1
00:00:01,370 --> 00:00:02,880
So real quick about me.

2
00:00:02,880 --> 00:00:15,380
I have a bit of a reputation as kind of approaching this as an academic frameset, simply because I got started in the whole password cracking thing through my research when I was getting my PhD.

3
00:00:16,180 --> 00:00:20,300
But I really do strongly believe in learning by doing.

4
00:00:20,300 --> 00:00:28,780
So I'm an active member in Team John Ripper, and I do participate in password cracking contests like, you know, Crack Me If You Can, that's going on right now.

5
00:00:28,800 --> 00:00:33,880
Luckily, this talk is, you know, being filmed, you know, before the contest starts.

6
00:00:33,880 --> 00:00:35,680
So no spoilers here, unfortunately.

7
00:00:35,800 --> 00:00:38,480
But good luck to everyone else who's participating.

8
00:00:38,920 --> 00:00:44,840
So password cracking, really, it's my hobby and a little bit of an obsession.

9
00:00:44,840 --> 00:00:46,920
But it's not my day job, unfortunately.

10
00:00:47,120 --> 00:00:54,180
But my day job has been very exciting recently, though, because I really focus on medical device security.

11
00:00:54,500 --> 00:01:01,580
And you can imagine with all the craziness around COVID-19, it's been an interesting time.

12
00:01:01,980 --> 00:01:09,580
So one project that I really kind of want to highlight is the Open Ventilator Monitoring and Alerting Project that I've been helping to contribute to.

13
00:01:09,780 --> 00:01:19,060
And there's actually a talk at the Biohacking Village this Sunday that I really highly recommend people go ahead and listen to, so that our team members are giving it.

14
00:01:19,460 --> 00:01:26,260
And it really is going to talk to you about, you know, the lessons learned and how other people can help contribute as well.

15
00:01:26,340 --> 00:01:35,100
Because this has been a big problem because, as I'm sure you're aware, there's been a huge demand for ventilators to be able to help deal with COVID-19.

16
00:01:35,380 --> 00:01:45,560
So there's been a lot of different projects that have kind of stood up to try to help produce, you know, low-cost ventilators to help fill that need pretty quickly there.

17
00:01:46,060 --> 00:01:58,200
So rather than have every single do-it-yourself ventilator develop their kind of own monitoring and alerting framework, we're trying to produce one common one that can be applied to all these different projects across the board.

18
00:01:58,260 --> 00:02:08,940
So because when you have these ventilators being able to treating, you know, patients, the patients are highly infectious, so you don't want to have the nurses exposed to that.

19
00:02:08,960 --> 00:02:11,480
But if something goes wrong, you need, you know, seconds count.

20
00:02:11,480 --> 00:02:17,920
So you need to be able to forward all that sensing information that these ventilators are doing back to a centralized nursing workstation.

21
00:02:18,040 --> 00:02:21,500
And you need to do that securely because you're not just on a real hospital network.

22
00:02:21,640 --> 00:02:28,340
So that's been a really fulfilling project that I've been working on.

23
00:02:28,640 --> 00:02:37,100
So another thing I'm kind of helping out with here, as I move my head, is I'm helping out run the Defcon Biohacking Village's Capture the Flag contest.

24
00:02:37,320 --> 00:02:39,220
So this was originally supposed to be in Vegas.

25
00:02:39,280 --> 00:02:40,700
That changed, of course.

26
00:02:40,700 --> 00:02:43,340
So now a lot of medical equipment is actually sitting in my house.

27
00:02:43,340 --> 00:02:52,600
So I have to be able to provide a way for hackers from all over the world to be able to log in and hack these infusion pumps here without also hacking my smart thermostat.

28
00:02:53,120 --> 00:03:05,740
As part of that, I actually had to repurpose one of my password cracking rigs, as you can see there, in order to run all the VMs that are helping to keep people, you know, on those ventilators and hacking those and not, you know, hacking my smart thermostat.

29
00:03:09,540 --> 00:03:31,580
So probably the first questions I should start kind of addressing here is, you know, what does that PCFG stand for in, so originally, and I guess still technically, it stands for Probabilistic Context-Free Grammar, which is the kind of the modeling framework it uses in order to model how people create passwords.

30
00:03:31,740 --> 00:03:37,300
So if you're into, you know, the Siri Autonoma or, you know, formal languages, this might actually mean something to you.

31
00:03:37,300 --> 00:03:42,100
But for most people, you know, they hear that and they're like, oh god, that's like mass and stuff like that.

32
00:03:42,100 --> 00:03:43,860
I mean, there's no way it's going to run on my computer.

33
00:03:44,420 --> 00:03:46,360
And then he's kind of like slowly walk away.

34
00:03:47,100 --> 00:03:51,360
So I decided in order, I need it need to have a more descriptive name.

35
00:03:52,040 --> 00:03:55,160
So I went ahead and rebranded it the Pretty Cool Fuzzy Guesser.

36
00:03:55,840 --> 00:04:02,600
So, and this kind of explains it a little bit better about what it's actually doing underneath the hood, because you train this on a list of passwords.

37
00:04:02,900 --> 00:04:11,900
And then it'll go ahead and create guesses that are similar to those passwords, but different, which is really kind of important in order to help, you know, expand your cracking session.

38
00:04:12,640 --> 00:04:14,520
So I don't this is my favorite slide I've ever made.

39
00:04:14,520 --> 00:04:16,440
So it's all downhill from here.

40
00:04:18,380 --> 00:04:23,940
So really kind of what it's doing is it's using machine learning in order to crack passwords.

41
00:04:23,940 --> 00:04:28,440
And when I say machine learning, I mean, in the traditional sense of a whole bunch of if then statements.

42
00:04:28,440 --> 00:04:31,400
So it's not using neural networks or artificial intelligence.

43
00:04:31,560 --> 00:04:37,320
But you are training on passwords that you expect to be somewhat similar to the target passwords that you're cracking.

44
00:04:37,740 --> 00:04:46,380
And when it processes that training password set, it extracts all sorts of probability information about the components of those passwords that it finds there.

45
00:04:46,380 --> 00:04:58,320
So it figures out things like, you know, capitalization masks, whether numbers go at the beginning of the password versus the end, the probability of individual letters and numbers found in that password, keyboard walks, and so on.

46
00:04:58,320 --> 00:05:02,860
And so it goes ahead and creates a model based upon all those different types of probability information there.

47
00:05:02,860 --> 00:05:07,880
And then it uses those in order to generate very highly probable password guesses in probability order.

48
00:05:07,960 --> 00:05:16,520
So it'll start with the most probable password guess and go to the second most probable password guess and then go to the third one and so on until you crack the password that you're trying to find or you give up.

49
00:05:19,910 --> 00:05:23,150
So let me just move my thing here a little bit here.

50
00:05:25,050 --> 00:05:32,330
So just to kind of tie us back into probably what's going on right now, as I said, I don't know what the actual contest is going to be like.

51
00:05:32,330 --> 00:05:33,670
Forward or crack me if you can.

52
00:05:33,990 --> 00:05:40,450
But CoreLogic helpfully provided a brief summary of, you know, what the scenario is going to be at least here.

53
00:05:40,730 --> 00:05:43,870
And so we're going to be targeting 12 different individuals.

54
00:05:43,970 --> 00:05:49,710
And those individuals change their passwords over time in order to be able to deal with more complex password creation requirements.

55
00:05:50,010 --> 00:05:54,070
And that sounds a little bit something like something that, you know, a PCFG might actually be useful for.

56
00:05:54,070 --> 00:05:56,550
So I'm really optimistic for this contest.

