The Experts below are selected from a list of 708 Experts worldwide ranked by ideXlab platform
Ingrid Verbauwhede - One of the best experts on this subject based on the ideXlab platform.
-
ARC - Time-Memory Trade-Off Attack on FPGA Platforms: UNIX Password Cracking
Reconfigurable Computing: Architectures and Applications, 2006Co-Authors: Nele Mentens, Lejla Batina, Bart Preneel, Ingrid VerbauwhedeAbstract:This paper presents a hardware architecture for UNIX Password Cracking using Hellman’s time-memory trade-off; it is the first hardware design for a key search machine based on the rainbow variant proposed by Oechslin. The implementation target is the Berkeley BEE2 FPGA platform which can run at 400 million Password calculations/second. Our design targets Passwords of length 48 bits (out of 56). This means that with one BEE2 module the precomputation for one salt takes about 8 days, resulting in a storage of 56 Gigabyte. For the precomputation of all salts in one year we would need 92 BEE2 modules. Recovering an individual Password requires a few minutes on a Virtex-4 FPGA.
-
time memory trade off attack on fpga platforms unix Password Cracking
Lecture Notes in Computer Science, 2006Co-Authors: Nele Mentens, Lejla Batina, Bart Preneel, Ingrid VerbauwhedeAbstract:This paper presents a hardware architecture for UNIX Password Cracking using Hellman's time-memory trade-off; it is the first hardware design for a key search machine based on the rainbow variant proposed by Oechslin. The implementation target is the Berkeley BEE2 FPGA platform which can run at 400 million Password calculations/second. Our design targets Passwords of length 48 bits (out of 56). This means that with one BEE2 module the precomputation for one salt takes about 8 days, resulting in a storage of 56 Gigabyte. For the precomputation of all salts in one year we would need 92 BEE2 modules. Recovering an individual Password requires a few minutes on a Virtex-4 FPGA.
Sudhir Aggarwal - One of the best experts on this subject based on the ideXlab platform.
-
new technologies in Password Cracking techniques
2018Co-Authors: Sudhir Aggarwal, Shiva Houshmand, Matt WeirAbstract:At its heart, a Password Cracking attack is a modeling problem. An attacker makes guesses about a user’s Password until they guess correctly or they give up. While the defender may limit the number of guesses an attacker is allowed, a Password’s strength often depends on how hard it is for an attacker to model and reproduce the way in which a user created their Password. If humans were effective at practicing unique habits or generating and remembering random values, Cracking Passwords would be a near impossible task. That is not the case, though. A vast majority of people still follow common patterns, from capitalizing the first letter of their Password to putting numbers at the end. While people have remained mostly the same, the Password security field has undergone major changes in an ongoing arms race between the attackers and defenders. The goal of this chapter is to highlight the current state of Password Cracking techniques, as well as discuss some of the cutting edge approaches that may become more prevalent in the near future.
-
IFIP Int. Conf. Digital Forensics - Using Personal Information in Targeted Grammar-Based Probabilistic Password Attacks
Advances in Digital Forensics XIII, 2017Co-Authors: Shiva Houshmand, Sudhir AggarwalAbstract:Passwords are the primary means of authentication and security for online accounts and are commonly used to encrypt files and disks. This research demonstrates how personal information about users can be added systematically to enhance Password Cracking. Specifically, a dictionary-based probabilistic context-free grammar approach is proposed that effectively incorporates personal information about a targeted user into component grammars and dictionaries used for Password Cracking. The component grammars model various types of personal information such as family names and dates, previous Password information and possible information about sequential Passwords. A mathematical model for merging multiple grammars that combines the characteristics of the component grammars is presented. The resulting merged target grammar, which is also merged with a standard grammar, is used along with various dictionaries to generate guesses that quickly match target Passwords. The experimental results demonstrate that the approach significantly improves Password Cracking performance.
-
next gen pcfg Password Cracking
IEEE Transactions on Information Forensics and Security, 2015Co-Authors: Shiva Houshmand, Sudhir Aggarwal, Randy FloodAbstract:Passwords continue to remain an important authentication technique. The probabilistic context-free grammar-based Password Cracking system of Weir et al. was an important addition to dictionary-based Password Cracking approaches. In this paper, we show how to substantially improve upon this system by systematically adding keyboard patterns and multiword patterns (two or more words in the alphabetic part of a Password) to the context-free grammars used in the probabilistic Password Cracking. Our results on Cracking multiple data sets show that by learning these new classes of patterns, we can achieve up to 22% improvement over the original system. In this paper, we also define metrics to help analyze and improve attack dictionaries. Using our approach to improving the dictionary, we achieve an additional improvement of $\sim 33$ % by increasing the coverage of a standard attack dictionary. Combining both approaches, we can achieve a 55% improvement over the previous system. Our tests were done over fairly long Password guessing sessions (up to 85 billion) and thus show the uniform effectiveness of our techniques for long Cracking sessions.
