Brute Forcing

BRUTE FORCE ATTACK by -------- SAI CHAITANYA

WHAT IS BRUTE FORCE? Brute force (also known as brute force cracking) is a trial and error method used to decode encrypted data such as passwords or Data Encryption Standard ( DES ) keys, through exhaustive effort (using brute force) rather than employing intellectual strategies. Brute force cracking application proceeds through all possible combinations of legal characters in sequence. Brute force is considered to be an infallible, although time-consuming, approach.

Determining the Difficulty of a Brute Force Attack How long can the key be? How many possible values can each component of the key have? How long will it take to attempt each key? Is there a mechanism which will lock the attacker out after a number of failed attempts?

Increasing Security Against a Brute Force Attack Increasing the length of the PIN Allowing the PIN to contain characters other than numbers, such as * or # Imposing a 30 second delay between failed authentication attempts Locking the account after 5 failed authentication attempts A brute force attack will always succeed, eventually. However, brute force attacks against systems with sufficiently long key sizes may require billions of years to complete.

Brute Forcing Log-in Credentials Most common type of attack in web-applications. Default password databases or dictionaries “ Word list attack” or a "dictionary attack"

Reverse brute force attack ‘ N’ uses An attacker may try to guess a password alone or guess both the user name and the password. In the later case the attacker might fix the user name and iterate through a list of possible passwords, or fix the password and iterate through a list of possible user names. useful when the attacked system locks users after a number of failed log-in attempts.

Brute Forcing Session Identifiers Since HTTP is a stateless protocol, in order to maintain state web applications need to ensure that a session identifier is sent by the browser with each request. The session identifier is most commonly stored in an HTTP cookie or URL. Using a brute force attack, an attacker can guess the session identifier of another user. This can lead to the attacker impersonating the user, retrieving personal information and performing actions on behalf of the user. Session identifiers usually consist of a number or a sequence of characters. In order for a brute force attack to succeed, the possible range of values for the session identifier must be limited. If the predicted range of values for a session identifier is very small based on existing information the attack is referred to as a session prediction attack .

Brute Forcing Directories and Files When files reside in directories that are served by the web server but are not linked anywhere, accessing those files requires knowing their file name. In some cases those files have been left by mistake: for example a backup file automatically created when editing a file or leftovers from an older version of the web application. In other cases files are intentionally left unlinked as a "security by obscurity" mechanism allowing only people who know the file names to access them. A brute force attack tries to locate the unlinked file by trying to access a large number of files. The list of attempted file names might be taken from a list of known potential files or based on variants of the visible files on the web site. More information on brute forcing directories and files can be found in the associated vulnerability, predictable resource location

Brute Forcing Credit Card Information Shopping online with stolen credit cards usually requires information in addition to the credit card number, most often the CVV/SCS [6] and/or expiration date. A fraudster may hold a stolen credit card number without the additional information. For example the CVV/CSC is not imprinted on the card or stored on the magnetic stripe so it cannot be collected by mechanical or magnetic credit card swiping devices. In order to fill in the missing information the hacker can guess the missing information using a brute force technique, trying all possible values. Guessing CVV/CSC requires only 1000 or 10000 attempts as the number is only 3 or 4 digits, depending on the card type. Guessing an expiration date requires only several dozen attempts.

Password retrieval information attack Brute force attacks are by no means limited to the scenarios described above. For example, a password reminder feature may enable a user to retrieve a forgotten password by providing a personal detail known just to him. However, if the personal detail is "favorite color" then an attacker can use a brute force attack to retrieve the password as the number of color choices is limited. In addition, studies have shown that approximately 40% of the population selects blue as their favorite color , so even if the attacker is locked out after three attempts, that would still enable the attacker to retrieve a fair amount of passwords.

Target of an attack By Examining the web service's catalogue structure . Target of an attack are data in forms (GET/POST). Target of an attack are in the form of users' Session-IDs.

Example(Session ID) Consider the URL http://greetings.acme-hackme.com/view/9BA54003218827622 Unique Session ID for each greeting card Using Brute Force applications, attackers may try thousands of session IDs embedded in a legitimate URL in an attempt to view greeting cards that they are not authorized to view.

Example(Object ID) Consider the URL: http://www.acme-hackme.com/online/Displaymsg.asp?msgID=12345 In this example, the dynamic page requested by the browser is called Displaymsg.asp and the browser sends the Web server the parameter msgID with a value of 12345. An attacker may try brute force values for msgID to try and read other users' messages.

Advantages and Disadvantages Finding the password is quite high since the attack uses so many possible answers . It is a fairly simplistic attack that doesn't require a lot of work to setup or initiate. Disadvantages Hardware intensive :curbs lots of processing power Extends the amount of time needed to crack the code by a huge margin.

Tools Brutus Brutus is one of the fastest, most flexible remote password crackers you can get your hands on - it's also free. This Windows-only cracker bangs against network services of remote systems trying to guess passwords by using a dictionary and permutations thereof. It supports HTTP, POP3, FTP, SMB, TELNET, IMAP, NTP, and more. Platform: Windows THC-Hydra This tool allows for rapid dictionary attacks against network login systems, including FTP, POP3, IMAP, Netbios, Telnet, HTTP Auth, LDAP NNTP, VNC, ICQ, Socks5, PCNFS, and more. It includes SSL support and is apparently now part of Nessus . Platform: UNIX

TSGrinder TSGrinder is the first production Terminal Server brute force tool. And having an encrypted channel to the TS logon process sure helps to keep IDS from catching the attempts. It is a "dictionary" based attack tool, but it does have some interesting features like "l337" conversion, and supports multiple attack windows from a single dictionary file. It supports multiple password attempts in the same connection, and allows you to specify how many times to try a username/password combination within a particular connection. Platform: Windows

Bibliography "Brute-Force Exploitation of Web Application Session ID's", David Endler - iDEFENSE Labs [2] http://www.cgisecurity.com/lib/SessionIDs.pdf "Brute force attack incidents", the Web Hacking Incidents Database [3] http://whid.webappsec.org/whid-list/Brute%20Force Credential/Session Prediction [4] http://projects.webappsec.org/Credential-and-Session-Prediction Predictable Resource Location [5] http://projects.webappsec.org/Predictable-Resource-Location "Card Security Code", Wikipedia [6] http://en.wikipedia.org/wiki/Card_Verification_Value "Color Assignment, Favorite Color", Joe Hallock [7] http://www.joehallock.com/edu/COM498/preferences.html

Brute Forcing

Recommended

More Related Content

What's hot (20)

Viewers also liked (9)

Similar to Brute Forcing (20)

More from n|u - The Open Security Community (20)

Recently uploaded (20)

Brute Forcing