Password Attacks - CompTIA Security+ SY0-701 - 2.4
Understanding Password Security and Hashing
The Risks of Storing Credentials in Plain Text
- Storing usernames and passwords in a non-encrypted form, known as "in the clear," poses significant security risks.
- If an application stores credentials as plain text, it is advisable to stop using that application or contact the developer for a secure rewrite.
Importance of Hashing Passwords
- Hashing transforms variable-length input (passwords) into a fixed-length string, often referred to as a message digest or fingerprint.
- Each unique password generates a distinct hash; thus, different inputs yield different outputs, enhancing security.
- Once stored as hashes, passwords cannot be reverse-engineered back to their original form, similar to how fingerprints cannot reconstruct a person.
Common Password Vulnerabilities
- Users frequently choose weak passwords like "123456" or "password," making accounts susceptible to attacks.
- Attackers can exploit these common passwords by attempting them on multiple accounts without triggering lockouts.
Types of Attacks: Spraying vs. Brute Force
- A spraying attack involves trying common passwords across many accounts with minimal attempts per account to avoid detection.
- In contrast, brute force attacks systematically try every possible combination of characters until the correct password is found.
The Process of Brute Forcing Passwords
- Attackers start with known hashes and attempt various combinations until they find one that matches the stored hash.
Brute Force Attacks and Password Security
Understanding Brute Force Attacks
- Attackers often download files containing password information, which typically include usernames, IDs, and hashed passwords.
- Once the attacker has this data offline, they can execute unlimited brute force attacks without worrying about account lockouts.
- The lack of immediate consequences allows attackers to perform these attacks over extended timeframes at their convenience.
- This method highlights the importance of securing password databases against unauthorized access to prevent such attacks.