Password Storage and Attacking in PHP

Password Storage and Attacking in PHP

• 1.
  Password Storage (AndAttacking) In PHP Anthony Ferrara
• 2.
  Github URL Follow Along: github.com/ircmaxell/password-bad-web-app A"Bad Web App" - Has Known Vulnerabilities - Only Use For Education!!! - Requires only Apache + PHP - Has Composer Dependencies
• 3.
  Let's Start From The Beginning
• 4.
  Plain-Text Storage git checkout plaintext Stores passwords in Plain-Text What's wrong with this picture?
• 5.
  Plain-Text Storage What happensif we have a SQL-Injection Vulnerability? localhost/sqli Simulates: ?offset=0'+UNION+SELECT+*+FROM+users
• 6.
  Plain-Text Storage Problem! Any attackvector results in leakage of ALL credentials!
• 7.
  We Can DoBetter
• 8.
  MD5 git checkout md5 Uses the MD5 Cryptographic Hash function. md5($password) hash('md5', $password)
• 9.
  Wait, What Is AHash?
• 11.
  What's A CryptographicHash? Like a fingerprint. One-way. - Easy and efficient to compute - Very inefficient to reverse - (Practically impossible) - Very hard to create collision - (new input with same output)
• 12.
  MD5 What's the problemnow? SQL-Injection still gives us hash But the hash is one-way, how can we attack it?
• 13.
  Enter: Lookup Tables
• 15.
  Lookup Table Google isa great example Maps hash to password directly Database Table: hash | password --------------+----------- "5f4dcc3b..." | "password" "acbd18db..." | "foo"
• 16.
  Lookup Table Lookups areCPU efficient. Require a LOT of storage space - (Very space inefficient) All passwords <= 7 chars (95^7, 70 Trillion) Requires 1.5 PetaBytes - In Most Optimal Storage Format
• 17.
  We Can DoBetter
• 18.
  Rainbow Table Seed Hash Reduce Hash
• 19.
  Rainbow Table a4fef... Seed Hash Reduce Reduce New Hash Password
• 20.
  Rainbow Table Seed 1 Hash Reduce Hash Reduce Hash Reduce Hash Seed 2 Hash Reduce Hash Reduce Hash Reduce Hash Seed 3 Hash Reduce Hash Reduce Hash Reduce Hash Seed 4 Hash Reduce Hash Reduce Hash Reduce Hash Seed 5 Hash Reduce Hash Reduce Hash Reduce Hash Seed 6 Hash Reduce Hash Reduce Hash Reduce Hash
• 21.
  Rainbow Table Time/Space Tradeoff -Slower than a Lookup Table - Uses Much less storage Most (99.9%) passwords <= 7 chars Requires only 64 GB - Chain length of 71,000
• 22.
  Defense!
• 24.
  Salted MD5 git checkout salted-md5 Uses the MD5 Cryptographic Hash function. But adds a random salt UNIQUE per user. md5($salt . $password) hash('md5', $salt . $password)
• 25.
  Salts Must be unique! -Per Hash - Globally Should be random - Strong!!! - Reasonably long (at least 64 bits)
• 26.
  Salted MD5 What's theproblem now? SQL-Injection still gives us hash - And the salt But the salt defeats rainbow tables...
• 27.
  Can Anyone See The Problem?
• 28.
  What's A CryptographicHash? Like a fingerprint. One-way. - Easy and efficient to compute - Very inefficient to reverse - (Practically impossible) - Very hard to create collision - (new input with same output)
• 29.
  What's A CryptographicHash? Like a fingerprint. One-way. - Easy and efficient to compute - Very inefficient to reverse - (Practically impossible) - Very hard to create collision - (new input with same output)
• 30.
  Hash Functions Are MadeTo Be FAST
• 31.
  Brute Forcing Several ToolsAvailable - John The Ripper - OCIHashCat A Lot Faster Than You May Think
• 32.
  Brute Forcing Multiple WaysTo Attack - Mask Based (permutations) - Dictionary Based - Combinator Based - Combinations of dictionary words - Fingerprint Based - Combinators applied with permutations - Rule Based - Takes input password and transforms it
• 33.
  Brute Forcing Salted MD5 2012 Macbook Pro: - md5: 33 million per second - sha256: 20 million per second Mask Attack: 6 char passwords: 5 hours 7 char passwords: 22 days Entire English Language: 1.8 seconds "LEET" Permutations: 1 hour
• 34.