57
00:05:56,770 --> 00:06:02,070
You'll see how, you know, optimistic I am on Saturday when I'm actually, you know, we're giving this talk.

58
00:06:02,610 --> 00:06:12,310
But, you know, this is kind of the scenario that this was originally developed for in the first place of, you know, you know how a subject creates passwords.

59
00:06:12,590 --> 00:06:15,070
So you want to create passwords kind of similar to that.

60
00:06:15,070 --> 00:06:23,950
But you also want to go ahead and change them and maybe, for example, you use more complex rules or, you know, complex password creation requirements added on top of that there.

61
00:06:24,390 --> 00:06:27,150
So I'm available probably on Discord right now.

62
00:06:27,830 --> 00:06:33,430
And so I'll be able to answer questions about how potentially you might be able to tweak this in order to help in a scenario like this here.

63
00:06:36,940 --> 00:06:42,800
The fact that there's a lot of academic papers about this, though, is when I give a talk like this, I don't actually have to create any of my own graphs.

64
00:06:42,800 --> 00:06:49,020
I just can go to other papers there, you know, look at the research that other people have done, and just pull out their graphs in order to be able to talk with it here.

65
00:06:50,480 --> 00:07:00,340
So one thing that I really kind of want to highlight, though, and you need to kind of look at this with a bit of a skeptical eye, is that you'll notice that all these cracking sessions are really, you know, short.

66
00:07:00,600 --> 00:07:04,800
I know, you know, one, you know, trillion guesses here, that might sound like a lot.

67
00:07:04,980 --> 00:07:10,180
But when you start talking about, you know, GPU password cracking, you're talking about like under a second in order to generate all those.

68
00:07:10,420 --> 00:07:12,980
So that's just, you know, no time whatsoever.

69
00:07:13,400 --> 00:07:21,780
And part of reason for this here is that the PCFG approach, it's very slow, it doesn't, you know, scale very well with multi-threading currently.

70
00:07:22,740 --> 00:07:35,520
So when you start talking about, you know, passwords that you want to be able to crack, it works very well when you're going ahead targeting very slow password hashes, where you can only make, you know, you know, thousands of guesses a second, because the hash is very slow.

71
00:07:35,520 --> 00:07:44,160
But we start talking about things like, you know, unsalted MD5, other attacks that are going to be much more effective, because you can just make so many more guesses in the same time frame there.

72
00:07:44,640 --> 00:07:52,160
So when you start talking, looking at, you know, faster password hashes, you can certainly go ahead and still use a PCFG to supplement your attack.

73
00:07:52,460 --> 00:07:56,900
And you can still go ahead and crack some passwords that you might not normally get.

74
00:07:57,160 --> 00:08:06,740
But in general, for the faster password hashes, you really are going to want to go ahead and use more traditional types of password cracking attacks in order to really make use of the hardware that you have available to you.

75
00:08:09,940 --> 00:08:18,820
So I want to talk about this graph kind of, though, and really focus on it, because this was a really neat study done by Carnegie Mellon University.

76
00:08:18,820 --> 00:08:31,200
And one of the problems when you look do academic research, especially when you start talking about offensive tactics, is that the academics are, you know, running attacks themselves.

77
00:08:31,200 --> 00:08:38,480
So you're looking at the, you know, the how effective students are at cracking passwords versus someone professional, potentially.

78
00:08:39,220 --> 00:08:47,640
So CMU, you know, took the probably the, you know, the most straightforward approach to be able to solve that problem was they went out and reached out to CoreLogic.

79
00:08:47,640 --> 00:08:48,540
You might have heard of them.

80
00:08:48,540 --> 00:08:50,280
They're running this, you know, password village.

81
00:08:50,280 --> 00:08:52,000
They run the Crack Me If You Can competition.

82
00:08:52,460 --> 00:08:56,260
So when you're trying to find an expert, you know, they're like, you know, way up there.

83
00:08:56,720 --> 00:08:59,060
So they're a pretty good representation for that there.

84
00:08:59,660 --> 00:09:04,200
So what they did was they gave, you know, one of the CoreLogic engineers a password list.

85
00:09:04,600 --> 00:09:06,160
They asked them to crack it.

86
00:09:06,220 --> 00:09:10,300
And they recorded, you know, how many passwords they cracked over time.

87
00:09:10,300 --> 00:09:11,540
It was the number of guesses they made.

88
00:09:11,540 --> 00:09:14,060
And then they compared it against other cracking sessions as well.

89
00:09:14,920 --> 00:09:27,640
And, you know, one thing I'm really, you know, it makes me smile every time I see this here is that the PCFG did really well compared to the pros, which was CoreLogic, for that short cracking session.

90
00:09:28,140 --> 00:09:40,740
So when you start asking, like, you know, can this represent, you know, how a real professional password cracker operates, the short answer is it certainly, you know, appears to be able to be able to do that there.

91
00:09:41,120 --> 00:09:48,780
So, you know, full disclaimer, when you gave, you know, CoreLogic more time, they definitely performed way better.

92
00:09:48,840 --> 00:09:52,020
This is a logarithmic graph, so that's about 100 times more guesses.

93
00:09:52,700 --> 00:10:02,480
And also, I'll admit this wasn't fair to CoreLogic either, because, you know, that's not typically how, you know, people crack passwords in real life there.

94
00:10:02,480 --> 00:10:05,880
It was such a short, you know, cracking session.

95
00:10:06,540 --> 00:10:14,580
And when it is that short, usually it's against a really strong password and you have a lot of time in order to really manually tweak your attack that you're running there.

96
00:10:15,040 --> 00:10:29,480
That being said, if any of you are listening, I would love to have a repeat or a rematch of this, you know, attack just to see, you know, how this performs with all the new improvements that have been made into PCFGs.

97
00:10:29,480 --> 00:10:33,440
And I'm sure that, you know, CoreLogic has really been upping their game over the years as well.

98
00:10:39,160 --> 00:10:44,600
So that's why I'm somewhat hopeful that we'll be able to find it, now.

99
00:10:47,010 --> 00:10:50,250
So enough about, you know, all the research side of that there.

100
00:10:50,270 --> 00:10:54,110
Let's talk about how to actually make use of this PCFG password cracker.

101
00:10:54,170 --> 00:10:58,870
So the first thing is you just go ahead and download it from the GitHub repo.

102
00:10:59,410 --> 00:11:03,430
And the requirements of it, I really have strived to make it as simple as possible.

103
00:11:03,610 --> 00:11:06,570
So you need to have Python 3, and that's it.

104
00:11:07,290 --> 00:11:12,830
So there's an optional Karadet Python module that can help during the training.

105
00:11:13,750 --> 00:11:21,330
And that's because it helps detect what character encoding the training set is, because character encoding is the bane of my password cracking existence.

106
00:11:21,450 --> 00:11:22,670
But even that's optional.

107
00:11:22,670 --> 00:11:26,250
And actually, it's now being installed as part of PIP 3.

108
00:11:26,390 --> 00:11:30,570
So if you have PIP, you probably don't even need to install it yourself as well.

109
00:11:30,570 --> 00:11:36,890
And this is really useful, though, because I find a lot of situations where, like, when I'm cracking passwords, like, I don't have, like, internet access.

110
00:11:37,050 --> 00:11:41,710
So it's really nice to be able to go ahead and quickly throw my tool on a box and get it to run.

111
00:11:41,710 --> 00:11:44,670
So if you can run Python 3 on a box, you can probably run this here.

112
00:11:44,670 --> 00:11:46,830
So I've tried it on a bunch of different OSs.

113
00:11:47,090 --> 00:11:49,390
I've actually even gotten it to run on NetBSD.

