start	end	text
1370	6380	So real quick about me. I have a bit of a reputation as kind of approaching this as an academic
6380	11460	frameset, simply because I got started in the whole password cracking thing
12020	19440	through my research when I was getting my PhD. But I really do strongly believe in learning by
19440	25640	doing. So I'm an active member in Team John Ripper, and I do participate in password cracking
25640	29920	contests like, you know, Crack Me If You Can, that's going on right now. Luckily, this talk is,
29920	34800	you know, being filmed, you know, before the contest starts. So no spoilers here,
34800	40160	unfortunately. But good luck to everyone else who's participating. So password cracking,
40160	46920	really, it's my hobby and a little bit of an obsession. But it's not my day job, unfortunately.
47120	53320	But my day job has been very exciting recently, though, because I really focus on medical device
53320	60720	security. And you can imagine with all the craziness around COVID-19, it's been an interesting
60720	66800	time. So one project that I really kind of want to highlight is the Open Ventilator Monitoring
66800	72120	and Alerting Project that I've been helping to contribute to. And there's actually a talk at the
72120	77340	Biohacking Village this Sunday that I really highly recommend people go ahead and listen to,
77340	82180	so that our team members are giving it. And it really is going to talk to you about, you know,
82180	87160	the lessons learned and how other people can help contribute as well. Because this has been a big
87160	92820	problem because, as I'm sure you're aware, there's been a huge demand for ventilators to be able to
92820	98200	help deal with COVID-19. So there's been a lot of different projects that have kind of stood up
98200	104500	to try to help produce, you know, low-cost ventilators to help fill that need pretty
104500	110140	quickly there. So rather than have every single do-it-yourself ventilator develop their kind of
110140	114760	own monitoring and alerting framework, we're trying to produce one common one that can be
114760	120700	applied to all these different projects across the board. So because when you have these ventilators
120700	124800	being able to treating, you know, patients, the patients are highly infectious, so you don't want
124800	131040	to have the nurses exposed to that. But if something goes wrong, you need, you know, seconds
131040	135240	count. So you need to be able to forward all that sensing information that these ventilators are
135240	139380	doing back to a centralized nursing workstation. And you need to do that securely because you're
139380	147300	not just on a real hospital network. So that's been a really fulfilling project that I've been
147300	152580	working on. So another thing I'm kind of helping out with here, as I move my head, is I'm helping
152580	158400	out run the Defcon Biohacking Village's Capture the Flag contest. So this was originally supposed
158400	162780	to be in Vegas. That changed, of course. So now a lot of medical equipment is actually sitting in
162780	168060	my house. So I have to be able to provide a way for hackers from all over the world to be able
168060	172600	to log in and hack these infusion pumps here without also hacking my smart thermostat.
173120	177180	As part of that, I actually had to repurpose one of my password cracking rigs, as you can see there,
177180	182960	in order to run all the VMs that are helping to keep people, you know, on those ventilators
182960	191880	and hacking those and not, you know, hacking my smart thermostat. So probably the first
191880	199120	questions I should start kind of addressing here is, you know, what does that PCFG stand for in,
201200	207400	so originally, and I guess still technically, it stands for Probabilistic Context-Free Grammar,
207400	211580	which is the kind of the modeling framework it uses in order to model how people create passwords.
211740	216140	So if you're into, you know, the Siri Autonoma or, you know, formal languages, this might actually
216140	220380	mean something to you. But for most people, you know, they hear that and they're like, oh god,
220380	223860	that's like mass and stuff like that. I mean, there's no way it's going to run on my computer.
224420	230060	And then he's kind of like slowly walk away. So I decided in order, I need it need to have a more
230060	237020	descriptive name. So I went ahead and rebranded it the Pretty Cool Fuzzy Guesser. So, and this
237020	240280	kind of explains it a little bit better about what it's actually doing underneath the hood,
240280	244600	because you train this on a list of passwords. And then it'll go ahead and create guesses that
244600	249560	are similar to those passwords, but different, which is really kind of important in order to
249560	254520	help, you know, expand your cracking session. So I don't this is my favorite slide I've ever made.
254520	262000	So it's all downhill from here. So really kind of what it's doing is it's using machine learning
262000	266280	in order to crack passwords. And when I say machine learning, I mean, in the traditional
266280	270380	sense of a whole bunch of if then statements. So it's not using neural networks or artificial
270380	275060	intelligence. But you are training on passwords that you expect to be somewhat similar to the
275060	280740	target passwords that you're cracking. And when it processes that training password set,
280740	285660	it extracts all sorts of probability information about the components of those passwords that
285660	290000	it finds there. So it figures out things like, you know, capitalization masks, whether numbers
290000	294080	go at the beginning of the password versus the end, the probability of individual letters and
294080	299940	numbers found in that password, keyboard walks, and so on. And so it goes ahead and creates a
299940	303500	model based upon all those different types of probability information there. And then it uses
303500	308160	those in order to generate very highly probable password guesses in probability order. So it'll
308160	311220	start with the most probable password guess and go to the second most probable password guess and
311220	315420	then go to the third one and so on until you crack the password that you're trying to find or
315420	326590	you give up. So let me just move my thing here a little bit here. So just to kind of tie us back
326590	331570	into probably what's going on right now, as I said, I don't know what the actual contest is going to
331570	337810	be like. Forward or crack me if you can. But CoreLogic helpfully provided a brief summary of, you know,
337810	342890	what the scenario is going to be at least here. And so we're going to be targeting 12 different
342890	347610	individuals. And those individuals change their passwords over time in order to be able to deal
347610	352010	with more complex password creation requirements. And that sounds a little bit something like
352010	355850	something that, you know, a PCFG might actually be useful for. So I'm really optimistic for this
355850	360930	contest. You'll see how, you know, optimistic I am on Saturday when I'm actually, you know,
360930	367250	we're giving this talk. But, you know, this is kind of the scenario that this was originally
367250	373290	developed for in the first place of, you know, you know how a subject creates passwords. So you
373290	376490	want to create passwords kind of similar to that. But you also want to go ahead and change them and
376490	382570	maybe, for example, you use more complex rules or, you know, complex password creation requirements
382570	388590	added on top of that there. So I'm available probably on Discord right now. And so I'll be
388590	391670	able to answer questions about how potentially you might be able to tweak this in order to
391670	399020	help in a scenario like this here. The fact that there's a lot of academic papers about this,
399020	402880	though, is when I give a talk like this, I don't actually have to create any of my own graphs. I
402880	406440	just can go to other papers there, you know, look at the research that other people have done,
406440	409020	and just pull out their graphs in order to be able to talk with it here.
