Honeywords:
Detectable Password
Theft
Gavin Holt
Abertay University
whoami
Gavin Holt (@GavinHolt)
Fourth Year Honours Student at Abertay University
One of the organisers of Securi-Tay 3
Vic...
What are we covering today?
Why is password theft so dangerous?
How are passwords currently being stored? (The good, the b...
Why is password theft so
dangerous?
Obvious Answer:
Because then someone has your
password
Less Obvious Answer:
Because then someone has your
password…for everything
60%+ of users use the same
password across multiple sites
(PayPal Report)
300% Increase in a single quarter
(Experian Report)
LinkedIn – 6.5 Million Passwords
Zappos.com – 12 Million Passwords
eHarmony – 1.5 Million Passwords
Adobe – 38 Million Pas...
But when you analyse a dump, you
have to wonder why you bother…
A lot of usernames and passwords
out there.
But Gavin, People don’t store
passwords in the plain anymore,
right?
http://plaintextoffenders.com/
Oh okay, but the big guys are doing
it right?
LinkedIn’s 6.5 Million Passwords
were unsalted.
Even if they salt the passwords, they
aren’t always per user salts.
Salting doesn’t stop a targeted
attack
Password Cracking is getting faster!
Making the Hashing more complex
and resource intensive is only part of
the solution.
How do I even know if my password
has been stolen?
You might not!
Some sneaky SysAdmins might put
some fake accounts in.
So if the User “Rory” logs in, they
can assume they have been
compromised.
Pretty useful idea – Honeypot
accounts.
Hackers are sneaky
Can potentially spot these fake
accounts by looking at their activity
and permissions.
So fake user accounts aren’t fool
proof.
But we like the idea of making it a
high-risk guessing game for the
attacker.
Why not have fake Passwords?
Introducing: Honeywords
First discussed by Jules and Rivest
of MIT in May 2013.
If for every user account, we have
multiple passwords, with only one
legit password, can we detect
password theft by watch...
An unsalted MD5 example (Don’t throw
things)
Traditional DBUID Username Password (Hashed, For Security obv)
1 Gavin 565E15...
A plain text example (Don’t throw things)
Traditional DB
Attacker Gets
a hold of the
database
Fires up John
or Similar Too...
Lets implement Honeywords…
How do we make Honeywords?
How do we make Honeywords?
We need believable words
We need some low hanging fruit
We need some tough passwords
We need to...
How do we make Honeywords?
Start with a dictionary
Select a handful of words of varying length
Depending on how hard we wa...
How do we make Honeywords?
We need to make a correct Checksum for our users password
We also need to make some fake checks...
An unsalted MD5 example
Using Honeywords
UID Username
1 Gavin
2 Rory
3 Tiago
UI
D
Password Hash Checksum
1 565E15D84CC5976...
An unsalted MD5 example
Using Honeywords
Attacker Gets a
hold of the
database
Fires up John or
Similar Tool
Gets Plain Tex...
1/5 Chance of getting it right
Can greatly decrease this chance by
adding more Honeywords!
How would I even authenticate
against that?
Authentication Process
Web Server
• Takes Password and
Hashes It
• Passes to DB Server
DB Server
• Retrieves
Checksum
wher...
In order to gain 100% certainty that
they have the correct password,
they attack would need to
compromise all 3 boxes.
So we now know when a password
we have purposely added to the DB
is used.
We can detect password theft!
What else can we do with it?
Time based detection?
Change the fake passwords
periodically to pinpoint when they
were stolen?
Alerting other services that
passwords have been stolen
Central API for Services to use
Pass UIDs of known compromised
accounts to a central service to alert
users across platforms they may be
vulnerable?
The Benefits of Honeywords
The benefits of Honeywords
Can be used to detect password theft
Can be used to prevent the usage of stolen credentials
Can...
What Honeywords won’t do
What Honeywords won’t do
Honeywords won’t stop your service being compromised
If they have your Password file, you have pr...
Honeywords are not a replacement
to a strong password policy and
user awareness
In Summary
Honeywords allow for detectable password theft by seeding a database with
known “wrong” passwords.
Watching for...
Any Questions?
Tweet me @GavinHolt later if you
think of any
Honeywords - BSides London 2014
Honeywords - BSides London 2014
Upcoming SlideShare
Loading in...5
×

Honeywords - BSides London 2014

413

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
413
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
12
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Honeywords - BSides London 2014