114
00:11:49,590 --> 00:11:52,470
And it was the only thing I've ever gotten to be able to run NetBSD.

115
00:11:53,310 --> 00:12:01,230
So hopefully this is easier than your typical academics tool set in order to get it installed and start cracking passwords with as quickly as you can.

116
00:12:02,710 --> 00:12:09,170
So we start talking about hardware requirements, because that's always an important portion when we start talking about password cracking.

117
00:12:09,710 --> 00:12:16,390
The PCFG tool set, it is single-threaded CPU bound, which is why it's so awfully slow.

118
00:12:16,610 --> 00:12:19,310
But it will use an entire CPU thread.

119
00:12:19,310 --> 00:12:25,470
So you do really need to dedicate one full CPU, you know, thread to the PCFG.

120
00:12:26,170 --> 00:12:28,610
The other thing is it has very high RAM usage.

121
00:12:29,010 --> 00:12:32,670
It basically maintains a lot of different data structures and memory.

122
00:12:32,770 --> 00:12:35,310
And those data structures become more complex over time.

123
00:12:35,310 --> 00:12:36,650
So it just grows.

124
00:12:36,790 --> 00:12:42,170
So I could have done some things, tried to go and prune that or, you know, move some of it to disk.

125
00:12:42,250 --> 00:12:43,730
But RAM is cheap.

126
00:12:43,910 --> 00:12:45,590
So I haven't.

127
00:12:45,630 --> 00:12:47,230
So it'll just keep on growing over time.

128
00:12:47,230 --> 00:12:50,570
So initially, it starts out pretty low usage.

129
00:12:50,650 --> 00:13:00,810
But if you're talking about running this, you know, password cracking session for like a week or two, you really need to have at least 16 gigabits of RAM to really kind of just fully dedicate to the PCFG tool set itself.

130
00:13:03,900 --> 00:13:08,300
So the next step is to actually make use of it and run it.

131
00:13:08,800 --> 00:13:14,200
So I apologize up front that I tend to use the words rule set and grammar interchangeably.

132
00:13:14,200 --> 00:13:16,740
At least to me, they mean the exact same thing.

133
00:13:16,840 --> 00:13:26,820
But really what I'm talking about is that, you know, I mentioned, you know, machine learning a couple of times here, you have to go ahead and train a grammar on existing password data set.

134
00:13:27,280 --> 00:13:32,800
Now, you may want to have, you know, you know, different grammars for different targets that you're trying to target.

135
00:13:32,800 --> 00:13:39,380
So if you're trying to target, you know, a web application catering to younger people, you might want to train it on passwords that resemble that.

136
00:13:39,380 --> 00:13:48,460
If you're trying to target, you know, corporate passwords, you might want to train on corporate passwords instead, and use those rule sets against target passwords that you're specifically you think will match that.

137
00:13:48,460 --> 00:13:54,180
So you can have as many rule sets as you want to be able to really kind of fine tune your cracking session there.

138
00:13:54,520 --> 00:14:04,800
So the default one rule set that comes with the PCFG password cracker was actually trained on a subset of 1 million passwords from the Rocky data set, which came out in 2008.

139
00:14:04,800 --> 00:14:06,260
And it was against web passwords.

140
00:14:06,260 --> 00:14:08,700
So there wasn't really any strong password requirement whatsoever.

141
00:14:08,780 --> 00:14:10,680
I've been thinking about updating that.

142
00:14:10,680 --> 00:14:19,440
So if you have a good data set that you think that I should use for that there, I'm open to hearing about that there to make it a little bit more effective.

143
00:14:19,540 --> 00:14:24,300
But that being said, the Rocky data set is still extremely effective even to this day.

144
00:14:24,940 --> 00:14:27,740
It's just, you know, Blink-182 is not nearly as popular.

145
00:14:28,640 --> 00:14:34,960
So after you choose the data set that you want to use, though, now you go ahead and start generating guesses.

146
00:14:34,960 --> 00:14:36,240
So it's a Python program.

147
00:14:36,240 --> 00:14:37,900
So you just run, you know, Python 3.

148
00:14:37,940 --> 00:14:44,780
You run the PCFG guesser.py tool from the repo.

149
00:14:45,420 --> 00:14:46,740
You get it in the ender rule set.

150
00:14:46,740 --> 00:14:47,800
By default, it's default.

151
00:14:47,840 --> 00:14:52,660
So if you don't go ahead and specify that there, it'll go ahead and use the Rocky data set.

152
00:14:52,940 --> 00:14:55,360
And then you go ahead and specify session name as well.

153
00:14:55,580 --> 00:14:57,640
By default, this is default as well.

154
00:14:58,040 --> 00:15:01,760
And so the session is used to restart a password cracking session.

155
00:15:02,020 --> 00:15:06,080
So if you have to cancel it for whatever reason, you can go ahead and restart it back up again.

156
00:15:09,720 --> 00:15:16,380
So I really want to kind of highlight, though, that the PCFG tool set is only a password guess generator tool set.

157
00:15:16,380 --> 00:15:17,820
It will generate password guesses.

158
00:15:17,820 --> 00:15:19,740
It'll generate those password guesses in probability order.

159
00:15:19,740 --> 00:15:24,060
So it'll start with the most probable password guess, second most probable password guess, and keep on going down the line.

160
00:15:24,060 --> 00:15:27,320
It will not actually hash and crack any passwords.

161
00:15:27,480 --> 00:15:30,740
So you need to use another password cracking tool set for that there.

162
00:15:31,260 --> 00:15:38,280
You know, both JohnDeRipper and Hashcat work are basically any other password cracking tool that accepts, you know, guesses in from, you know, the standard input there.

163
00:15:38,500 --> 00:15:41,040
As I mentioned earlier, I'm on team JohnDeRipper.

164
00:15:41,040 --> 00:15:44,960
So I'm going to go ahead and use JohnDeRipper for pretty much all my examples here.

165
00:15:44,960 --> 00:15:46,940
But you can totally use Hashcat as well.

166
00:15:47,780 --> 00:15:52,260
So in order to do this here, you run the, you know, the previous command that, you know, I talked about.

167
00:15:53,220 --> 00:15:56,320
And then you run, you know, pipe it into, for example, John.

168
00:15:56,320 --> 00:16:00,840
And on John, they have, you know, a command called standard in, so that you type that in there.

169
00:16:00,840 --> 00:16:08,820
And instead of running data from like a word list, or generate your password guesses, it'll go ahead and use the password guesses that are piped into it instead.

170
00:16:09,780 --> 00:16:10,860
And you're cracking passwords.

171
00:16:10,860 --> 00:16:12,900
That's really all there is to it.

172
00:16:13,980 --> 00:16:17,820
So there's definitely optimizations for actually using this in the real world, though.

173
00:16:17,820 --> 00:16:23,600
So the first thing I really kind of want to highlight is a lot of times you want to know what the status of a cracking session is.

174
00:16:24,160 --> 00:16:34,360
So the challenge when you are using the pipe command, though, is if you go ahead and hit the enter button on your keyboard, instead of sending the enter button to JohnDeRipper, it's going to go ahead and forward that to my tool instead.

175
00:16:34,720 --> 00:16:39,160
So you might want to be able to, you know, get JohnDeRipper to output a status report.

176
00:16:39,160 --> 00:16:43,280
The way that you do that is you send a siguser1 signal to JohnDeRipper.

177
00:16:43,440 --> 00:16:50,760
If you're writing this on a Linux system here, you just type in kill-siguser1 and then the process identifier JohnDeRipper.

178
00:16:50,760 --> 00:16:58,500
And when you do that and hit enter, it'll be just like hitting enter on the JohnDeRipper itself and it'll go ahead and output the status output of its current cracking session.