-
Password Cracking using probabilistic context free grammars
IEEE Symposium on Security and Privacy, 2009Co-Authors: Matt Weir, Sudhir Aggarwal, Breno De Medeiros, Bill GlodekAbstract:Choosing the most effective word-mangling rules to use when performing a dictionary-based Password Cracking attack can be a difficult task. In this paper we discuss a new method that generates Password structures in highest probability order. We first automatically create a probabilistic context-free grammar based upon a training set of previously disclosed Passwords. This grammar then allows us to generate word-mangling rules, and from them, Password guesses to be used in Password Cracking. We will also show that this approach seems to provide a more effective way to crack Passwords as compared to traditional methods by testing our tools and techniques on real Password sets. In one series of experiments, training on a set of disclosed Passwords, our approach was able to crack 28% to 129% more Passwords than John the Ripper, a publicly available standard Password Cracking program.
-
IEEE Symposium on Security and Privacy - Password Cracking Using Probabilistic Context-Free Grammars
2009 30th IEEE Symposium on Security and Privacy, 2009Co-Authors: Matt Weir, Sudhir Aggarwal, Breno De Medeiros, Bill GlodekAbstract:Choosing the most effective word-mangling rules to use when performing a dictionary-based Password Cracking attack can be a difficult task. In this paper we discuss a new method that generates Password structures in highest probability order. We first automatically create a probabilistic context-free grammar based upon a training set of previously disclosed Passwords. This grammar then allows us to generate word-mangling rules, and from them, Password guesses to be used in Password Cracking. We will also show that this approach seems to provide a more effective way to crack Passwords as compared to traditional methods by testing our tools and techniques on real Password sets. In one series of experiments, training on a set of disclosed Passwords, our approach was able to crack 28% to 129% more Passwords than John the Ripper, a publicly available standard Password Cracking program.
Nele Mentens - One of the best experts on this subject based on the ideXlab platform.
-
ARC - Time-Memory Trade-Off Attack on FPGA Platforms: UNIX Password Cracking
Reconfigurable Computing: Architectures and Applications, 2006Co-Authors: Nele Mentens, Lejla Batina, Bart Preneel, Ingrid VerbauwhedeAbstract:This paper presents a hardware architecture for UNIX Password Cracking using Hellman’s time-memory trade-off; it is the first hardware design for a key search machine based on the rainbow variant proposed by Oechslin. The implementation target is the Berkeley BEE2 FPGA platform which can run at 400 million Password calculations/second. Our design targets Passwords of length 48 bits (out of 56). This means that with one BEE2 module the precomputation for one salt takes about 8 days, resulting in a storage of 56 Gigabyte. For the precomputation of all salts in one year we would need 92 BEE2 modules. Recovering an individual Password requires a few minutes on a Virtex-4 FPGA.
-
time memory trade off attack on fpga platforms unix Password Cracking
Lecture Notes in Computer Science, 2006Co-Authors: Nele Mentens, Lejla Batina, Bart Preneel, Ingrid VerbauwhedeAbstract:This paper presents a hardware architecture for UNIX Password Cracking using Hellman's time-memory trade-off; it is the first hardware design for a key search machine based on the rainbow variant proposed by Oechslin. The implementation target is the Berkeley BEE2 FPGA platform which can run at 400 million Password calculations/second. Our design targets Passwords of length 48 bits (out of 56). This means that with one BEE2 module the precomputation for one salt takes about 8 days, resulting in a storage of 56 Gigabyte. For the precomputation of all salts in one year we would need 92 BEE2 modules. Recovering an individual Password requires a few minutes on a Virtex-4 FPGA.
Shiva Houshmand - One of the best experts on this subject based on the ideXlab platform.
-
new technologies in Password Cracking techniques
2018Co-Authors: Sudhir Aggarwal, Shiva Houshmand, Matt WeirAbstract:At its heart, a Password Cracking attack is a modeling problem. An attacker makes guesses about a user’s Password until they guess correctly or they give up. While the defender may limit the number of guesses an attacker is allowed, a Password’s strength often depends on how hard it is for an attacker to model and reproduce the way in which a user created their Password. If humans were effective at practicing unique habits or generating and remembering random values, Cracking Passwords would be a near impossible task. That is not the case, though. A vast majority of people still follow common patterns, from capitalizing the first letter of their Password to putting numbers at the end. While people have remained mostly the same, the Password security field has undergone major changes in an ongoing arms race between the attackers and defenders. The goal of this chapter is to highlight the current state of Password Cracking techniques, as well as discuss some of the cutting edge approaches that may become more prevalent in the near future.