  We Can DoBetter
• 36.
  Brute Forcing Salted MD5 25 GPU Cluster - md5: 180 Billion per second - < $50,000 6 char passwords: 4 seconds 7 char passwords: 6 minutes 8 char passwords: 10 hours Entire English Language: "LEET" Permutations:
• 37.
  Brute Forcing Salted MD5 25 GPU Cluster - md5: 180 Billion per second - < $50,000 6 char passwords: 4 seconds 7 char passwords: 6 minutes 8 char passwords: 10 hours Entire English Language: yeah... "LEET" Permutations: 0.7 seconds
• 38.
  But Wait, I ThoughtMD5 Was Broken?
• 39.
  MD5 IS Broken! ButNo Other Primitive Hash Is Not!!! sha1≈ md5 sha256 ≈ md5 sha512 ≈ md5 whirlpool ≈ md5 ALL raw primitive hashes are broken for password storage.
• 40.
  So, How CanWe Combat Such Hardware?
• 41.
  Iterated MD5 git checkout iterated-md5 Uses the MD5 Cryptographic Hash function. But adds a random salt UNIQUE per user. And iterates a lot of times do { $h = md5($h . $salt . $password) } while($i++ < 1000);
• 42.
  We're Intentionally SlowingIt Down
• 43.
  Brute Forcing Iterated MD5 25 GPU Cluster - md5: 70 million per second 6 char passwords: 17 minutes 7 char passwords: 1 day 8 char passwords: 124 days Entire English Language: 0.8 seconds
• 44.
  We Can DoBetter
• 45.
  PBKDF2 git checkout pbkdf2 Uses the standard PBKDF2 algo - With SHA512 primitive Slower, and harder to use on GPU pbkdf2($pass, $salt, 10000, 40)
• 46.
  Brute Forcing PBKDF2 25 GPU Cluster - PBKDF2(sha512): 300,000 per second 6 char passwords: 28 days 7 char passwords: 7 years 8 char passwords: 700 years Entire English Language: 3 minutes
• 47.
  We Can Still Do Better
• 48.
  BCrypt git checkout bcrypt Uses the standard BCrypt algo - based on Blowfish cipher Same execution time, Much harder to run on GPU crypt $2a$
• 49.
  Brute Forcing BCrypt 25 GPU Cluster - BCrypt: 70,000 per second 6 char passwords: 120 days 7 char passwords: 31 years 8 char passwords: 3000 years Entire English Language: 14 minutes
• 50.
  A Note OnCost BCrypt accepts a "cost" parameter Must be tuned per server! - Target about 0.25 to 0.5 second runtime - Cost of 10 is a good baseline - Cost of 11 or 12 is better - If you have decent hardware.
• 51.
  PHP 5.5 PasswordHashing API git checkout password-compat A thin wrapper over crypt() - Simplifies implmentation - Strong random salt generation - Can specify cost as int option password_hash($pass, $algo, $opts) password_verify($pass, $hash) github.com/ircmaxell/password_compat
• 52.
  We Can Do EvenBetter!
• 53.
  Let's Encrypt Instead!
• 54.
  Encrypted BCrypt git checkoutbcrypt-with-encryption Hash with BCrypt, Then encrypt result with AES-128. Requires key storage for the app. - Not trivial Use only if needed! - BCrypt alone is typically sufficient
• 55.
  Brute Forcing Encrypted BCrypt Attack requires low level server compromise! - SQL Injection is not enough! localhost/codeinject - Simulates code injection that reads source Any low level compromise Is No Worse than raw BCrypt - BCrypt is the baseline.
• 56.
  The Future
• 57.
  The Future scrypt -Sequential Memory Hard - Uses a LOT of memory (32mb / hash) - Harder to brute-force than bcrypt But it's VERY new - In cryptography terms at least - Not proven enough for use (yet)
• 58.
  The Future Password HashingCompetition - Currently being setup - Aims to pick "standard" password hashing algorithm - A community effort
• 59.
  The Future Brute ForcingWord Lists - Complex combinations of words - "horse correct battery staple" Brute Forcing Grammar - "I don't want no cookies" Brute Forcing Structures - URLs, Email Addresses, URLs, etc
• 60.
  Anthony Ferrara joind.in/7792 @ircmaxell ircmaxell@php.net blog.ircmaxell.com youtube.com/ircmaxell