Download Lists That Contain Weak Passwords and Previously Breached Passwords and to Attack Offline Password Hashes
Total Page：16
File Type：pdf, Size：1020Kb
An investigation of the security of passwords derived from African languages Submitted in partial fulfilment for the requirements of the degree of Master of Science of Rhodes University Sibusiso Sishi Grahamstown, South Africa March 2019 i Abstract Password authentication has become ubiquitous in the cyber age. To-date, there have been several studies on country based passwords by authors who studied, amongst others, English, Finnish, Italian and Chinese based passwords. However, there has been a lack of focused study on the type of passwords that are being created in Africa and whether there are benefits in creating passwords in an African language. For this research, password databases containing LAN Manager (LM) and NT LAN Man- ager (NTLM) hashes extracted from South African organisations in a variety of sectors in the economy, were obtained to gain an understanding of user behaviour in creating passwords. Analysis of the passwords obtained from these hashes (using several cracking methods) showed that many organisational passwords are based on the English language. This is understandable considering that the business language in South Africa is English even though South Africa has 11 official languages. African language based passwords were derived from known English weak passwords and some of the passwords were appended with numbers and special characters. The African based passwords created using eight Southern African languages were then uploaded to the Internet to test the security around using passwords based on African languages. Since most of the passwords were able to be cracked by third party researchers, we conclude that any password that is derived from known weak English words marked no improvement in the security of a password written in an African language, especially the more widely spoken languages, namely, isiZulu, isiXhosa and Setswana. ii Acknowledgement I would like to thank my supervisor Professor K. Bradshaw for all the help and guidance with this research paper and to my family for being the foundation. iii ACM Computing Classification System Classification • Security and privacy ~ Authentication • Security and privacy ~ Multi-factor authentication • Security and privacy ~ Usability in security and privacy Glossary AD Active Directory.3,6,8, 21, 22, 23, 24, 25, 30, 39, 43, 44, 58, 74 API Application Programming Interface. 23 ASCII American Standard Code for Information Interchange.9, 10 CIS Center for Internet Security.8,9, 10, 13, 29, 58 CPU Central Processing Unit. 35 CSV Comma-Separated Values. 42, 49 DES Data Encryption Standard. 24, 25, 51 DSA Directory System Agent. 23 ESE Extensible Storage Engine. 21, 23 GPU Graphics Processing Unit.3, 35, 36 IT information technology.1,6, 11, 13, 15, 16 LDAP Lightweight Directory Access Protocol. 22, 23, 24 LM LAN Manager. viii,x, xii,4, 24, 25, 30, 31, 32, 35, 36, 37, 38, 39, 40, 42, 43, 44, 45, 44, 45, 46, 47, 48, 49, 50, 51, 74 MD4 Message Digest 4. 25 NIST National Institute of Standards and Technology.3,9, 10, 13, 14, 29, 58, 74 NTLM NT LAN Manager. viii,x, xii,3,4,8, 24, 25, 30, 31, 32, 35, 36, 37, 38, 39, 40, 41, 42, 45, 47, 48, 49, 50, 51, 58, 68, 70 iv Glossary v SASL Simple Authentication and Security Layer. 24 SHA1 Secure Hash Algorithm 1. 17 SID Security ID. 38, 42 SMS Short Message Service. 10 SSL Secure Sockets Layer. 24 TLS Transport Layer Security. 24 Contents Glossary iv List of Figures xi List of Tables xiii 1 Introduction1 1.1 Context of the research.............................1 1.2 Research statement...............................2 1.3 Research objectives...............................3 1.4 Approach....................................3 1.5 Limitations...................................4 1.6 Document structure...............................4 2 Literature review6 2.1 Overview of passwords.............................6 2.2 Organisational password policy........................7 2.2.1 Typical South African password policies............... 10 2.2.2 Password policy concerns........................ 14 vi CONTENTS vii 2.2.3 Selection of passwords......................... 15 2.3 Password attack methods............................ 16 2.3.1 Attacks using dictionaries....................... 17 2.3.2 Brute-force attacks........................... 17 2.3.3 Attacks using rainbow tables...................... 18 2.3.4 Attacks using part-of-speech tagging................. 18 2.3.5 Keyboard walking............................ 19 2.4 Microsoft active directory database...................... 21 2.4.1 Password storage............................ 23 2.4.2 Windows password hashing algorithms................ 24 2.5 Analysis of Chinese regional breached passwords............... 