-
IFIP Int. Conf. Digital Forensics - Using Personal Information in Targeted Grammar-Based Probabilistic Password Attacks
Advances in Digital Forensics XIII, 2017Co-Authors: Shiva Houshmand, Sudhir AggarwalAbstract:Passwords are the primary means of authentication and security for online accounts and are commonly used to encrypt files and disks. This research demonstrates how personal information about users can be added systematically to enhance Password Cracking. Specifically, a dictionary-based probabilistic context-free grammar approach is proposed that effectively incorporates personal information about a targeted user into component grammars and dictionaries used for Password Cracking. The component grammars model various types of personal information such as family names and dates, previous Password information and possible information about sequential Passwords. A mathematical model for merging multiple grammars that combines the characteristics of the component grammars is presented. The resulting merged target grammar, which is also merged with a standard grammar, is used along with various dictionaries to generate guesses that quickly match target Passwords. The experimental results demonstrate that the approach significantly improves Password Cracking performance.
-
next gen pcfg Password Cracking
IEEE Transactions on Information Forensics and Security, 2015Co-Authors: Shiva Houshmand, Sudhir Aggarwal, Randy FloodAbstract:Passwords continue to remain an important authentication technique. The probabilistic context-free grammar-based Password Cracking system of Weir et al. was an important addition to dictionary-based Password Cracking approaches. In this paper, we show how to substantially improve upon this system by systematically adding keyboard patterns and multiword patterns (two or more words in the alphabetic part of a Password) to the context-free grammars used in the probabilistic Password Cracking. Our results on Cracking multiple data sets show that by learning these new classes of patterns, we can achieve up to 22% improvement over the original system. In this paper, we also define metrics to help analyze and improve attack dictionaries. Using our approach to improving the dictionary, we achieve an additional improvement of $\sim 33$ % by increasing the coverage of a standard attack dictionary. Combining both approaches, we can achieve a 55% improvement over the previous system. Our tests were done over fairly long Password guessing sessions (up to 85 billion) and thus show the uniform effectiveness of our techniques for long Cracking sessions.
Matt Weir - One of the best experts on this subject based on the ideXlab platform.
-
new technologies in Password Cracking techniques
2018Co-Authors: Sudhir Aggarwal, Shiva Houshmand, Matt WeirAbstract:At its heart, a Password Cracking attack is a modeling problem. An attacker makes guesses about a user’s Password until they guess correctly or they give up. While the defender may limit the number of guesses an attacker is allowed, a Password’s strength often depends on how hard it is for an attacker to model and reproduce the way in which a user created their Password. If humans were effective at practicing unique habits or generating and remembering random values, Cracking Passwords would be a near impossible task. That is not the case, though. A vast majority of people still follow common patterns, from capitalizing the first letter of their Password to putting numbers at the end. While people have remained mostly the same, the Password security field has undergone major changes in an ongoing arms race between the attackers and defenders. The goal of this chapter is to highlight the current state of Password Cracking techniques, as well as discuss some of the cutting edge approaches that may become more prevalent in the near future.
-
Password Cracking using probabilistic context free grammars
IEEE Symposium on Security and Privacy, 2009Co-Authors: Matt Weir, Sudhir Aggarwal, Breno De Medeiros, Bill GlodekAbstract:Choosing the most effective word-mangling rules to use when performing a dictionary-based Password Cracking attack can be a difficult task. In this paper we discuss a new method that generates Password structures in highest probability order. We first automatically create a probabilistic context-free grammar based upon a training set of previously disclosed Passwords. This grammar then allows us to generate word-mangling rules, and from them, Password guesses to be used in Password Cracking. We will also show that this approach seems to provide a more effective way to crack Passwords as compared to traditional methods by testing our tools and techniques on real Password sets. In one series of experiments, training on a set of disclosed Passwords, our approach was able to crack 28% to 129% more Passwords than John the Ripper, a publicly available standard Password Cracking program.
-
IEEE Symposium on Security and Privacy - Password Cracking Using Probabilistic Context-Free Grammars
2009 30th IEEE Symposium on Security and Privacy, 2009Co-Authors: Matt Weir, Sudhir Aggarwal, Breno De Medeiros, Bill GlodekAbstract:Choosing the most effective word-mangling rules to use when performing a dictionary-based Password Cracking attack can be a difficult task. In this paper we discuss a new method that generates Password structures in highest probability order. We first automatically create a probabilistic context-free grammar based upon a training set of previously disclosed Passwords. This grammar then allows us to generate word-mangling rules, and from them, Password guesses to be used in Password Cracking. We will also show that this approach seems to provide a more effective way to crack Passwords as compared to traditional methods by testing our tools and techniques on real Password sets. In one series of experiments, training on a set of disclosed Passwords, our approach was able to crack 28% to 129% more Passwords than John the Ripper, a publicly available standard Password Cracking program.