410480	413400	So one thing that I really kind of want to highlight, though, and you need to kind of
413400	417960	look at this with a bit of a skeptical eye, is that you'll notice that all these cracking
417960	423320	sessions are really, you know, short. I know, you know, one, you know, trillion guesses here,
423320	427260	that might sound like a lot. But when you start talking about, you know, GPU password cracking,
427260	431740	you're talking about like under a second in order to generate all those. So that's just, you know,
431740	438620	no time whatsoever. And part of reason for this here is that the PCFG approach, it's very slow,
438620	444900	it doesn't, you know, scale very well with multi-threading currently. So when you start
444900	448280	talking about, you know, passwords that you want to be able to crack, it works very well
448280	451780	when you're going ahead targeting very slow password hashes, where you can only make, you
451780	455940	know, you know, thousands of guesses a second, because the hash is very slow. But we start
455940	460060	talking about things like, you know, unsalted MD5, other attacks that are going to be much
460060	464160	more effective, because you can just make so many more guesses in the same time frame there.
464640	469640	So when you start talking, looking at, you know, faster password hashes, you can certainly go
469640	474080	ahead and still use a PCFG to supplement your attack. And you can still go ahead and crack
474080	479980	some passwords that you might not normally get. But in general, for the faster password hashes,
479980	482960	you really are going to want to go ahead and use more traditional types of password cracking
482960	486740	attacks in order to really make use of the hardware that you have available to you.
489940	495900	So I want to talk about this graph kind of, though, and really focus on it, because this
495900	501120	was a really neat study done by Carnegie Mellon University. And one of the problems when you look
501120	503700	do academic research, especially when you start talking about offensive
505360	512880	tactics, is that the academics are, you know, running attacks themselves. So you're looking at
512880	517720	the, you know, the how effective students are at cracking passwords versus someone professional,
517720	523840	potentially. So CMU, you know, took the probably the, you know, the most straightforward approach
523840	528040	to be able to solve that problem was they went out and reached out to CoreLogic. You might have
528040	531000	heard of them. They're running this, you know, password village. They run the Crack Me If You
531000	535160	Can competition. So when you're trying to find an expert, you know, they're like, you know,
535160	540220	way up there. So they're a pretty good representation for that there. So what they
540220	545380	did was they gave, you know, one of the CoreLogic engineers a password list. They asked them to
545380	550720	crack it. And they recorded, you know, how many passwords they cracked over time. It was the
550720	554060	number of guesses they made. And then they compared it against other cracking sessions as well.
554920	558500	And, you know, one thing I'm really, you know, it makes me smile every time I see this here
558500	565480	is that the PCFG did really well compared to the pros, which was CoreLogic,
565480	570620	for that short cracking session. So when you start asking, like, you know, can this represent,
571040	577660	you know, how a real professional password cracker operates, the short answer is it
577660	582220	certainly, you know, appears to be able to be able to do that there. So, you know,
582220	587460	full disclaimer, when you gave, you know, CoreLogic more time, they definitely performed
587460	592020	way better. This is a logarithmic graph, so that's about 100 times more guesses.
592700	598360	And also, I'll admit this wasn't fair to CoreLogic either, because, you know, that's not typically
598360	604660	how, you know, people crack passwords in real life there. It was such a short, you know,
604660	609800	cracking session. And when it is that short, usually it's against a really strong password
609800	613940	and you have a lot of time in order to really manually tweak your attack that you're running
613940	620640	there. That being said, if any of you are listening, I would love to have a repeat or a
620640	628220	rematch of this, you know, attack just to see, you know, how this performs with all the new improvements
628220	632180	that have been made into PCFGs. And I'm sure that, you know, CoreLogic has really been upping
632180	643900	their game over the years as well. So that's why I'm somewhat hopeful that we'll be able to find it,
643900	651130	now. So enough about, you know, all the research side of that there. Let's talk about how to
651130	656250	actually make use of this PCFG password cracker. So the first thing is you just go ahead and
656250	661890	download it from the GitHub repo. And the requirements of it, I really have strived to
661890	668510	make it as simple as possible. So you need to have Python 3, and that's it. So there's an optional
669190	676210	Karadet Python module that can help during the training. And that's because it helps detect
676210	679970	what character encoding the training set is, because character encoding is the bane of my
679970	684910	password cracking existence. But even that's optional. And actually, it's now being installed
684910	690570	as part of PIP 3. So if you have PIP, you probably don't even need to install it yourself as well.
690570	694350	And this is really useful, though, because I find a lot of situations where, like, when I'm cracking
694350	698410	passwords, like, I don't have, like, internet access. So it's really nice to be able to go
698410	703510	ahead and quickly throw my tool on a box and get it to run. So if you can run Python 3 on a box,
703510	707850	you can probably run this here. So I've tried it on a bunch of different OSs. I've actually even
707850	712470	gotten it to run on NetBSD. And it was the only thing I've ever gotten to be able to run NetBSD.