26 2.6 Summary.................................... 29 3 Research design 31 3.1 High-level overview of research......................... 31 3.2 Password databases............................... 32 3.3 Breached password lists............................ 33 3.3.1 HaveIbeenPwned............................ 33 3.3.2 Breachcompilation........................... 33 3.3.3 Weakpass_2a.............................. 33 3.4 Rules used.................................... 34 3.5 Creating African language derived passwords................. 34 3.6 Hardware/software configuration....................... 36 3.7 Hashcat attack modes............................. 36 3.8 Summary.................................... 37 CONTENTS viii 4 Analysis of LM and NTLM hashes 38 4.1 Extraction software............................... 38 4.2 Extraction of hashes.............................. 41 4.3 LAN Manager (LM) hashes.......................... 43 4.4 NT LAN Manager (NTLM) hashes...................... 46 4.5LM hash attack................................. 47 4.6 NTLM hash attack............................... 48 4.7 Characters forLM and NTLM hashes..................... 49 4.8 Summary.................................... 50 5 Analysis and discussion of organisational passwords 51 5.1 Cracked passwords............................... 51 5.2 Top ten passwords............................... 52 5.3 Top ten base words............................... 52 5.4 Keyboard walking patterns........................... 55 5.5 Password length analysis............................ 58 5.6 Analysis of digits used............................. 60 5.7 Use of characters in passwords......................... 61 5.8 Letter frequency analysis............................ 62 5.9 Character set usage............................... 64 5.10 Summary.................................... 65 CONTENTS ix 6 Generating and analysing passwords using African languages 66 6.1 Creation of African language passwords.................... 66 6.2 Further processing of passwords generated.................. 69 6.3 Analysis of African derived passwords..................... 70 6.3.1 African language base words found.................. 71 6.3.2 Passwords found............................ 72 6.4 Summary.................................... 73 7 Conclusion and future work 74 7.1 Summary.................................... 74 7.2 Future work................................... 75 List of Figures 2.1 Password examples taken from CapeNature(2007).............. 13 2.2 Example of keyboard walking......................... 20 2.3 Second example of keyboard walking..................... 20 2.4 Third example of keyboard walking...................... 20 2.5 Square keyboard walking............................ 20 2.6 Directional keyboard walking......................... 21 2.7 Rectanglular east and west pattern...................... 21 2.8 Physical components of the Data store taken from Microsoft(2014).... 22 2.9 Data store architecture taken from Microsoft(2014)............. 23 2.10LM hash creation from Johansson(n.d.)................... 25 2.11 NTLM hash creation from Johansson(n.d.)................. 26 2.12 Top weak Chinese and English characters obtained from Li et al. (2014).. 27 4.1 Extract of Impacket’s secretsdump...................... 38 4.2 NTDS.dit, SYSTEM and SECURITY extraction using NTDSUtil ..... 40 4.3 NTDS.dit and SYSTEM extraction using Vssadmin ............. 41 4.4LM hash treemap top 100........................... 44 x LIST OF FIGURES xi 4.5LM hash top ten................................ 45 4.6 NTLM hash top 20............................... 46 5.1 Cracking passwords using keyboard walking................. 56 5.2 Keypad walking patterns used......................... 57 5.3 Top 20 character counts in cracked password list............... 61 5.4 Top 20 character heatmap where darker colours show higher frequency of use 62 5.5 English letter frequency............................ 63 5.6 Cracked password letter frequency....................... 63 6.1 Venda special characters............................ 66 List of Tables 2.1 Li et al. (2014) leaked password datasets................... 26 2.2 Top weak Chinese and English passwords obtained from Li et al. (2014).. 27 2.3 Top five Chinese Pinyins and English words obtained from Li et al. (2014) 28 2.4 Eight character date formats used obtained from Li et al. (2014)...... 29 2.5 Six character dates used obtained from Li et al. (2014)........... 29 3.1 Hardware used to extract and analyse the NTLM andLM hashes..... 36 3.2 Software used to obtain clear text passwords................. 36 4.1 Hashes collected................................. 42 4.2 Count of least frequently appearingLM hashes................ 45 4.3 Count of least frequently appearing NTLM hashes.............. 47 4.4 NTLM passwords found using wordlists and rules.............. 48