179
00:17:00,120 --> 00:17:07,180
So now you can do things like, okay, not only see the passwords are getting cracked, but you can see like the number of hashes, the total number of hashes are cracked so far.

180
00:17:07,320 --> 00:17:09,500
You can see like, for example, the guessing speed.

181
00:17:09,500 --> 00:17:11,960
So in this case, it's making about 4 million guesses a second.

182
00:17:12,160 --> 00:17:16,160
And then you can see like how long it's been running and, you know, all the other, you know, options as well.

183
00:17:19,000 --> 00:17:31,140
So I want to kind of dig into that one, you know, output of that cracking session though, because I think, you know, this really kind of helps demonstrate kind of some of the power of using the PCFG.

184
00:17:31,760 --> 00:17:35,980
Because normally when you're, this here is showing the passwords as they get cracked.

185
00:17:37,500 --> 00:17:47,000
So you can kind of see that it's not just going ahead and, you know, figuring out one rule and then exhausting that rule and then going to the next rule like you would see in the more traditional password cracking session.

186
00:17:47,140 --> 00:17:53,680
Instead, it's creating much more fine grained rules and iterating between all those depending on what the current probability of it is here.

187
00:17:53,740 --> 00:18:00,720
So when you see these passwords being cracked, it's kind of fun to try to figure out like how did the underlying system, you know, generate that password guess?

188
00:18:00,720 --> 00:18:04,000
Why is it making the guess right now that that it is?

189
00:18:05,020 --> 00:18:08,940
So kind of if you look up, you know, initially here, like this is pretty easy.

190
00:18:08,940 --> 00:18:11,020
Okay, it's just taking like some five letter word.

191
00:18:22,900 --> 00:18:25,140
I apologize, my microphone just died here.

192
00:18:25,200 --> 00:18:28,000
So fun doing, you know, DEF CON remote.

193
00:18:29,520 --> 00:18:34,480
So, you know, it's using five digits, you know, or five letter words plus four digits here.

194
00:18:35,980 --> 00:18:39,240
Moving on, though, this is a kind of an interesting one here is SES is cool.

195
00:18:39,320 --> 00:18:43,980
So I looked into my input dictionary and SES is cool was not in my input dictionary or my train set at all.

196
00:18:44,240 --> 00:18:47,220
And I found out that it was actually you doing multi words for this year.

197
00:18:47,220 --> 00:18:49,640
So it was combining, you know, SES and then it's cool.

198
00:18:50,620 --> 00:19:00,520
So one kind of cool thing about this, and I'll talk to us about this a little bit later, is that instead of, you know, going ahead and breaking this up into three words, like we normally would think about it there, it actually broke it up into two different words.

199
00:19:00,520 --> 00:19:01,540
So SES is cool.

200
00:19:01,540 --> 00:19:06,160
So that way you can go ahead and go through it and say like, is, you know, Katie cool?

201
00:19:06,160 --> 00:19:07,980
Is, you know, Allie cool?

202
00:19:07,980 --> 00:19:09,480
Is Bob cool?

203
00:19:09,480 --> 00:19:11,340
Because there's a lot of cool people out there.

204
00:19:11,460 --> 00:19:18,140
So it can go ahead and iterate through those there and try that type of, you know, mangling rule for it there.

205
00:19:18,140 --> 00:19:27,540
And what's really cool about this is that it learned that is cool is a common word from the train set itself.

206
00:19:27,540 --> 00:19:30,280
So I didn't actually ever program in that logic into it.

207
00:19:30,280 --> 00:19:37,700
It learned it by itself by looking at the training data, which is, as I said, pretty cool.

208
00:19:39,660 --> 00:19:43,320
But you can see after that there, it kind of went into brute force.

209
00:19:43,320 --> 00:19:49,380
It wasn't the pure brute force, and I'll talk about the different types of brute force here, is actually combining some very short words, kind of like a combinator attack.

210
00:19:49,520 --> 00:19:53,420
But still, you know, it's able to kind of get that out that way.

211
00:19:54,520 --> 00:20:01,120
And then it went ahead and tried, you know, words with, you know, special characters, the same special characters at the beginning and the end of them too.

212
00:20:01,500 --> 00:20:07,540
And that's, you might be able to see that in a traditional password cracking session, but you actually have to have a rule in order to generate that.

213
00:20:07,540 --> 00:20:09,720
And trying to create those rules is a real pain.

214
00:20:09,720 --> 00:20:17,420
So you won't see those in, you know, most, you know, common publicly available rule sets, but it was able to learn that from the training data, which was, I thought, pretty cool as well.

215
00:20:19,500 --> 00:20:26,540
So down here, and I'm kind of, you know, need to get off the screen here, but you can see it's trying some longer words.

216
00:20:26,540 --> 00:20:33,120
But these are actually, while they're normal words here, it's actually generated them via the multi-words as well.

217
00:20:33,120 --> 00:20:35,640
So like finger plus nail, or 90 plus 9.

218
00:20:35,840 --> 00:20:45,180
And once again, this is kind of really useful because now you don't have to have things like 99, 98, 93, you know, in your data set, your word list as well, because it's generating those on the fly.

219
00:20:46,820 --> 00:20:50,880
Kind of going down a little bit further here, this is your more traditional kind of rule here.

220
00:20:50,880 --> 00:20:53,620
It's just two digits plus capitalizing the first letter of a word.

221
00:20:53,780 --> 00:20:54,920
So you can see it's starting to do that.

222
00:20:54,920 --> 00:20:58,740
But, you know, settings is a pretty uncommon password, word to be able to use.

223
00:20:58,760 --> 00:21:00,980
So it's trying it later in a cracking session here.

224
00:21:01,740 --> 00:21:03,820
And now it's even combining even more mangling rules.

225
00:21:03,820 --> 00:21:11,220
So it's trying, doing a multi-word, you know, of wood plus fish and, you know, Tara plus Don, and adding digits to the end of that as well.

226
00:21:11,220 --> 00:21:14,000
So you can see how it starts stacking these different rules together.

227
00:21:14,860 --> 00:21:21,260
And I kind of want to highlight that this cracking session has been going on, as you can kind of see from the status output, for about 13 minutes.

228
00:21:21,560 --> 00:21:23,860
So all the really easy passwords have already been cracked.

229
00:21:23,860 --> 00:21:27,580
It's already guessed, you know, 1, 2, 3, 4, 5, 6, and password 1, 2, 3, 4, 5, and so on.

230
00:21:28,160 --> 00:21:35,040
So these are starting to get into more of the, you know, the fuzzier of the rule sets that you might not normally see in a normal password cracking session.

231
00:21:38,130 --> 00:21:45,530
So as I mentioned a little bit earlier, if you hit the enter button, it's going to go to my program, not, you know, John the Ripper.

232
00:21:45,970 --> 00:21:50,790
But there's a lot of information that I want to be able to provide to people about the cracking session.

233
00:21:51,410 --> 00:21:58,510
So whenever you hit enter, or basically any of these R keys here, it'll display an output of what it's currently doing.

234
00:21:58,510 --> 00:22:04,650
So you can try to figure out, you know, whether you want to continue it, whether it's working correctly, and whether it's kind of doing what you want it to do as well.

235
00:22:05,330 --> 00:22:09,470
So kind of going through this here, I hit enter twice.

236
00:22:09,510 --> 00:22:13,590
And so you can kind of see how it's generating, you know, these password guesses as doing it here.

237
00:22:14,390 --> 00:22:19,050
So the first one, you know, it's, you know, basically going ahead and trying to combine two words.