713310	717630	So hopefully this is easier than your typical academics tool set in order to get it installed
717630	721230	and start cracking passwords with as quickly as you can.
722710	726930	So we start talking about hardware requirements, because that's always an important portion when
726930	733590	we start talking about password cracking. The PCFG tool set, it is single-threaded CPU bound,
733590	740370	which is why it's so awfully slow. But it will use an entire CPU thread. So you do really need
740370	748070	to dedicate one full CPU, you know, thread to the PCFG. The other thing is it has very high RAM
748070	753470	usage. It basically maintains a lot of different data structures and memory. And those data
753470	758150	structures become more complex over time. So it just grows. So I could have done some things,
758150	765590	tried to go and prune that or, you know, move some of it to disk. But RAM is cheap. So I haven't.
765630	770570	So it'll just keep on growing over time. So initially, it starts out pretty low usage.
770650	773630	But if you're talking about running this, you know, password cracking session for like a week
773630	777990	or two, you really need to have at least 16 gigabits of RAM to really kind of just fully
777990	788300	dedicate to the PCFG tool set itself. So the next step is to actually make use of it and run it.
788800	794200	So I apologize up front that I tend to use the words rule set and grammar interchangeably.
794200	799580	At least to me, they mean the exact same thing. But really what I'm talking about is that,
799580	803380	you know, I mentioned, you know, machine learning a couple of times here, you have to go ahead and
803380	809320	train a grammar on existing password data set. Now, you may want to have, you know,
809320	813280	you know, different grammars for different targets that you're trying to target. So if you're trying
813280	817980	to target, you know, a web application catering to younger people, you might want to train it on
817980	821420	passwords that resemble that. If you're trying to target, you know, corporate passwords, you might
821420	826280	want to train on corporate passwords instead, and use those rule sets against target passwords that
826280	830480	you're specifically you think will match that. So you can have as many rule sets as you want
830480	834180	to be able to really kind of fine tune your cracking session there.
834520	840480	So the default one rule set that comes with the PCFG password cracker was actually trained on
841140	845120	a subset of 1 million passwords from the Rocky data set, which came out in 2008. And it was
845120	848700	against web passwords. So there wasn't really any strong password requirement whatsoever.
848780	854540	I've been thinking about updating that. So if you have a good data set that you think that
854540	858720	I should use for that there, I'm open to hearing about that there to make it a little bit more
858720	864300	effective. But that being said, the Rocky data set is still extremely effective even to this day.
864940	871540	It's just, you know, Blink-182 is not nearly as popular. So after you choose the data set that
871540	876240	you want to use, though, now you go ahead and start generating guesses. So it's a Python program.
876240	884780	So you just run, you know, Python 3. You run the PCFG guesser.py tool from the repo.
885420	889240	You get it in the ender rule set. By default, it's default. So if you don't go ahead and
889920	893960	specify that there, it'll go ahead and use the Rocky data set. And then you go ahead and specify
893960	900820	session name as well. By default, this is default as well. And so the session is used to restart a
900820	904460	password cracking session. So if you have to cancel it for whatever reason, you can go ahead
904460	913700	and restart it back up again. So I really want to kind of highlight, though, that the PCFG tool set
913700	918240	is only a password guess generator tool set. It will generate password guesses. It'll generate
918240	921660	those password guesses in probability order. So it'll start with the most probable password guess,
921660	925260	second most probable password guess, and keep on going down the line. It will not actually
925260	930740	hash and crack any passwords. So you need to use another password cracking tool set for that there.
931260	935080	You know, both JohnDeRipper and Hashcat work are basically any other password cracking tool
935080	939740	that accepts, you know, guesses in from, you know, the standard input there. As I mentioned earlier,
939740	943520	I'm on team JohnDeRipper. So I'm going to go ahead and use JohnDeRipper for pretty much all
943520	949960	my examples here. But you can totally use Hashcat as well. So in order to do this here, you run the,
949960	954600	you know, the previous command that, you know, I talked about. And then you run, you know, pipe it
954600	959960	into, for example, John. And on John, they have, you know, a command called standard in, so that
959960	964440	you type that in there. And instead of running data from like a word list, or generate your
964440	968820	password guesses, it'll go ahead and use the password guesses that are piped into it instead.
969780	972900	And you're cracking passwords. That's really all there is to it.
973980	977820	So there's definitely optimizations for actually using this in the real world, though.
977820	981620	So the first thing I really kind of want to highlight is a lot of times you want to know
981620	986420	what the status of a cracking session is. So the challenge when you are using the pipe command,
986420	989660	though, is if you go ahead and hit the enter button on your keyboard, instead of sending the
989660	994360	enter button to JohnDeRipper, it's going to go ahead and forward that to my tool instead.
994720	999160	So you might want to be able to, you know, get JohnDeRipper to output a status report.
999160	1003280	The way that you do that is you send a siguser1 signal to JohnDeRipper.
1003440	1009200	If you're writing this on a Linux system here, you just type in kill-siguser1 and then the
1009200	1013020	process identifier JohnDeRipper. And when you do that and hit enter, it'll be just like hitting
1013020	1017020	enter on the JohnDeRipper itself and it'll go ahead and output the status output of its
1017020	1022400	current cracking session. So now you can do things like, okay, not only see the passwords
1022400	1025960	are getting cracked, but you can see like the number of hashes, the total number of hashes
1025960	1029980	are cracked so far. You can see like, for example, the guessing speed. So in this case,
1029980	1033500	it's making about 4 million guesses a second. And then you can see like how long it's been
1033500	1040500	running and, you know, all the other, you know, options as well. So I want to kind of dig into
1040500	1045840	that one, you know, output of that cracking session though, because I think, you know,
1045840	1051140	this really kind of helps demonstrate kind of some of the power of using the PCFG.
