Passwords alone can’t protect your network

A German researcher’s claim that he has found a way to leverage Amazon’s EC2 service to crack wireless passwords raises an important question: Have passwords outlived their usefulness?

InfoWorld analyst Ted Samson reported this week that the researcher was able to use customized software running on multicomputer cloud system to crack wireless WPA preshared keys in as little as six minutes for a few dollars or less.

[ Revisit your company’s stance on passwords — start by testing the strength of your password policy. | Master your security with InfoWorld’s interactive Security iGuide. | Stay up to date on the latest security developments with InfoWorld’s Security Central newsletter. ]

This threat isn’t entirely surprising. To slightly paraphrase computer security expert Bruce Schneier, password attacks only become more effective over time. Yesterday’s long and secure passwords become tomorrow’s easily hackable passwords. A decade ago, a 6-character password provided most people a lot of protection. Today, it’s likely that 10-character passwords are susceptible to assault, even when they’re strong and employ authentication protocols.

Precloud password cracking Cloud computing and its ability to bring in cheap, elastic computing and storage resources are certainly putting pressure on passwords, but there are other factors to consider. Five years ago I was using the John the Ripper password hash cracking program to make tens of millions of password guesses per second. I thought that was extraordinary. Then password crackers started using GPU (graphical processing unit) chips from standard PC video cards and gaming systems to increase password cracking speeds by as much as 100 times. In fact, it’s cloud computing with GPUs that led to the recent superquick wireless WPA-PSK exploit.

But cloud computing isn’t even necessary to take advantage of the benefits of parallel computing. Using Distributed John the Ripper and other password crackers, such as Passware Password Kit Forensics or Elcomsoft’s Distributed Password Recovery product, password hackers have long been able to take advantage of every CPU under their control.

Anyone can even buy dedicated hardware units that use FPGA (field-programmable gateway array) circuits, such as Tableau’s TACC1441, which has 16 FGPAs. It claims to boost password cracking speed by between 6 and 30 times compared to regular, nonaccelerated computers. Further, several TACC systems (less than $5,000 each, including software) can be connected to crack even faster.

If you already have the password hash, you can try it against any of the many online rainbow table hash crackers; alternatively, you can download the tables to crack them yourself without exposing your treasured hash to a complete stranger.

Of course, if an attacker has a password hash today, he or she will simply reuse the hash instead of cracking it with a pass-the-hash technique. Although hacking tools are only widely available for Windows password hashes, the attack will work equally as well against any popular operating system. Why crack when you can just reuse? In the immortal words of the Black Eyed Peas, cracking is “so 2000 and late.”

Passwords can be recovered from hibernated systems; from active memory, even on a locked system; and from memory chips, even with a shutdown system. Clearly, whatever password you use to protect yourself today is not as safe as it was yesterday.

A world without passwords? Are passwords now a waste of time? No, security is not binary. It run along a continuum from none to absolute. Your passwords (or preshared keys, passphrases, and so on), no matter what the size and complexity, provide some protection. If you use weak password systems and policies, then passwords may provide very little protection. But if you enforce a decent password policy, then passwords will provide some protection. Password-only protection, however, is becoming far less reliable.

What’s a decent password policy? Well, a typical user’s password protecting medium sensitivity data should be 12 or more characters. Elevated users (admin or root) or service/daemon accounts or users protecting highly sensitive data should probably be 15 characters or longer. Passwords should be complex and changed every 90 or so days. You should disable older password hashes and algorithms, and use the ones demonstrated to better withstand password attacks. In Windows, this means using NT hashes; in Linux/BSD, go with Blowfish hashes.

Not wanting to forget the recent WPA-PSK attack news, make sure your wireless networks are protected with the strongest wireless protocol you can use (WPA2, EAP-TLS, and so on); if you use PSKs, go with long, complex options. PSKs should be at least 40 characters and contain complexity. If you use PSKs, change them frequently, as you would a password. Most companies I visit never or rarely change their PSKs once established. Using certificate-based protocols, like EAP-TLS, is even better.

The fact remains, though, that thanks to cheaply and plentiful cloud computing and FPGAs, adhering to a solid password policy may not be enough if a would-be attacker gets your password hash.

Personally, I think passwords, even for general purposes, are becoming less useful if you want decent protection. Password-only protection truly is only for those companies and people willing to accept a growing level of risk. Two-factor authentication is starting to make more sense. Unfortunately, doing away with passwords completely can be both costly and difficult. But if I were a security admin and my company hadn’t already started to move away from password-only authentication systems, I would at least start the planning.

Every time I read an article about how cloud computing simplifies the cracking of strong passwords and protocols, I know the days of the password-only authentication system are numbered.

This story, “Passwords alone can’t protect your network,” was originally published at InfoWorld.com. Keep up on the latest developments in network security and read more of Roger Grimes’ Security Adviser blog at InfoWorld.com. For the latest developments in business technology news, follow InfoWorld.com on Twitter.