Common password encryption formats used by programs such as Microsoft’s LAN Manager have, since the mid-1990s, been vulnerable to brute force attacks like the infamous l0phtcrack. A brute force attack works by guessing entire passwords against dictionaries of known passwords, and/or by going through the password characters one at a time until the trial password combination opens the virtual lock.

However, simply testing one character sequence after another to try to hit upon the password can be quite time-consuming. Over the past few years, a new method called rainbow cracking has exponentially sped up the process of cracking passwords encrypted with commonly used hashes (or algorithms) such as MD5. “Rainbow tables” contain strings of precomputed hash values covering, for example, every possible eight-digit sequence of keyboard characters. If a hacker has the hashed password value, he can find that hashed value in the rainbow table and thus recover the associated password.

Password-cracking programs like these are part of any hacker’s toolbox. Cracking the passwords faster gives criminals more time to invade and exploit the system before the compromise is discovered, says Gunter Ollmann, director of security strategy at IBM Internet Security Systems.

A number of hacking and security groups are building, giving away and selling these ready-made tables of precracked hash encryptors. The Shmoo Group, a well-known group of security researchers, released a set of rainbow tables at its annual ShmooCon in 2005. Hak.5, Freerainbowtables.com and others are also dedicating time to making rainbow tables available. And some companies, such as RainbowTables.net, sell these tables for password security evaluation and help-desk password retrieval.

Experts say the best defense against rainbow tables is to “salt” passwords, which is the practice of appending a random value to the password before it is encrypted. “Salting thwarts attacks based on precalculated possible passwords, since the encrypted value is not based solely on the value of the unencrypted text,” Ollmann adds.

LAN Manager is doubly susceptible to rainbow attacks because it hashes passwords into all uppercase letters and then splits 14-character strings into two shorter and easier-to-crack strings of seven characters, Ollmann says.Affected systems include Windows NT, 2000, XP, Radius servers, Samba (a Linux version of LAN Manager) and other embedded systems. A Microsoft spokesman says Windows Vista offers a feature called BitLocker prevents rainbow crack–type attacks by encrypting the entire operating system, including the password hash.

–Deb Radcliff

What to Do

Prevention is the best course against rainbow tables. That means:

• Protecting hardware—servers, desktops, wireless and other network devices—from malware that can be used to copy and sniff passwords to send out of the network for cracking, says Andre Protas, research engineer at eEye Digital Security.

• Using strong alphanumeric passwords eight characters or longer that are changed at regular intervals. Don’t use the same passwords for all your users’ critical applications, says Gerald Carter, the release manager for Samba 3.0, which is a Linux version of LAN Manager.

• If you use one of the 50 hash types that provide salting (MD5, SHA and so on), make sure salting is turned on, says Rodney Thayer, member of The Shmoo Group, a “white hat” hacking group. Windows versions do not use salting, but they do encrypt stored hashes if you use the “SYSKEY” tool to activate this option, Ollmann said. Salting also is available for recent versions of Samba for Linux.