1051760	1055980	Because normally when you're, this here is showing the passwords as they get cracked.
1057500	1061840	So you can kind of see that it's not just going ahead and, you know, figuring out one rule and
1061840	1064860	then exhausting that rule and then going to the next rule like you would see in the more
1064860	1069380	traditional password cracking session. Instead, it's creating much more fine grained rules
1069380	1073680	and iterating between all those depending on what the current probability of it is here.
1073740	1076360	So when you see these passwords being cracked, it's kind of fun to try to figure out like
1076360	1081680	how did the underlying system, you know, generate that password guess? Why is it making the guess
1081680	1087640	right now that that it is? So kind of if you look up, you know, initially here,
1087640	1091020	like this is pretty easy. Okay, it's just taking like some five letter word.
1102900	1108000	I apologize, my microphone just died here. So fun doing, you know, DEF CON remote.
1109520	1114480	So, you know, it's using five digits, you know, or five letter words plus four digits here.
1115980	1119240	Moving on, though, this is a kind of an interesting one here is SES is cool.
1119320	1123180	So I looked into my input dictionary and SES is cool was not in my input dictionary or my train
1123180	1127640	set at all. And I found out that it was actually you doing multi words for this year. So it was
1127640	1132560	combining, you know, SES and then it's cool. So one kind of cool thing about this, and I'll talk
1132560	1136640	to us about this a little bit later, is that instead of, you know, going ahead and breaking
1136640	1139920	this up into three words, like we normally would think about it there, it actually broke it up into
1139920	1143620	two different words. So SES is cool. So that way you can go ahead and go through it and say like,
1143620	1150140	is, you know, Katie cool? Is, you know, Allie cool? Is Bob cool? Because there's a lot of cool
1150140	1155280	people out there. So it can go ahead and iterate through those there and try that type of, you
1155280	1162940	know, mangling rule for it there. And what's really cool about this is that it learned that
1162940	1169260	is cool is a common word from the train set itself. So I didn't actually ever program in
1169260	1175540	that logic into it. It learned it by itself by looking at the training data, which is,
1176120	1183320	as I said, pretty cool. But you can see after that there, it kind of went into brute force.
1183320	1186300	It wasn't the pure brute force, and I'll talk about the different types of brute force here,
1186300	1189380	is actually combining some very short words, kind of like a combinator attack.
1189520	1195680	But still, you know, it's able to kind of get that out that way. And then it went ahead and
1195680	1199660	tried, you know, words with, you know, special characters, the same special characters at the
1199660	1204640	beginning and the end of them too. And that's, you might be able to see that in a traditional
1204640	1207620	password cracking session, but you actually have to have a rule in order to generate that. And
1207620	1212360	trying to create those rules is a real pain. So you won't see those in, you know, most, you know,
1212360	1215720	common publicly available rule sets, but it was able to learn that from the training data, which
1215720	1222880	was, I thought, pretty cool as well. So down here, and I'm kind of, you know, need to get off
1222880	1227760	the screen here, but you can see it's trying some longer words. But these are actually, while they're
1227760	1233920	normal words here, it's actually generated them via the multi-words as well. So like finger plus
1233920	1238460	nail, or 90 plus 9. And once again, this is kind of really useful because now you don't have to
1238460	1243780	have things like 99, 98, 93, you know, in your data set, your word list as well, because it's
1243780	1249680	generating those on the fly. Kind of going down a little bit further here, this is your more
1249680	1253620	traditional kind of rule here. It's just two digits plus capitalizing the first letter of a word.
1253780	1256940	So you can see it's starting to do that. But, you know, settings is a pretty uncommon password,
1256940	1260980	word to be able to use. So it's trying it later in a cracking session here.
1261740	1265640	And now it's even combining even more mangling rules. So it's trying, doing a multi-word,
1265640	1270920	you know, of wood plus fish and, you know, Tara plus Don, and adding digits to the end of that
1270920	1275420	as well. So you can see how it starts stacking these different rules together. And I kind of
1275420	1278500	want to highlight that this cracking session has been going on, as you can kind of see from the
1278500	1283860	status output, for about 13 minutes. So all the really easy passwords have already been cracked.
1283860	1287580	It's already guessed, you know, 1, 2, 3, 4, 5, 6, and password 1, 2, 3, 4, 5, and so on.
1288160	1292420	So these are starting to get into more of the, you know, the fuzzier of the rule sets that you
1292420	1301170	might not normally see in a normal password cracking session. So as I mentioned a little
1301170	1304890	bit earlier, if you hit the enter button, it's going to go to my program, not, you know, John
1304890	1309470	the Ripper. But there's a lot of information that I want to be able to provide to people about the
1309470	1316330	cracking session. So whenever you hit enter, or basically any of these R keys here, it'll display
1316330	1320370	an output of what it's currently doing. So you can try to figure out, you know, whether you want to
1320370	1323630	continue it, whether it's working correctly, and whether it's kind of doing what you want it to do
1323630	1330770	as well. So kind of going through this here, I hit enter twice. And so you can kind of see how
1330770	1335930	it's generating, you know, these password guesses as doing it here. So the first one, you know,
1335930	1339890	it's, you know, basically going ahead and trying to combine two words. So it's a multi-word type
1339890	1346030	of attack. And you can, if you dig into like the real details of it there, you can kind of see
1346030	1351710	that it's trying like the hundred and forty-third most probable word with no capitalization. And
1351710	1355550	it's combining it to the ninety-third most probable four-letter word with no capitalization
1355550	1359590	as well. So you can see that the probabilities it assigns to like even individual words and
1359590	1365070	stuff like that is very, very fine grained. So it's going to try some words, and then like do
1365070	1369290	other mangling rules and stuff like that. And they'll go back to the less probable words later
1369290	1376150	on in the cracking session. So now this next one here, it's kind of a little bit, I'll try to get
1376150	1380190	out of the way or something like that. You can see that it switched to a real brute force attack using
1380190	1386430	OMEN, ordered Markov enumerators. And I'll talk about that a little bit later there.