238
00:22:19,050 --> 00:22:20,730
So it's a multi-word type of attack.

239
00:22:21,370 --> 00:22:31,070
And you can, if you dig into like the real details of it there, you can kind of see that it's trying like the hundred and forty-third most probable word with no capitalization.

240
00:22:31,310 --> 00:22:35,910
And it's combining it to the ninety-third most probable four-letter word with no capitalization as well.

241
00:22:35,910 --> 00:22:41,670
So you can see that the probabilities it assigns to like even individual words and stuff like that is very, very fine grained.

242
00:22:42,130 --> 00:22:46,710
So it's going to try some words, and then like do other mangling rules and stuff like that.

243
00:22:46,710 --> 00:22:50,770
And they'll go back to the less probable words later on in the cracking session.

244
00:22:53,070 --> 00:22:57,090
So now this next one here, it's kind of a little bit, I'll try to get out of the way or something like that.

245
00:22:57,170 --> 00:23:04,390
You can see that it switched to a real brute force attack using OMEN, ordered Markov enumerators.

246
00:23:04,530 --> 00:23:06,430
And I'll talk about that a little bit later there.

247
00:23:06,690 --> 00:23:10,870
But really, I kind of want to highlight though that it's trying, you know, more traditional cracking rules.

248
00:23:10,870 --> 00:23:14,010
So it's like, you know, combining words.

249
00:23:14,070 --> 00:23:15,430
And then it's switching to brute force.

250
00:23:15,430 --> 00:23:18,150
And then it'll switch to another mangling rule after this here.

251
00:23:18,150 --> 00:23:21,410
And then it'll just keep on going based upon whatever the current probability is.

252
00:23:23,070 --> 00:23:27,210
Now, as I said, I really struggle with documenting my code.

253
00:23:27,310 --> 00:23:33,190
So I try to go ahead and add as much documentation into the runtime behavior of it as possible.

254
00:23:33,270 --> 00:23:46,710
So if instead of hitting, you know, enter or anything else along those lines, you hit H and hit enter, it'll provide, or just H actually, it'll provide a SAS report output of what all these different fields here mean.

255
00:23:46,710 --> 00:23:52,390
And that SAS report actually is much longer than even, you know, displayed on the screen here.

256
00:23:52,630 --> 00:23:57,570
But it explains what all those different, like, letters like A5 or C5 actually stand for.

257
00:23:58,610 --> 00:24:03,830
The one thing that I kind of really want to highlight though is this one metric here called probability coverage.

258
00:24:04,110 --> 00:24:14,810
Because since the PCFG password cracker creates guesses in probability order, it starts with the very high probable passwords, and it goes to less probable passwords and less probable passwords.

259
00:24:15,330 --> 00:24:19,150
And the model that it has will basically never finish.

260
00:24:19,150 --> 00:24:23,010
It'll just keep on figuring new combinations of words to go through to it.

261
00:24:23,010 --> 00:24:28,470
So a real challenge becomes, you know, when do you go ahead and give up on a cracking session?

262
00:24:28,470 --> 00:24:30,370
So you haven't cracked the password.

263
00:24:31,730 --> 00:24:37,230
When should you go ahead and, you know, kill this off and try some other cracking type of attack that might be more successful?

264
00:24:37,350 --> 00:24:41,750
Or when do you go ahead and just choose to say, I'm not going to crack this password and move to a different case?

265
00:24:42,250 --> 00:24:51,190
So this probability coverage is a very fuzzy metric that I tried to develop to try to just give you a little bit of kind of a rule some about when that should be.

266
00:24:51,810 --> 00:25:09,790
So what this metric says is that if the target password is the same probability distribution as the password data set that I trained, and if my grammar and how to model how these passwords are created was exactly correct, this is the probability that we cracked this password.

267
00:25:09,790 --> 00:25:12,730
Now, neither one of those assumptions is actually true in real life.

268
00:25:12,730 --> 00:25:15,790
You know, the probability model of the password you're trying to crack is probably very different.

269
00:25:16,230 --> 00:25:21,090
You know, the grammar that I generate and train on is absolutely not perfect.

270
00:25:21,290 --> 00:25:25,690
But at least, as I said, it kind of gives you a rule of thumb to say, okay, you know, this is starting to get a little bit high.

271
00:25:25,750 --> 00:25:28,770
It says, you know, I had like a 90% chance to crack this password.

272
00:25:28,770 --> 00:25:30,090
I haven't cracked this password yet.

273
00:25:30,450 --> 00:25:32,210
Maybe I should go ahead and give up.

274
00:25:32,650 --> 00:25:37,950
And you'll notice this number jumps up really high initially because it's making, you know, high probability password guesses.

275
00:25:37,990 --> 00:25:45,170
And then it slows to a crawl to almost like no advancing after you get to, you know, like 70 or 80, 90 percent, you know, completion there.

276
00:25:46,210 --> 00:25:53,850
So this is kind of really good to be able to figure out, you know, where can I go ahead and devote that, you know, that one single CPU and that RAM to somewhere else there.

277
00:25:56,700 --> 00:26:03,780
So another usage tip I just kind of want to highlight is that sometimes the cracking dynamic when it comes to speed is completely reversed.

278
00:26:04,220 --> 00:26:15,400
So you might be trying to crack very, very computationally password hashes, expensive password hashes, or a lot of like, let's say, assaulted hashes, in which case you're really only making, you know, a couple guesses a second.

279
00:26:15,460 --> 00:26:21,640
Well, this generator is generating, you know, let's say, you know, between like, you know, 100,000 and like 4 million guesses a second.

280
00:26:21,640 --> 00:26:23,460
So it gets backlogged.

281
00:26:23,900 --> 00:26:29,840
And basically, essentially freezes while it waits for to be able to send more guesses to the password cracking program.

282
00:26:29,960 --> 00:26:35,460
So occasionally, if you hit enter, it won't actually display set the status or it'll take a while to display the status.

283
00:26:35,520 --> 00:26:37,680
And that's kind of usually what's happening.

284
00:26:37,720 --> 00:26:53,620
So if that's happening, and you're kind of curious whether the password cracking session has crashed or not, I recommend going back to earlier advice about sending a signal to, let's say, John Ripper, and just seeing how that's doing there in order to make sure that your password cracking session is still running.

285
00:26:56,680 --> 00:27:05,920
So, as I talked about, you know, multi-word feature has probably been the biggest, you know, addition to the new 4.0 rewrite.

286
00:27:05,920 --> 00:27:11,220
And it has completely shocked me how effective this has been here.

287
00:27:11,320 --> 00:27:14,540
So I won't get talk too much details about it.

288
00:27:14,540 --> 00:27:19,720
But the one thing I want to really kind of stress, though, is that it is not language specific at all.

289
00:27:19,720 --> 00:27:25,200
It learns all what constitutes a word from the training set that you're giving it there.

290
00:27:25,200 --> 00:27:32,820
So it'll pick up things like new band names or proper nouns that are really hard to specify inside the language dictionary or whatever new Pokemon just came out.

291
00:27:33,000 --> 00:27:37,260
And identifies patterns like, you know, I love, and stuff like that.

292
00:27:37,420 --> 00:27:48,860
So this is very useful for being able to, you know, you know, try to target new, you know, password hashes.

293
00:27:49,160 --> 00:27:51,740
So, as I said, it's not language specific.

294
00:27:51,740 --> 00:27:58,200
It works best with, I would say, kind of like European English type languages.

295
00:27:58,880 --> 00:28:04,200
It really struggles still with some of the other languages like Mandarin.

296
00:28:04,220 --> 00:28:08,700
But that is something absolutely that I really want to focus on more going forward here.

