Password Recovery (Password Cracking)
Passwords are the key to accessing or securing your operating systems, networks, applications, databases, ATMs, cell phones, etc...
In an effort to avoid memory overload, users choose simple codes that are easy for them to remember. They also often reuse the same passwords with slight variations.This causes a conflict in that users with many passwords want to have ones that are easy to remember, yet system administrators require complex passwords in order to curtail hackers.
If you lose your network password, the system network administrators can retrieve your password or give you a new one according to the Password Policy of the network (company or Internet service providers). But if you lose your access password to your pc, operating system or any password protected data, without a doubt, sometimes this is near impossible to regain. For This purpose many software companies are making different
data recovery software which can be very helpful in solving lost password problems.
A Data Recovery Software can recover the password by scanning your hard drive. For instance, anti-virus software will stop, remove and protect your computer system from virus attacks, and any password recovery software will help you to restore the lost/forgotten passwords of your email id which were stored in your PC.The Operating System stores the hash of the user’s password. Authentication works by hashing the user’s input and comparing the result with the stored hash.Password Cracking works exactly the same way, so every Data Recovery Software works like a password cracking program using different hashing algorithms.
During the user authentication the input password is converted to the hash to compare it with the one stored in the database - if the two match it means the input password is correct and the logging on is successful.
But what if we need to perform the reverse action - to try to restore the password from the hash? It's impossible to do that directly, as any hashing algorithm is the password's checksum calculation. This process involves irreversible mathematical operations like the logical operation AND, etc. For example, even knowing Y and Z we can never find the exact X from the "X AND Y = Z" equation (all we can do is calculate the range of possible X values satisfying the equation).
Thus, if we need to find the password for a certain hash there's the only way to generate hashes for different passwords and then compare the hashes we got get with the source one. If they match, it means exactly the exact source password is found as the possibility of collision (i.e. another password which has the hash matching our source hash) is very low - for example, it is 128 bit in case of MD5-hashing.
What is password cracking?
Password cracking is the process of removing passwords from the data and software programs that have been stored as a measure of security to prevent break-ins into a system, database, program, and even electronic devices, and electronic operating safes. An Operating System stores a hash (hashes can be encoded passwords). Hashes use cryptographic algorithms to create a message digest of the data and present it as a relatively small piece of data. The ‘cracking hash’ is then compared with a hash of the original data (the resulting hashes are put into an indexed collection). A matching hash may mathematically guarantee the file is a file associated with the application regardless of its name.
Matching hashes are accepted as a proof that the data is an exact copy (in this text hashes are encoded passwords). Although it has not been challenged yet, the traditional hashes of CRC, MD5, and SHA1 have been cracked. Also, there are limitations in the sheer volume of 128 bit hashing algorithms such as MD5.
Password cracking methods:
Password guessing
This method is applied until the searched password is found .
This is made easier by:
- Weak passwords (which is the core cause)
- Open authentication points
- Excessive information from server
- Lack of password guessing controls
This method will take a much time and requires a huge amount of network bandwidth. It’s also easily detected and stopped.
Brute force attacks
A brute force attack is an attack on a password, where all possible character combinations are tried. A major advantage of this method is that all passwords will be found. However, this way of attacking a password is very inefficient. It is a good and fast method for cracking short passwords, but if a password is rather long this method will get very slow.
Dictionary attacks
In a dictionary attack all passwords from a specific list are tried. This attack utilizes the characteristic that many people use a word or a word combination as a password. Trying a large number of words can be significantly faster than a brute force attack. The success factor of a dictionary attack depends on the number of the chosen words in the list. Also, the success rate of this method depends highly on the type of the passwords one is trying to crack.
Hybrid attacks
A hybrid attack is a combination of the dictionary attack and the brute force attack. It utilizes a wordlist with some mutations of the entropy. This means that this method will generate new passwords based on the used wordlist, by applying different techniques. The entropy can be altered by appending a symbol or number at the end of a word, or replacing letters with numbers.
Non-software attacks
- keyboard sniffing
- shoulder surfing
-Another technical methods
Hackers way for accessing Computer systems
Wire sniffing
This is a passive attack method of gathering authentication information.
Attacks performed using wire sniffing requires physical access to the network. This is needed to sniff the cable and record raw network traffic.
The attacker has to wait until there are some authentication frames passing by, encrypted or not, before he can attack these credentials.
Man-in-the-middle and replay attacks
This is a method that uses online attacks with a man in the middle, i.e. a replay attack that requires access to the network. This is needed to sniff the cable and record raw network traffic, from which authentication frames can be obtained. With a MiM-attack the attacker has to wait for an authentication sequence so he or she can imitate a proxy. With the acquired information, the proxy can make the connection to the other party involved. This way, the proxy can record all information that passes him.