Download to read offline
Uploaded byChristopher Grayson
Introduction to LavaPasswordFactory
The document discusses authentication, emphasizing the significance of identity verification through passwords, security tokens, and biometrics, and outlines common issues with password usage. It highlights the vulnerabilities associated with password-based attacks and introduces the lava.password.factory tool designed for generating and managing passwords for secure authentication. The presentation is delivered by Christopher Grayson, a senior security analyst, who encourages feedback on the ongoing development of the tool.
More Related Content
![[CB16] Facebook Malware: Tag Me If You Can by Ido Naor & Dani Goland](https://cdn.slidesharecdn.com/ss_thumbnails/cb16idoen-161109041834-thumbnail.jpg?width=640&height=640&fit=bounds)
![[OWASP Poland Day] Saving private token](https://cdn.slidesharecdn.com/ss_thumbnails/pawelbochenskisecuretoken2-171003211501-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Introduction to LavaPasswordFactory
Introduction to LavaPasswordFactory
- 1. LAVA.PASSWORD.FACT ORY PASSWORDS ARE BADAND YOU CAN TOO!!
- 2.
- 3. AGENDA 1. What isauthentication? 2. Why do passwords exist? 3. Why attack authentication mechanisms? 1. Password-based attacks 4. LavaPasswordFactory 1. Demonstration 5. Conclusion / Questions
- 4. WHO AM I? •Christopher Grayson • cegrayson3@gmail.com • @_lavalamp • Senior Security Analyst at Bishop Fox (Pen-Testing FTW) • MSCS, BSCM from GT • Former Research Scientist from GT • Former president, GT hacking club That guy in the front…
- 5.
- 6. THE BASICS • It’sall about identity baby • Something you know • Something you have • Something you are
- 7. SOMETHING YOU KNOW •Passwords • Personal knowledge (security questions) • Only those that know X should have access.
- 8. SOMETHING YOU HAVE •RSA SecurID • Google Authenticator • Only those that have X should be allowed access.
- 9. SOMETHING YOU ARE •Most nebulous of the three • Commonly refers to biometrics (iris scans for instance) • Only those who are X should be allowed access.
- 10. TAKEAWAYS • Authentication mechanismsaim to identify who you are for the purpose of establishing the correct level of authority. • Without accurately identifying someone, how can one hope to apply any meaningful identity-based security controls?
- 11.
- 12. WHYYYYYYY?! • Easy toimplement • Usually easy to remember • Requires the lowest amount of technical overhead • Many other reasons…
- 13. PASSWORDS ARE BAD,M’KAY? • When used properly, passwords can provide a decent level of security. • Passwords are largely used improperly, even within the security community.
- 14. COMMON PASSWORD PROBLEMS •Low complexity • Password re-use • Writing passwords down
- 15. SOME TANGIBLE DATA Creditto Karl Sigler, The Register http://www.theregister.co.uk/2014/08/15/hundreds_of_thousands_of_corporate_passwords_cracke
- 16.
- 17. WHY ATTACK AUTHENTICATION? • Automatedsystems typically have different roles meant for different users. • Correctly identifying a user supplies that user with the intended level of authority. • Even in an incredibly secure system, if you can trick the system into thinking you’re an admin, many security controls fall away.
- 18. ONLINE PASSWORD ATTACKS •Logging into a Web site • Logging into network services • Don’t have access to hashed representation of passwords
- 19. OFFLINE PASSWORD ATTACKS •Typically a data store has been compromised • Have direct access to hashed representation of passwords • Can break passwords at much larger scale
- 20.
- 21. SHINY NEW TOOL •Generates passwords for offline and online attacks • Cleans existing password lists • Uses a set of seed words • Has functionality for matching password policies
- 22.
- 23. GETTING IT • https://github.com/lavalamp- /LavaPasswordFactory •Still a work-in-progress, but current work is only to add more functionality. • Comments and feature requests welcome!
- 24.
- 25.