297
00:28:09,220 --> 00:28:10,140
It's not perfect.

298
00:28:10,140 --> 00:28:11,660
It's definitely a work in progress.

299
00:28:12,320 --> 00:28:16,060
So there is a balance between, you know, creating, you know, false positives and matches here.

300
00:28:16,320 --> 00:28:20,960
If you don't see some of the base words in the train set by themselves, it won't identify them.

301
00:28:21,260 --> 00:28:23,980
But it's something that is evolving.

302
00:28:23,980 --> 00:28:34,340
And part of the new pull request that I just received from somebody else actually has some improvements to this here that I'm really excited about, again, pushing to Maine.

303
00:28:37,380 --> 00:28:42,360
So one of the other big features that have been added recently here is ordered Markov enumerator.

304
00:28:45,940 --> 00:28:51,140
And the whole reason why I talked about this is that a similar approach can be taken for pretty much anything.

305
00:28:51,520 --> 00:28:59,780
So if someone creates a better cracking attack or cracking mode, it can totally be incorporated into a PCFG style attack.

306
00:29:00,180 --> 00:29:03,120
I'll be a little bit like the Borg in that respect.

307
00:29:03,820 --> 00:29:07,800
But the real challenge is to be able to figure out how to assign a probability to a password guess.

308
00:29:07,800 --> 00:29:11,600
So if you can assign a probability to a password guess, I can probably incorporate it into a PCFG.

309
00:29:15,320 --> 00:29:24,480
So just kind of in the last little bit here, I really kind of want to highlight some additional tricks that are very useful when it comes to cracking passwords.

310
00:29:24,660 --> 00:29:29,780
So the first one here is this skip root flag in the PCFG.

311
00:29:29,800 --> 00:29:32,560
And basically what this does is disable omen guest generation.

312
00:29:32,760 --> 00:29:37,800
And that's not to say that omen guest generation is something that's bad to do.

313
00:29:37,800 --> 00:29:41,600
It certainly definitely helps increase the success of a password cracking session.

314
00:29:42,000 --> 00:29:45,120
But this is a way to paralyze your attack.

315
00:29:45,120 --> 00:29:54,960
So if you're having another system that's going ahead and really cranking through your brute force attack, you might want to go ahead and do all your brute force on that other system or on that other thread.

316
00:29:55,040 --> 00:29:58,540
And then run the PCFG guesser really just to focus on the word mangling rules instead.

317
00:29:58,540 --> 00:30:03,160
So in order to do that, all you need to do is just when you run it, just type in skip root.

318
00:30:07,450 --> 00:30:10,630
Another flag that's really kind of useful is the all lower flag.

319
00:30:10,630 --> 00:30:14,610
And what this means is it'll stop doing any sort of case mangling on the password guesses.

320
00:30:15,050 --> 00:30:23,170
So let me try to move my picture just a little bit here just to make it easier to read as I go back.

321
00:30:24,510 --> 00:30:25,790
I apologize.

322
00:30:27,070 --> 00:30:27,990
Okay.

323
00:30:30,310 --> 00:30:30,770
So

324
00:30:34,150 --> 00:30:39,830
a lot of times you may want to not go ahead and do case mangling inside of PCFG itself.

325
00:30:39,950 --> 00:30:45,550
And one reason might be that the hash that you're targeting is case insensitive like landman.

326
00:30:45,830 --> 00:30:51,470
That's not probably the best example, though, because if you're cracking landman hashes, you're not using PCFG in order to do that there.

327
00:30:51,470 --> 00:30:55,750
You're just going ahead and brute forcing that sucker and taking it out that way.

328
00:30:56,190 --> 00:31:02,330
Where it's more likely, though, is that case mangling is very distinct for how people do it there.

329
00:31:02,330 --> 00:31:09,850
So if someone does a certain type of case mangling, they have a tendency to keep on using that strategy for all their other passwords.

330
00:31:10,010 --> 00:31:15,670
So when you start doing things like targeted password cracking, you may not want to go ahead and just go ahead and do what everyone does.

331
00:31:15,670 --> 00:31:19,390
You want to really make a really specific case mangling for that particular individual.

332
00:31:19,550 --> 00:31:26,310
In that case, the better way to do this is that JohnRipper supports a really powerful feature called Pipe.

333
00:31:27,110 --> 00:31:41,910
So what the Pipe does is instead of just going taking the guesses in from standard input and running them as is, you can apply additional rules on top of that like you would do in a traditional password cracking dictionary type of attack.

334
00:31:41,910 --> 00:31:53,410
So you can specify your very specific case mangling rules inside JohnRipper's rule set and then pipe the lowercase password guesses right into JohnRipper and have JohnRipper capitalize it itself.

335
00:31:53,410 --> 00:31:59,170
And that can be very powerful when you have an idea of what type of case mangling you want to be able to target.

336
00:32:07,620 --> 00:32:12,600
So I of course moved it to the wrong portion here.

337
00:32:14,220 --> 00:32:16,040
Let me move my screen again here.

338
00:32:16,040 --> 00:32:16,800
I apologize.

339
00:32:18,640 --> 00:32:19,460
Some kind of improvements.

340
00:32:19,460 --> 00:32:25,360
As I mentioned, there was an amazing pull request that was submitted to me with a bunch of new features.

341
00:32:25,360 --> 00:32:32,120
I'm slowly incorporating them into the core, but I actually have the features available as their own kind of tool called segmenter.py.

342
00:32:32,120 --> 00:32:37,520
I mean, and I apologize if I mispronounce your name because I've only seen it written.

343
00:32:37,520 --> 00:32:44,960
But Chun-Wan Wang submitted this here and it really impresses me there.

344
00:32:45,120 --> 00:32:48,580
So probably the biggest feature I'm really excited about is leet-speak replacement.

345
00:32:48,580 --> 00:32:52,840
This has been a feature that has been kind of my white whale as far as implementing.

346
00:32:53,120 --> 00:32:57,060
And it's just every single time I've gone through it, it's just not been very effective.

347
00:32:58,260 --> 00:33:05,540
But that's currently incorporated into this tool he has called segmenter.py.

348
00:33:05,580 --> 00:33:09,820
That's been included in the repo that will go ahead and try to parse that information out.

349
00:33:09,820 --> 00:33:16,160
So I'm looking at getting that incorporated into my core trainer and getting that incorporated into password cracking sessions in order to be able to really target that there.

350
00:33:16,840 --> 00:33:19,300
He also improved some of the multi-word detection.

351
00:33:19,300 --> 00:33:20,800
So he made that better.

352
00:33:20,980 --> 00:33:30,740
And then he also has incorporated some new approaches into the password score, which is a different tool that you can go ahead and submit your password into the password score.

353
00:33:30,820 --> 00:33:34,540
And they'll tell you what the probability your password is, which is kind of nice as well.

354
00:33:35,100 --> 00:33:36,720
So all credit goes to him for this.

355
00:33:36,720 --> 00:33:39,440
I'm really impressed with this here.

356
00:33:39,700 --> 00:33:43,540
And if anyone else is looking at helping out too, I'm all about that.

357
00:33:43,540 --> 00:33:46,540
So thank you very much once again for that there.

358
00:33:51,100 --> 00:33:53,800
Okay, so let me move my screen around again here.

359
00:33:58,640 --> 00:34:04,420
Okay, so the next thing I currently want to talk about here is the compiled PCFG guesser.

360
00:34:04,420 --> 00:34:07,760
So I've been talking about the Python tool set all along right now.

361
00:34:08,160 --> 00:34:12,280
So the compiled PCFG guesser is a completely different, you know, fork.

