKABLE" PASSWORD
|
||
--------------------------------------
|
||
|
||
Many people consider the type of password - the so- called random combination
|
||
of alpha and numeric characters - to be "uncrackable" because so many billions
|
||
of combinations seem possible. A six-character password of this type using
|
||
only letters and numerals, could have 2,238,976,116 variations. This type of
|
||
password is most frequently used by large data-base vendors. It is assigned
|
||
to the user by the vendor, and is often used with systems requiring only one
|
||
access level (that is, no second security number) because the password is
|
||
believed to be so invulnerable to cracking.
|
||
|
||
In reality, however, this password format is vulnerable to solution by both
|
||
doors and algorithms. In the first case, not all passwords require the presence
|
||
of numbers. Passwords may be alphabetic characters only. In some cases pass-
|
||
words such as "GUEST" or "IBMCE" may provide a backdoor into the system.
|
||
|
||
Solution by algorithmcan also be simple because most systems do not use a truly
|
||
random method for generating passwords. We know, for example, that MILNET
|
||
passwords exclude certain letters and numbers. There are doubtlessly other
|
||
rules involved in their construction that we could discover. A study of pass-
|
||
words from a given system - we'll use Dow Jones as an example here - can
|
||
reveal the patterns that are used to create such "uncrackable" passwords.
|
||
|
||
Dow Jones passwords are generally 10 characters long. If character assignment
|
||
were truly random, we would expect that most of the characters would be alpha-
|
||
betic because there are 26 alpha characters compared to only 10 numeric char-
|
||
acters. A random system would generate 2.6 alphas for each numeric character.
|
||
In fact, however, Dow Jones passwords appear to have only 4 or 5 alphabetic and
|
||
have 5 or 6 numeric characters. This is our first clue that the password sel-
|
||
ection proccess is not random. Here is a sample of the typical Dow Jones
|
||
passwords:
|
||
|
||
92J62P4BUF
|
||
35K4UPK931
|
||
59LTAN7521
|
||
|
||
Patterns are readily discernable:
|
||
|
||
1) The first two characters are numbers
|
||
2) The third character is a letter of the alphabet
|
||
3) Each password has at least two numbers that are duplicates.
|
||
4) No password has three numbers that are the same
|
||
5) Each password has one three-letter combination that includes a vowel
|
||
(eg. BUF,UPK,TAN)
|
||
6) This alpha-triplet can begin at any character from the fourth to the eighth
|
||
position.
|
||
7) No password has more than one vowel.
|
||
8) Passwords may have either 4 or 5 alphabetic characters.
|
||
9) While a password may have two alpha characters that are the same,these
|
||
letters do not follow one another,
|
||
10) Of the 16 numbers used in the passwords above, none is a zero.
|
||
|
||
Examination of a large number of passwords would doubtlessly reveal other
|
||
"rules" that were used in Dow Jones password selection. Each newly-discovered
|
||
"rule" would limit the actual number of available passwords and make the system
|
||
that much more subject to cracking by computer.
|
||
|
||
TAKING THE "RANDOM" OUT OF RANDOM
|
||
|
||
One of the most notable factors in so-called tables of computerized "random"
|
||
numbers is that there are two basic ways of creating them. The first method is
|
||
to create a table that will provide what can statistically be said to be a
|
||
random list - that is no number or letter would theoretically occur more
|
||
frequently than any other number or letter. Most systems, however, simply rely
|
||
on an electronic component that creates alledgedly "random" numbers. These
|
||
hardware random number generators are usually biased in their number selections
|
||
|
||
One simple test of a random number generator is called the "coin toss test." A
|
||
program is written to simulate the results of a thousand or so coin tosses.
|
||
Were the random number generator truly random, heads would appear about as
|
||
frequently as tails. In an actual test, however, heads appeared 421 times, and
|
||
tails appeared 579 times - a significant bias. A test such as this could be
|
||
performed over the entire alphanumeric character list and the component's bias
|
||
chartered. Once this information was known, the cracking computer could be
|
||
programmed to insert this selection bias into it's own attempts to generate
|
||
passwords. This is yet another step that evens the odds between the hacker and
|
||
the so-called "uncrackable" password. This testing scheme, requiring either a
|
||
component or a computer like the target computer, would be a lengthy process,
|
||
but some people might regard the product as worth the time involved in
|
||
preparing such an analysis. A strategy of cracking Dow Jones system, given the
|
||
rules listed above, would be to create a program with an algorithm that
|
||
provided combinations of passwords meeting the criteria above. As each
|
||
creation was tested, a pattern might be found in the successful creations that
|
||
would make the algorithm even more selective. One would expect, for example,
|
||
that simular to the MILNET and ARPANET passwords, certain confusing characters
|
||
would be eliminated from passwords. The number, "0" is often eliminated, for
|
||
example, because it is easily confused with the letter "O".
|
||
|
||
===============================================================================
|
||
[Hackernet BBS,LEEDS,UK(0532)557739, 24hrs. Home of H-Net Hacking magazine]
|
||
|