1386690	1390510	But really, I kind of want to highlight though that it's trying, you know, more traditional cracking
1390510	1395570	rules. So it's like, you know, combining words. And then it's switching to brute force. And then
1395570	1399130	it'll switch to another mangling rule after this here. And then it'll just keep on going
1399130	1406290	based upon whatever the current probability is. Now, as I said, I really struggle with documenting
1406290	1412190	my code. So I try to go ahead and add as much documentation into the runtime behavior of it
1412190	1417350	as possible. So if instead of hitting, you know, enter or anything else along those lines, you hit
1417350	1425050	H and hit enter, it'll provide, or just H actually, it'll provide a SAS report output of what all
1425050	1430450	these different fields here mean. And that SAS report actually is much longer than even, you
1430450	1435190	know, displayed on the screen here. But it explains what all those different, like, letters like A5 or
1435190	1441410	C5 actually stand for. The one thing that I kind of really want to highlight though is this one
1441410	1448890	metric here called probability coverage. Because since the PCFG password cracker creates guesses
1448890	1452710	in probability order, it starts with the very high probable passwords, and it goes to less
1452710	1458310	probable passwords and less probable passwords. And the model that it has will basically never
1458310	1463010	finish. It'll just keep on figuring new combinations of words to go through to it.
1463010	1468470	So a real challenge becomes, you know, when do you go ahead and give up on a cracking session?
1468470	1474130	So you haven't cracked the password. When should you go ahead and, you know, kill this off and try
1474130	1478610	some other cracking type of attack that might be more successful? Or when do you go ahead and just
1478610	1482870	choose to say, I'm not going to crack this password and move to a different case? So this probability
1482870	1487850	coverage is a very fuzzy metric that I tried to develop to try to just give you a little bit of
1487850	1496050	kind of a rule some about when that should be. So what this metric says is that if the target
1496050	1502510	password is the same probability distribution as the password data set that I trained, and if my
1502510	1508030	grammar and how to model how these passwords are created was exactly correct, this is the
1508030	1512050	probability that we cracked this password. Now, neither one of those assumptions is actually true
1512050	1514870	in real life. You know, the probability model of the password you're trying to crack is probably
1514870	1521090	very different. You know, the grammar that I generate and train on is absolutely not perfect.
1521290	1524550	But at least, as I said, it kind of gives you a rule of thumb to say, okay, you know, this is
1524550	1528770	starting to get a little bit high. It says, you know, I had like a 90% chance to crack this password.
1528770	1533310	I haven't cracked this password yet. Maybe I should go ahead and give up. And you'll notice
1533310	1536730	this number jumps up really high initially because it's making, you know, high probability
1536730	1542010	password guesses. And then it slows to a crawl to almost like no advancing after you get to,
1542010	1547650	you know, like 70 or 80, 90 percent, you know, completion there. So this is kind of really good
1547650	1551170	to be able to figure out, you know, where can I go ahead and devote that, you know, that one single
1551170	1558740	CPU and that RAM to somewhere else there. So another usage tip I just kind of want to highlight
1558740	1563780	is that sometimes the cracking dynamic when it comes to speed is completely reversed.
1564220	1568860	So you might be trying to crack very, very computationally password hashes, expensive
1568860	1573320	password hashes, or a lot of like, let's say, assaulted hashes, in which case you're really
1573320	1577100	only making, you know, a couple guesses a second. Well, this generator is generating, you know,
1577100	1581640	let's say, you know, between like, you know, 100,000 and like 4 million guesses a second.
1581640	1587320	So it gets backlogged. And basically, essentially freezes while it waits for to be able to send more
1587320	1592360	guesses to the password cracking program. So occasionally, if you hit enter, it won't actually
1592360	1596560	display set the status or it'll take a while to display the status. And that's kind of usually
1596560	1601060	what's happening. So if that's happening, and you're kind of curious whether the password
1601060	1605800	cracking session has crashed or not, I recommend going back to earlier advice about sending a
1605800	1609300	signal to, let's say, John Ripper, and just seeing how that's doing there
1610320	1613620	in order to make sure that your password cracking session is still running.
1616680	1621620	So, as I talked about, you know, multi-word feature has probably been the biggest,
1621620	1630140	you know, addition to the new 4.0 rewrite. And it has completely shocked me how effective this
1630140	1635420	has been here. So I won't get talk too much details about it. But the one thing I want to
1635420	1641060	really kind of stress, though, is that it is not language specific at all. It learns all what
1641060	1645980	constitutes a word from the training set that you're giving it there. So it'll pick up things
1645980	1649920	like new band names or proper nouns that are really hard to specify inside the language
1649920	1656000	dictionary or whatever new Pokemon just came out. And identifies patterns like, you know, I love,
1656000	1663040	and stuff like that. So this is very useful for being able to, you know, you know,
1663040	1671740	try to target new, you know, password hashes. So, as I said, it's not language specific.
1671740	1678200	It works best with, I would say, kind of like European English type languages.