  1. 1. Honeywords: Detectable Password Theft Gavin Holt Abertay University
  2. 2. whoami Gavin Holt (@GavinHolt) Fourth Year Honours Student at Abertay University One of the organisers of Securi-Tay 3 Vice President of Abertay Ethical Hacking Society (@AbertayHackers)
  3. 3. What are we covering today? Why is password theft so dangerous? How are passwords currently being stored? (The good, the bad and the plain stupid) What are Honeywords? How Honeywords can be implemented The benefits of Honeywords What Honeywords won’t save you from Summary Questions
  4. 4. Why is password theft so dangerous?
  5. 5. Obvious Answer: Because then someone has your password
  6. 6. Less Obvious Answer: Because then someone has your password…for everything
  7. 7. 60%+ of users use the same password across multiple sites (PayPal Report)
  8. 8. 300% Increase in a single quarter (Experian Report)
  9. 9. LinkedIn – 6.5 Million Passwords Zappos.com – 12 Million Passwords eHarmony – 1.5 Million Passwords Adobe – 38 Million Passwords Evernote – 50 Million Passwords
  10. 10. But when you analyse a dump, you have to wonder why you bother…
  11. 11. A lot of usernames and passwords out there.
  12. 12. But Gavin, People don’t store passwords in the plain anymore, right?
  13. 13. http://plaintextoffenders.com/
  14. 14. Oh okay, but the big guys are doing it right?
  15. 15. LinkedIn’s 6.5 Million Passwords were unsalted.
  16. 16. Even if they salt the passwords, they aren’t always per user salts.
  17. 17. Salting doesn’t stop a targeted attack
  18. 18. Password Cracking is getting faster!
  19. 19. Making the Hashing more complex and resource intensive is only part of the solution.
  20. 20. How do I even know if my password has been stolen?
  21. 21. You might not!
  22. 22. Some sneaky SysAdmins might put some fake accounts in.
  23. 23. So if the User “Rory” logs in, they can assume they have been compromised.
  24. 24. Pretty useful idea – Honeypot accounts.
  25. 25. Hackers are sneaky
  26. 26. Can potentially spot these fake accounts by looking at their activity and permissions.
  27. 27. So fake user accounts aren’t fool proof.
  28. 28. But we like the idea of making it a high-risk guessing game for the attacker.
  29. 29. Why not have fake Passwords?
  30. 30. Introducing: Honeywords
  31. 31. First discussed by Jules and Rivest of MIT in May 2013.
  32. 32. If for every user account, we have multiple passwords, with only one legit password, can we detect password theft by watching for our known entries?
  33. 33. An unsalted MD5 example (Don’t throw things) Traditional DBUID Username Password (Hashed, For Security obv) 1 Gavin 565E15D84CC59763D13D58B5F66C967F 2 Rory AD7FADB59974D0C2E66E628C0485F9C9 3 Tiago AA177EC5DCBF88CA5EDF17236C1981E8
  34. 34. A plain text example (Don’t throw things) Traditional DB Attacker Gets a hold of the database Fires up John or Similar Tool Gets Plain Text Passwords Back
  35. 35. Lets implement Honeywords…
  36. 36. How do we make Honeywords?
  37. 37. How do we make Honeywords? We need believable words We need some low hanging fruit We need some tough passwords We need to ensure we don’t use the users PW We need to be able to identify HoneyWords internally!
  38. 38. How do we make Honeywords? Start with a dictionary Select a handful of words of varying length Depending on how hard we want to make the password to crack we can: Mangle for Upper and Lower Case Prepend and Append numbers Substitute Symbols Concatenate Words Make sure it doesn’t make our users PW!
  39. 39. How do we make Honeywords? We need to make a correct Checksum for our users password We also need to make some fake checksums for the honeywords we have generated
  40. 40. An unsalted MD5 example Using Honeywords UID Username 1 Gavin 2 Rory 3 Tiago UI D Password Hash Checksum 1 565E15D84CC59763D13D58B5F66C 967F TU32R781V346R7ETV81ERTGE7RT8EV4 1 AD7FADB59974D0C2E66E628C0485 F9C9 SVEVREVR6571654SF7CEWF7E1FC51W 1 AA177EC5DCBF88CA5EDF17236C1 981E8 BCN7GHER17G8J7678A78W81CDFCTHY871 1 DC5F61F959F188478982A9DBB153 EWFFFFSEESYUUTRYER87F1S67F1S5E7F1SCE
  41. 41. An unsalted MD5 example Using Honeywords Attacker Gets a hold of the database Fires up John or Similar Tool Gets Plain Text Passwords Back Has a 20% chance of picking the correct password
  42. 42. 1/5 Chance of getting it right
  43. 43. Can greatly decrease this chance by adding more Honeywords!
  44. 44. How would I even authenticate against that?
  45. 45. Authentication Process Web Server • Takes Password and Hashes It • Passes to DB Server DB Server • Retrieves Checksum where UID and Hash match and passes to Auth Server Auth Server • Performs additional secret cryptographic function on hash and compares to Passed Check Sum • Returns True or False to Web Server Web Server • Either: • Logs user in because they have a correct password • Doesn’t log user in and flags that a known “Honeyword” was used • Doesn’t log in due to incorrect password
  46. 46. In order to gain 100% certainty that they have the correct password, they attack would need to compromise all 3 boxes.
  47. 47. So we now know when a password we have purposely added to the DB is used.
  48. 48. We can detect password theft!
  49. 49. What else can we do with it?
  50. 50. Time based detection?
  51. 51. Change the fake passwords periodically to pinpoint when they were stolen?
  52. 52. Alerting other services that passwords have been stolen
  53. 53. Central API for Services to use
  54. 54. Pass UIDs of known compromised accounts to a central service to alert users across platforms they may be vulnerable?
  55. 55. The Benefits of Honeywords
  56. 56. The benefits of Honeywords Can be used to detect password theft Can be used to prevent the usage of stolen credentials Can provide warnings to other services that users may reuse passwords on Can be used to deter attackers from trying to compromise accounts
  57. 57. What Honeywords won’t do
  58. 58. What Honeywords won’t do Honeywords won’t stop your service being compromised If they have your Password file, you have problems to begin with Honeywords won’t stop the hashes from being cracked Only per hash salting and intensive hashing functions will slow that down Honeywords won’t stop attackers from gaining a users password by another method Social Engineering, Key Logger, or simply guessing a rubbish password
  59. 59. Honeywords are not a replacement to a strong password policy and user awareness
  60. 60. In Summary Honeywords allow for detectable password theft by seeding a database with known “wrong” passwords. Watching for these passwords allows Systems to detect when they have had their password DB stolen. Honeywords should be of varying difficulty in order to disguise themselves Honeywords are not a replacement for: A strong password policy A strong password storage mechanism End Point Security
  61. 61. Any Questions? Tweet me @GavinHolt later if you think of any
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×