362
00:34:12,380 --> 00:34:17,780
And as you kind of get the name there, it's still being written in Python, it's written in compiled C code.

363
00:34:18,020 --> 00:34:26,460
It's a little bit harder to get actually installed and running simply because when you start talking about compiling your code, you know, it runs great on my machine, but it has challenges elsewhere.

364
00:34:26,540 --> 00:34:30,980
I tried to go ahead and use a Hashcat build make file for this.

365
00:34:30,980 --> 00:34:36,980
So if you can build Hashcat on your computer, you have at least a better chance of being able to go ahead and get this running as well.

366
00:34:37,900 --> 00:34:47,260
But if you have problems, please, you know, reach out to me on the GitLab or GitHub site, and I can try to help you fix those there.

367
00:34:47,900 --> 00:34:51,340
So I will say that the trainer portion, it will always be in written in Python.

368
00:34:51,340 --> 00:34:54,540
I just like writing Python too much to change that over.

369
00:34:54,940 --> 00:35:03,540
So basically, you'll go ahead and create train rule sets with the Python trainer, but then copy them over to be used in the compiled version here.

370
00:35:04,480 --> 00:35:11,160
Also, the compiled version has a tendency to lag in features from the Python tool set, because once again, I like writing Python.

371
00:35:11,820 --> 00:35:13,780
I'm not the best C coder in the world.

372
00:35:14,540 --> 00:35:20,800
So basically, if I write a hello world program, it's going to have like five buffer overflows and, you know, a segfault.

373
00:35:21,440 --> 00:35:28,380
So take what you will there, but I'm making this available.

374
00:35:28,380 --> 00:35:31,080
If someone wants to write a better one, I'm totally open to that as well.

375
00:35:31,440 --> 00:35:35,800
But, you know, it doesn't have save restore, it doesn't have status outputs, and it has no omen guest iteration.

376
00:35:36,520 --> 00:35:40,980
So all that being said, you know, why bother with this here?

377
00:35:41,220 --> 00:35:50,320
And really, at the end of the day, the main reason is it's about 20 times faster than the Python tool set.

378
00:35:50,320 --> 00:35:53,760
And I've always heard that, you know, C code is faster than Python.

379
00:35:53,760 --> 00:35:55,760
But when I saw that, I was like, holy crap.

380
00:35:55,760 --> 00:35:57,740
So I will be up front.

381
00:35:57,740 --> 00:36:06,620
I'm actually, even with all these limitations, when I'm cracking passwords, I'm using the compiled C version now much, much more often than I'm using the Python one there.

382
00:36:07,100 --> 00:36:12,740
So because that 20 speed improvement is hard to beat for most password cracking sessions.

383
00:36:16,120 --> 00:36:20,240
So now I'm going to talk real quick about training passwords.

384
00:36:21,080 --> 00:36:23,060
So I've been talking about this a lot here.

385
00:36:23,080 --> 00:36:26,580
And there's a lot of different reasons why you want to go ahead and create a new password training set there.

386
00:36:26,660 --> 00:36:29,180
So language is a huge one.

387
00:36:29,460 --> 00:36:34,480
So you want to be able to train on passwords that are similar to the target that you're trying to target.

388
00:36:35,260 --> 00:36:40,280
And another big one is that corporate passwords are very, very different than you'll see from websites.

389
00:36:40,500 --> 00:36:46,560
And I'm sure you probably heard CoreLogic talk about this before, you know, yesterday.

390
00:36:47,440 --> 00:36:49,980
But that's something that, you know, is very evident.

391
00:36:49,980 --> 00:36:58,580
So if you're trying to target corporate passwords, you probably do want to go ahead and train on corporate passwords versus going ahead and training on passwords for some gaming website.

392
00:37:02,860 --> 00:37:11,060
So another reason to go ahead and train it, though, is if you're targeting a specific password creation policy, or you know which mangler rules your target prefers.

393
00:37:11,060 --> 00:37:17,440
So one way to be able to really target that there is to train only on passwords that match that training set there.

394
00:37:17,440 --> 00:37:24,440
And there's other things you can do, like the password rules, or the, you know, the grammar that I generate.

395
00:37:24,800 --> 00:37:29,560
I made sure that I didn't include anything like a CRC check or any of those sanity checks into it there.

396
00:37:29,560 --> 00:37:35,140
So you can actually open up the files themselves, they're just text files, and start editing the probabilities of different things in them by hand, too.

397
00:37:35,140 --> 00:37:41,480
So if you say, like, oh, this is one word I really want to go ahead and make it, like, highly probable, but I don't want to go have to train on a whole new training set.

398
00:37:41,480 --> 00:37:49,200
You can just go ahead and open it up, put that word in there, give it whatever probability you want, and that will just be read in and used in your password cracking session there.

399
00:37:49,980 --> 00:37:57,520
So the other reason to train on a password train set there is it generates a bunch of information and extracts a lot of information from that password set.

400
00:37:57,560 --> 00:38:01,880
So it's really useful to be able to analyze a new dump that you have accessible to you there.

401
00:38:01,880 --> 00:38:09,700
So for example, it'll pull out, like, common emails, it'll pull out dates and websites, and try to help you figure out where did this, you know, password data set come from there.

402
00:38:13,590 --> 00:38:19,130
So the next question, of course, is, you know, where do you go ahead and, you know, get these password data sets from?

403
00:38:19,670 --> 00:38:27,290
So there's a lot of challenges with this, too, because a lot of data sets are not optimal when it comes to training on.

404
00:38:27,390 --> 00:38:33,990
So I don't know if you know of hashes.org, but it's a really great site for being able to download all these, you know, dumps as they come out here.

405
00:38:34,890 --> 00:38:39,010
So for example, let's say you want to go ahead and train on this data set here.

406
00:38:39,010 --> 00:38:44,290
I'm not going to try and pronounce the name of that site, because I'm sure I'll just horribly, horribly mangle it there.

407
00:38:44,490 --> 00:38:53,430
But when I did some googling about this site here, it was a site for, you know, new college students trying to find a job in China.

408
00:38:53,550 --> 00:38:59,910
So that's kind of an interesting data set there that you might want to be able to use in order to train for correct passwords here.

409
00:39:00,750 --> 00:39:13,290
So if you download something from, like, hashes.org, the first and most important thing is select the plain text option to train your rule set on, because you don't want to include the hash part of your training set, because then you'll think it's part of the password and just it goes poorly there.

410
00:39:14,350 --> 00:39:38,210
So one other thing I really kind of want to highlight here, and this is a feature that I'm hopeful to be able to get added to the PCFG tool set, but I was informed by the owner of the site here that they actually do some additional things for encoding non-UTF-8 characters that my trainer will not fully parse correctly.

411
00:39:38,550 --> 00:39:47,130
So that's something I need to add in too, so that it goes ahead and, you know, uses the correct character encoding for non-English passwords.

412
00:39:47,410 --> 00:39:51,990
So I just want to put that warning out too for trying to train this on things like Mandarin.

413
00:39:55,080 --> 00:40:00,000
But one problem with a lot of these dumps here is the first one is they don't contain duplicate guesses.

414
00:40:01,760 --> 00:40:11,540
So duplicate guesses are really important when it comes to trying to figure out what the probability of password is, because if you don't have duplicate guesses, 1, 2, 3, 4, 5, 6 looks like a very just random string.

415
00:40:12,400 --> 00:40:25,440
So that's useful, but I will say when you run longer cracking sessions with PCFGs, that lack of duplicates becomes less and less important, because you've already exhausted all the really probable password guesses.

416
00:40:25,780 --> 00:40:30,800
The one issue though is that the OMEN portion really does struggle without the duplicates.