1678880	1684980	It really struggles still with some of the other languages like Mandarin. But that is something
1684980	1690260	absolutely that I really want to focus on more going forward here. It's not perfect. It's
1690260	1694260	definitely a work in progress. So there is a balance between, you know, creating, you know,
1694260	1699180	false positives and matches here. If you don't see some of the base words in the train set by
1699180	1705000	themselves, it won't identify them. But it's something that is evolving. And part of the new
1705540	1711360	pull request that I just received from somebody else actually has some improvements to this here
1711360	1719000	that I'm really excited about, again, pushing to Maine. So one of the other big features that have
1719000	1727680	been added recently here is ordered Markov enumerator. And the whole reason why I talked
1727680	1732040	about this is that a similar approach can be taken for pretty much anything. So if someone
1732040	1738860	creates a better cracking attack or cracking mode, it can totally be incorporated into a PCFG style
1738860	1745400	attack. I'll be a little bit like the Borg in that respect. But the real challenge is to be
1745400	1748460	able to figure out how to assign a probability to a password guess. So if you can assign a
1748460	1751600	probability to a password guess, I can probably incorporate it into a PCFG.
1755320	1759120	So just kind of in the last little bit here, I really kind of want to highlight
1760200	1765920	some additional tricks that are very useful when it comes to cracking passwords. So the first one
1765920	1771640	here is this skip root flag in the PCFG. And basically what this does is disable omen guest
1771640	1777800	generation. And that's not to say that omen guest generation is something that's bad to do.
1777800	1781600	It certainly definitely helps increase the success of a password cracking session.
1782000	1786820	But this is a way to paralyze your attack. So if you're having another system that's going ahead
1786820	1791860	and really cranking through your brute force attack, you might want to go ahead and do all
1791860	1796680	your brute force on that other system or on that other thread. And then run the PCFG guesser really
1796680	1800480	just to focus on the word mangling rules instead. So in order to do that, all you need to do is
1800480	1809610	just when you run it, just type in skip root. Another flag that's really kind of useful is
1809610	1813570	the all lower flag. And what this means is it'll stop doing any sort of case mangling on the
1813570	1819950	password guesses. So let me try to move my picture just a little bit here just to make it easier to
1819950	1837510	read as I go back. I apologize. Okay. So a lot of times you may want to not go ahead and do case
1837510	1843590	mangling inside of PCFG itself. And one reason might be that the hash that you're targeting is
1843590	1848650	case insensitive like landman. That's not probably the best example, though, because if you're
1848650	1852010	cracking landman hashes, you're not using PCFG in order to do that there. You're just going ahead
1852010	1857910	and brute forcing that sucker and taking it out that way. Where it's more likely, though, is that
1858710	1865010	case mangling is very distinct for how people do it there. So if someone does a certain type
1865010	1869850	of case mangling, they have a tendency to keep on using that strategy for all their other passwords.
1870010	1873510	So when you start doing things like targeted password cracking, you may not want to go ahead
1873510	1877450	and just go ahead and do what everyone does. You want to really make a really specific case
1877450	1883210	mangling for that particular individual. In that case, the better way to do this is that JohnRipper
1883210	1890970	supports a really powerful feature called Pipe. So what the Pipe does is instead of just going
1890970	1896070	taking the guesses in from standard input and running them as is, you can apply additional
1896070	1901010	rules on top of that like you would do in a traditional password cracking dictionary type
1901010	1907250	of attack. So you can specify your very specific case mangling rules inside JohnRipper's rule set
1907250	1911950	and then pipe the lowercase password guesses right into JohnRipper and have JohnRipper
1911950	1917290	capitalize it itself. And that can be very powerful when you have an idea of what type
1917290	1932600	of case mangling you want to be able to target. So I of course moved it to the wrong portion here.
1934220	1936800	Let me move my screen again here. I apologize.
1938640	1942620	Some kind of improvements. As I mentioned, there was an amazing pull request that was
1943060	1947520	submitted to me with a bunch of new features. I'm slowly incorporating them into the core,
1947520	1952120	but I actually have the features available as their own kind of tool called segmenter.py.
1952120	1957520	I mean, and I apologize if I mispronounce your name because I've only seen it written.
1957520	1964960	But Chun-Wan Wang submitted this here and it really impresses me there.
1965120	1968840	So probably the biggest feature I'm really excited about is leet-speak replacement. This has
1968840	1973460	been a feature that has been kind of my white whale as far as implementing. And it's just
1973900	1979820	every single time I've gone through it, it's just not been very effective. But that's
1979820	1986660	currently incorporated into this tool he has called segmenter.py. That's been included in the
1986660	1990620	repo that will go ahead and try to parse that information out. So I'm looking at getting that
1990620	1994600	incorporated into my core trainer and getting that incorporated into password cracking sessions in
1994600	1999300	order to be able to really target that there. He also improved some of the multi-word detection.
1999300	2004740	So he made that better. And then he also has incorporated some new approaches into the
2004740	2008420	password score, which is a different tool that you can go ahead and submit your password into
2008420	2012720	the password score. And they'll tell you what the probability your password is,
2012720	2018800	which is kind of nice as well. So all credit goes to him for this. I'm really impressed with this
2018800	2025020	here. And if anyone else is looking at helping out too, I'm all about that. So thank you very
2025020	2039340	much once again for that there. Okay, so let me move my screen around again here. Okay, so
2040880	2044680	the next thing I currently want to talk about here is the compiled PCFG guesser. So I've been
2044680	2051080	talking about the Python tool set all along right now. So the compiled PCFG guesser is a completely
2051080	2055860	different, you know, fork. And as you kind of get the name there, it's still being written in Python,
2055860	2060280	it's written in compiled C code. It's a little bit harder to get actually installed and running
2060280	2063220	simply because when you start talking about compiling your code, you know, it runs great
2063220	2070100	on my machine, but it has challenges elsewhere. I tried to go ahead and use a Hashcat build make
2070100	2074320	file for this. So if you can build Hashcat on your computer, you have at least a better chance
2074320	2080780	of being able to go ahead and get this running as well. But if you have problems, please, you know,
2080780	2087260	reach out to me on the GitLab or GitHub site, and I can try to help you fix those there.
