by Laura S.

Created on: November 18, 2008

The easiest way into a computer is usually through the front door, which is to say, the login command. On nearly all systems, a successful login is based on supplying the correct password within a reasonable number of tries.

The history of the generic login program is a series of escalated attacks and defenses: a typical arms race. We can name early systems that stored passwords in the clear in a file. One system's security was based on the secrecy of the name of that password file: it was readable by any who knew its name. The system's security was "protected" by ensuring that the system's directory command would not list the filename.

This approach relied on security by obscurity. Obscurity is not a bad security tool, though it has received a bad reputation in this regard. After all, what is a cryptographic key but a small well-designed piece of obscurity. The failure here was the weakness of the obscurity, and the lack of other layers in the defenses.

System bugs are an exciting way to crack a system, but they are not the easiest way to attack. That honor is reserved for a rather mundane feature: user password. A high percentage of system penetrations occur because of the failure of the entire password system.

We write "password system" because there are several causes of failure. However, the most common problem is that people tend to pick very bad passwords. Repeated studies have shown that password guessing is likely to succeed. I'm not saying that everyone will pick a poor password, but an attacker usually needs only one bad choice.

Password-guessing attacks take two basic forms. The first involves attempts to log in using known or assumed usernames and likely guesses at password. This succeeds amazingly often; sites often have account-password pairs such as field services, guest-guest, etc. These pairs often come out of system manuals! The first try may not succeed, nor even the tenth, but all too often, one will work-and once the attacker is in, your major line of defense is gone. Regrettably, few operating systems can resist attacks from the inside.

This approach should not be possible! Users should not be allowed an infinite number of login attempts with bad password, failures, should be logged, users should be notified of failed login attempts on their accounts , and so on. None of this is new technology, but these things are seldom done, and even more seldom done correctly.

The second way hackers go after passwords is by matching guesses against stolen

• 1
• 2
• Next Page >>