417
00:40:31,280 --> 00:40:36,860
So you might not want to go ahead and enable OMEN guessing if you train on a data set that doesn't contain any duplicate guesses there.

418
00:40:37,620 --> 00:40:40,940
The other problem with these dumps is that they only contain the passwords that have been cracked.

419
00:40:41,660 --> 00:40:45,620
So basically you don't know or learn anything about the passwords that haven't been cracked.

420
00:40:45,680 --> 00:40:55,780
That's not a deal stopper, but just it's useful to keep that in mind there, that the cracked percentage is going to be very useful when it comes to figuring out how good a data set is in order to create a new rule set.

421
00:40:59,160 --> 00:41:06,440
So in order to train on a password data set there, really you just apply some program once again.

422
00:41:06,680 --> 00:41:12,660
You just give the name of the rule set that you want to be able to train it on, as well as the password data set that you want to train it on as well.

423
00:41:13,240 --> 00:41:20,880
And it'll go ahead and run in order to do all the parsing and stemming of the password data set here.

424
00:41:21,100 --> 00:41:31,200
So it will try to auto detect what that encoding is, but when in doubt, set it to be UTF-8 because the encoding really does matter quite a bit there.

425
00:41:32,780 --> 00:41:38,840
So the first pass it takes through the data set there, it learns all the character frequencies and base words for multi-word detection.

426
00:41:38,880 --> 00:41:43,660
So it actually makes a couple different passes through the same data set in order to learn more and more and more about it there.

427
00:41:44,880 --> 00:41:48,560
The second pass it goes through there, it'll do much of the real parsing of the password.

428
00:41:48,560 --> 00:41:54,440
So it figures out things like, you know, keyboard walks, alpha strings, you know, letters, how probable like the digits are and stuff like that.

429
00:41:54,440 --> 00:42:00,980
So most of the stuff you think of traditionally when you talk about, you know, what their probabilities of different, you know, things are, it does on the second run through.

430
00:42:02,100 --> 00:42:09,640
And it actually goes ahead and makes a whole third run through then to see about how effective things like, you know, OMEN would be for cracking passwords.

431
00:42:09,640 --> 00:42:14,420
So that kind of gets back to how OMEN generates the probability it's assigned with its different levels there.

432
00:42:15,260 --> 00:42:16,760
And so this takes a while.

433
00:42:17,020 --> 00:42:21,480
So if you're cracking, you're training it on a million passwords, you know, it's done in like a minute or two.

434
00:42:21,480 --> 00:42:25,300
If you're training it on a billion passwords , it takes significantly longer.

435
00:42:25,780 --> 00:42:29,780
And it has to keep all this data in memory.

436
00:42:29,880 --> 00:42:35,120
So if you're training on some of these really gigantic data sets there, it's just not going to work.

437
00:42:35,840 --> 00:42:45,080
So one thing you might want to do is just select a subset of that password set, you know, chosen randomly in order to train your rule set on instead.

438
00:42:47,120 --> 00:42:55,020
So after you're all done with that, though, it'll display statistics about the data set you just trained upon too, which are really kind of useful to figure out, you know, where it came from.

439
00:42:55,020 --> 00:42:58,140
So, you know, password lengths and stuff like that.

440
00:42:58,400 --> 00:43:14,140
But one thing that I've been kind of added that I found really useful is it'll display kind of like the top URLs, which are usually at the beginning, the top of them are like, you know, web, you know, email, email account information.

441
00:43:14,300 --> 00:43:20,660
But if you start getting down a little bit, you'll can actually see usually what the website is because people have a tendency to use the website in their password.

442
00:43:21,480 --> 00:43:28,000
I also highlight the dates that it finds it in there as well, because that's useful kind of trying to date when that password data set got leaked.

443
00:43:28,220 --> 00:43:31,680
Now, I want to kind of highlight that there's a long tail when it comes to the dates.

444
00:43:32,280 --> 00:43:33,000
I'm sorry.

445
00:43:33,620 --> 00:43:41,380
Because people, you know, create passwords before, you know, the password data set gets stolen.

446
00:43:41,520 --> 00:43:48,740
So, you'll see a lot of passwords for years before the data set actually gets down.

447
00:43:48,740 --> 00:43:56,560
But if you start kind of going down it a little bit, you can say, okay, that's probably about where the cutoff was for when this password data set was, you know, disclosed.

448
00:43:59,490 --> 00:44:05,150
So, kind of one last thing I really want to talk about real quick is that I am trying to get this to work with other cracking modes there.

449
00:44:05,530 --> 00:44:10,090
So, one of the, you know, really popular cracking modes used is called Prince.

450
00:44:10,530 --> 00:44:18,490
So, Prince basically takes a lot of different words and just combines them all together and makes lots of guesses based upon that.

451
00:44:18,730 --> 00:44:24,590
But one challenge with Prince is that it's very dependent upon the input word list that you give it to it there.

452
00:44:24,870 --> 00:44:29,310
Because the word list needs to have, you know, high quality words in it.

453
00:44:29,370 --> 00:44:32,510
But it also needs to have a level of kind of cruft in there too.

454
00:44:32,510 --> 00:44:39,330
Just because if you want to go ahead and, let's say, add the number one to the end of a word, you have one in your word list by itself.

455
00:44:40,010 --> 00:44:44,010
But the challenge is, the larger your word list is, the more words it's trying to combine.

456
00:44:44,250 --> 00:44:46,930
And then, you know, it starts to have issues there as well.

457
00:44:47,550 --> 00:44:51,330
So, we have all this probability information about how a password was generated.

458
00:44:51,330 --> 00:44:58,310
So, maybe we can go ahead and use this to create very bespoke word lists for like a Prince-style guessing session there.

459
00:44:58,830 --> 00:45:03,410
So, I created another tool called Princeling that basically just does that there.

460
00:45:04,250 --> 00:45:06,150
So, it goes...

461
00:45:10,300 --> 00:45:12,860
I'm sorry, my microphone just went out again there.

462
00:45:12,860 --> 00:45:20,060
But yeah, so it creates a very, you know, high quality word list there and does it automatically.

463
00:45:20,320 --> 00:45:25,280
Because one thing I like about Prince is it's the kind of the attack that I run when I want to goof off.

464
00:45:25,320 --> 00:45:29,500
So, like, you know, password cracking, sometimes it takes a lot of brain cells because you're kind of looking at how you're cracking.

465
00:45:29,500 --> 00:45:31,100
You're trying to optimize your cracking session.

466
00:45:31,400 --> 00:45:33,140
And Prince is like, I have no idea what I want to do.

467
00:45:33,140 --> 00:45:34,960
I want to go watch Tiger King on Netflix.

468
00:45:35,000 --> 00:45:37,960
Let's just go ahead and just launch this off and come back and see if it was successful.

469
00:45:37,960 --> 00:45:40,160
And Prince is usually actually quite successful.

470
00:45:40,820 --> 00:45:43,280
So, it's a pretty good tool to be able to use.

471
00:45:43,280 --> 00:45:48,580
And by anything that you can do in order to automate Prince even more, I'm all for, which is why I went ahead and created that.

472
00:45:51,140 --> 00:45:54,280
So, I'm going to go ahead and stop the live stream here.

473
00:45:54,280 --> 00:45:57,320
And hopefully, I'll be on Discord there in order to answer any questions that you have.

474
00:45:57,320 --> 00:45:58,000
I hope you enjoyed this.

475
00:45:58,000 --> 00:45:58,940
I hope this was helpful.

476
00:45:59,200 --> 00:46:03,800
And once again, you know, thank you for attending the Password Village here at DEF CON Safe Mode.