2087900	2091340	So I will say that the trainer portion, it will always be in written in Python.
2091340	2096820	I just like writing Python too much to change that over. So basically, you'll go ahead and
2096820	2101780	create train rule sets with the Python trainer, but then copy them over to be used in the compiled
2102560	2109140	version here. Also, the compiled version has a tendency to lag in features from the Python tool
2109140	2115800	set, because once again, I like writing Python. I'm not the best C coder in the world. So basically,
2115800	2119980	if I write a hello world program, it's going to have like five buffer overflows and, you know,
2120080	2128860	a segfault. So take what you will there, but I'm making this available. If someone wants to
2128860	2133260	write a better one, I'm totally open to that as well. But, you know, it doesn't have save restore,
2133260	2138040	it doesn't have status outputs, and it has no omen guest iteration. So all that being said,
2138040	2143580	you know, why bother with this here? And really, at the end of the day,
2145140	2151720	the main reason is it's about 20 times faster than the Python tool set. And I've always heard
2151720	2155760	that, you know, C code is faster than Python. But when I saw that, I was like, holy crap.
2155760	2160880	So I will be up front. I'm actually, even with all these limitations, when I'm cracking passwords,
2160880	2166620	I'm using the compiled C version now much, much more often than I'm using the Python one there.
2167100	2172740	So because that 20 speed improvement is hard to beat for most password cracking sessions.
2176120	2182420	So now I'm going to talk real quick about training passwords. So I've been talking about this a lot
2182420	2185400	here. And there's a lot of different reasons why you want to go ahead and create a new password
2185400	2192380	training set there. So language is a huge one. So you want to be able to train on passwords that
2192380	2196600	are similar to the target that you're trying to target. And another big one is that corporate
2196600	2201720	passwords are very, very different than you'll see from websites. And I'm sure you probably heard
2201720	2209060	CoreLogic talk about this before, you know, yesterday. But that's something that, you know,
2209060	2213380	is very evident. So if you're trying to target corporate passwords, you probably do want to go
2213380	2217240	ahead and train on corporate passwords versus going ahead and training on passwords for some
2217240	2226280	gaming website. So another reason to go ahead and train it, though, is if you're targeting a specific
2226280	2232400	password creation policy, or you know which mangler rules your target prefers. So one way to be able
2232400	2237440	to really target that there is to train only on passwords that match that training set there.
2237440	2243500	And there's other things you can do, like the password rules, or the, you know, the grammar
2243500	2248380	that I generate. I made sure that I didn't include anything like a CRC check or any of those
2248380	2251740	sanity checks into it there. So you can actually open up the files themselves, they're just text
2251740	2255420	files, and start editing the probabilities of different things in them by hand, too. So if you
2255420	2258960	say, like, oh, this is one word I really want to go ahead and make it, like, highly probable,
2258960	2262220	but I don't want to go have to train on a whole new training set. You can just go ahead and open
2262220	2266840	it up, put that word in there, give it whatever probability you want, and that will just be read
2266840	2272160	in and used in your password cracking session there. So the other reason to train on a password
2272160	2275360	train set there is it generates a bunch of information and extracts a lot of information
2275360	2280440	from that password set. So it's really useful to be able to analyze a new dump that you have
2280440	2284920	accessible to you there. So for example, it'll pull out, like, common emails, it'll pull out
2284920	2288700	dates and websites, and try to help you figure out where did this, you know, password data set
2288700	2297430	come from there. So the next question, of course, is, you know, where do you go ahead and, you know,
2297430	2302350	get these password data sets from? So there's a lot of challenges with this, too, because a lot
2302350	2308650	of data sets are not optimal when it comes to training on. So I don't know if you know of
2308650	2312990	hashes.org, but it's a really great site for being able to download all these, you know, dumps as
2312990	2319010	they come out here. So for example, let's say you want to go ahead and train on this data set here.
2319010	2323050	I'm not going to try and pronounce the name of that site, because I'm sure I'll just horribly,
2323050	2328270	horribly mangle it there. But when I did some googling about this site here, it was a site for,
2329230	2335350	you know, new college students trying to find a job in China. So that's kind of an interesting
2335350	2339910	data set there that you might want to be able to use in order to train for correct passwords here.
2340750	2344010	So if you download something from, like, hashes.org, the first and most important thing is select the
2344010	2349110	plain text option to train your rule set on, because you don't want to include the hash
2349810	2352370	part of your training set, because then you'll think it's part of the password and just it goes
2352370	2358050	poorly there. So one other thing I really kind of want to highlight here, and this is a
2358050	2364670	feature that I'm hopeful to be able to get added to the PCFG tool set, but I was informed by the
2364670	2372290	owner of the site here that they actually do some additional things for encoding non-UTF-8 characters
2373310	2380130	that my trainer will not fully parse correctly. So that's something I need to add in too,
2380130	2386310	so that it goes ahead and, you know, uses the correct character encoding for non-English
2386310	2391250	passwords. So I just want to put that warning out too for trying to train this on things like
2391250	2398900	Mandarin. But one problem with a lot of these dumps here is the first one is they don't contain
2398900	2405180	duplicate guesses. So duplicate guesses are really important when it comes to trying to figure out
2405180	2409140	what the probability of password is, because if you don't have duplicate guesses, 1, 2, 3, 4, 5,
2409140	2418020	6 looks like a very just random string. So that's useful, but I will say when you run longer
2418020	2422740	cracking sessions with PCFGs, that lack of duplicates becomes less and less important,
2422740	2426640	because you've already exhausted all the really probable password guesses. The one issue though
2426640	2432300	is that the OMEN portion really does struggle without the duplicates. So you might not want
2432300	2435860	to go ahead and enable OMEN guessing if you train on a data set that doesn't contain any duplicate
2435860	2440180	guesses there. The other problem with these dumps is that they only contain the passwords that have
2440180	2445140	been cracked. So basically you don't know or learn anything about the passwords that haven't been
2445140	2450180	cracked. That's not a deal stopper, but just it's useful to keep that in mind there, that the
2450680	2454300	cracked percentage is going to be very useful when it comes to figuring out how good a data set is
2454300	2463960	in order to create a new rule set. So in order to train on a password data set there, really
2464360	2468480	you just apply some program once again. You just give the name of the rule set that you want to be
2468480	2472660	able to train it on, as well as the password data set that you want to train it on as well.
2473240	2479540	And it'll go ahead and run in order to do all the parsing and stemming of the
2479540	2485080	password data set here. So it will try to auto detect what that encoding is,
2485780	2491200	but when in doubt, set it to be UTF-8 because the encoding really does matter quite a bit there.
2492780	2496000	So the first pass it takes through the data set there, it learns all the character
2496000	2499840	frequencies and base words for multi-word detection. So it actually makes a couple
2499840	2503100	different passes through the same data set in order to learn more and more and more about it
2503100	2508640	there. The second pass it goes through there, it'll do much of the real parsing of the password. So
2508640	2512260	it figures out things like, you know, keyboard walks, alpha strings, you know, letters, how
2512260	2516160	probable like the digits are and stuff like that. So most of the stuff you think of traditionally
2516160	2519040	when you talk about, you know, what their probabilities of different, you know, things
2519040	2524460	are, it does on the second run through. And it actually goes ahead and makes a whole third run
2524460	2529080	through then to see about how effective things like, you know, OMEN would be for cracking
2529080	2533160	passwords. So that kind of gets back to how OMEN generates the probability it's assigned with its
2533160	2538860	different levels there. And so this takes a while. So if you're cracking, you're training it on a
2538860	2543260	million passwords, you know, it's done in like a minute or two. If you're training it on a billion
2543260	2551000	passwords, it takes significantly longer. And it has to keep all this data in memory. So if you're
2551000	2557000	training on some of these really gigantic data sets there, it's just not going to work. So one
2557000	2560820	thing you might want to do is just select a subset of that password set, you know, chosen
2560820	2568620	randomly in order to train your rule set on instead. So after you're all done with that,
2568620	2573080	though, it'll display statistics about the data set you just trained upon too, which are really
2573080	2577360	kind of useful to figure out, you know, where it came from. So, you know, password lengths and stuff
2577360	2582280	like that. But one thing that I've been kind of added that I found really useful is it'll display
2582280	2587540	kind of like the top URLs, which are usually at the beginning, the top of them are like, you know,
2587540	2595440	web, you know, email, email account information. But if you start getting down a little bit,
2595440	2599140	you'll can actually see usually what the website is because people have a tendency to use the
2599140	2604840	website in their password. I also highlight the dates that it finds it in there as well,
2604840	2608000	because that's useful kind of trying to date when that password data set got leaked.
2608220	2611680	Now, I want to kind of highlight that there's a long tail when it comes to the dates.
2612280	2620420	I'm sorry. Because people, you know, create passwords before, you know, the password data
2620420	2628040	set gets stolen. So, you'll see a lot of passwords for years before the data set actually gets
2628040	2631280	down. But if you start kind of going down it a little bit, you can say, okay, that's probably
2631280	2636560	about where the cutoff was for when this password data set was, you know, disclosed.
2639490	2643070	So, kind of one last thing I really want to talk about real quick is that I am trying to get this
2643070	2648150	to work with other cracking modes there. So, one of the, you know, really popular cracking modes
2648150	2655630	used is called Prince. So, Prince basically takes a lot of different words and just combines them
2655630	2661690	all together and makes lots of guesses based upon that. But one challenge with Prince is that it's
2661690	2666550	very dependent upon the input word list that you give it to it there. Because the word list needs
2666550	2671770	to have, you know, high quality words in it. But it also needs to have a level of kind of cruft in
2671770	2675650	there too. Just because if you want to go ahead and, let's say, add the number one to the end of
2675750	2682070	a word, you have one in your word list by itself. But the challenge is, the larger your word list
2682070	2686210	is, the more words it's trying to combine. And then, you know, it starts to have issues there
2686210	2691330	as well. So, we have all this probability information about how a password was generated.
2691330	2696650	So, maybe we can go ahead and use this to create very bespoke word lists for like a Prince-style
2696650	2702770	guessing session there. So, I created another tool called Princeling that basically just does that
2702770	2714560	there. So, it goes... I'm sorry, my microphone just went out again there. But yeah, so it creates a very,
2714560	2721460	you know, high quality word list there and does it automatically. Because one thing I like
2721460	2726280	about Prince is it's the kind of the attack that I run when I want to goof off. So, like, you know,
2726280	2728920	password cracking, sometimes it takes a lot of brain cells because you're kind of looking at
2728920	2732260	how you're cracking. You're trying to optimize your cracking session. And Prince is like, I have
2732260	2735700	no idea what I want to do. I want to go watch Tiger King on Netflix. Let's just go ahead and just
2735700	2739380	launch this off and come back and see if it was successful. And Prince is usually actually quite
2739380	2744380	successful. So, it's a pretty good tool to be able to use. And by anything that you can do in order
2744380	2748580	to automate Prince even more, I'm all for, which is why I went ahead and created that.
2751140	2755920	So, I'm going to go ahead and stop the live stream here. And hopefully, I'll be on Discord there in
2755920	2758940	order to answer any questions that you have. I hope you enjoyed this. I hope this was helpful.
2759200	2763800	And once again, you know, thank you for attending the Password Village here at DEF CON Safe Mode.