start	end	text
1690	7430	Hello, and welcome to Cracking Beyond 15 Characters for under $500.
7750	11590	Some alternative titles for this talk were Greener Pastures Over the Computational Wall
11590	16110	or Why XKCD Advice is Easy to Understand and Hard to Do.
16210	20570	That last one was suggested by my management, and we'll talk more about that one later.
21510	25330	Hi, I'm Travis Palmer. I'm also a nerd, so I go by the pseudonym tramco.
25330	29390	I am an OSCP, OSCE, and GMOD, if those letters mean something to you.
29390	34590	And as is traditional for speakers, a couple of my favorite hobbies outside of security are on the right.
34810	38430	D&D, Arma 3, and BBC. Yes, again, I am a nerd.
38670	42790	And these slides arguably have too much on them, so this is the point where I ditch my ugly mug
43530	47890	so that we can happily reveal that picture from the Red Team Village last year.
48290	52170	Yeah, let's just say that room was pretty tight.
52170	54530	I'm glad we're not trying to do that again this year.
55150	58350	Everybody would have COVID by now if we were trying to be doing this live.
59530	65450	For this talk, we're going to start with a fair bit of background before we get into the meat of things.
65450	69410	I should give a disclaimer. This isn't going to be an all-inclusive introductory talk.
69410	71630	There is just too much to get through.
71790	75670	And if you've never heard of HashGap before and are thinking, where can I adopt one?
75690	79030	This talk is going to be a little rough to follow. Just stick around.
79030	82750	You'll still learn something, and you'll definitely have some keywords to Google later.
82750	86130	So, let's address what should always be the first question.
86450	87210	Why?
87510	94510	Well, large web corporations are still using character requirements that were determined in 1985 by the Department of Defense to be resistant
94510	95830	only resistant
95830	99810	to online brute force attacks over a 1,200-baud modem.
99810	103670	And even then, they should have been rotated every couple months.
104190	109370	They also have complexity requirements that should seem familiar because they have become pervasive
109370	115710	and are largely responsive for a lot of people honestly believing that they can take almost any English word
115710	119250	and add a number and an exclamation point to it.
119350	121450	And it makes it an acceptable password.
121450	126150	Spoiler, these policies in isolation have not magically become more secure since 1985
126150	129390	and are still guarding some very sensitive things.
129850	133910	Thankfully, most of these websites and companies have some additional safety nets,
133910	136970	like detecting questionable login origins or 2FA.
137510	140730	Well, except Wikipedia, which, well, doesn't.
140790	144910	And historically might have had one of the worst password policies on the internet.
144910	148110	Thank you, Troy Hunt, for using a megaphone to broadcast the history here, which...
149130	151090	I just... why?
151470	155450	Your fix for zero-character passwords was a one-character requirement?
155810	159730	There's also a large number of places where that eight-character standard, well, isn't,
159730	163170	which frankly is a little baffling given some of the sensitivity here.
163170	169170	PCI, the payment card industry, which only covers the systems where the payment card info is stored,
169170	171130	this just seems lackluster.
171310	174770	And on the other side of things, imagine what kind of information someone could collect
174770	176790	for getting into your Facebook or Pornhub account.
176790	179430	Imagine what they could do to your reputation by controlling it.
179750	183310	And then there's eBay, which I should need to explain the level of financial ruin
183310	186150	an auction site can bring if somebody else is bidding for you.
186210	190550	Wells Fargo, a deserving punchbag perhaps, but they just haven't wisened up.
190550	192370	That's a 14-character limit.
192990	198370	And is there seriously a database with plain-text referentials limited to 14 characters in the background somewhere?
199770	201010	Then there's Netflix.
201870	206350	Does it make sense why hijacked Netflix accounts are so commonplace?
206350	210410	I understand the want to make four-number pins usable, but really?
210750	215490	Finally, we have a whole suite of devices in tech, and I'll pick on Cisco because I love them so much,
215490	221930	that historically, by default, have no password, and the policy might get set by the people installing it,
221930	225130	but, you know, eight characters suggest it.
225310	228550	This seems like a deeply questionable recommendation when, again,
229070	233610	those passwords were determined to only be resistant to attacks on networks in 1985.
234090	236990	And while I'm on the trend of bashing trustworthy sources,
236990	240470	it's only proper that I talk about NIST, or the National Institute of Science and Technology,
240470	243750	and what they say, given that what they say often seeps into government regulation.
243750	248410	The special publication 800-63B, released in 2017,
248410	252110	said that the requirement should actually be 8-plus characters with no complexity,
252110	257170	because someone did the statistical analysis and found out that people actually produce easier-to-reinforce passwords
257170	259030	under complexity requirements.
259030	262070	Like, adding a number and an exclamation point.
262170	266530	They also say the maximum should at least be 64 characters.
266690	269310	Hmm. I anted where things might be going.
269310	271370	There's also a key section here that says
271370	275910	increased password length is a key security control and to encourage passphrases.
276270	277490	Hmm. You hear that?
277490	279670	The future is coming. Slowly.
279670	282150	And the 80s might finally end soon.
282550	285490	The most recent guidance on February this year, mind you,
285490	287890	this was not the first time it was published, from NIST and the FBI,
287890	290450	is that, well, a lot more explict.
290450	294350	15 characters without other complexity requirements is where we should be going.
294350	296830	In fact, we should require it as soon as possible.
297470	300770	And this is in line with what a bunch of other experts and sources
300770	302570	that aren't the largest tech companies
302570	304930	have been saying for much, much longer.
305290	308050	In fact, a security consulting group that I greatly respect,
308050	309750	Black Hills Information Security,
309750	311430	makes this suggestion to their clients
311430	315070	and uses a more paranoid standard of 20 characters internally.
315270	315970	Neat.
316170	317490	Though you might be asking,
317490	319550	okay, why is Black Hills specifically on here?
319550	320690	Well, it's because I'm picking on them
320690	324310	and we're about to listen to some snippets of audio from a webcast last December.
324310	326350	Mind you, this is a little cut up and out of context,
326350	328690	but don't worry, most of the context is still there.
329270	332910	7 characters is just easy to crack.
332910	333910	How easy?
334650	336170	If you go to the next slide,
336170	338950	my son's computer, he's got a gaming computer.
338950	341690	It takes 8 minutes to crack an LM hash.
342130	344290	If you take the same 14 character password,
344290	346790	it would take 4.3 billion years.
347050	348430	Well, we got time.
348710	351910	This is kind of what I'm talking about with regards to
351910	355230	the password policy that they set in 1985.
355230	361650	I mean, in 1985, an 8 character password policy was secure forever.
363230	364410	90 days.
364410	365870	90 days, okay.
365870	369230	So it was secure for long enough for them to...
370910	372990	we don't need to do anything.
373730	377270	But, I mean, as technology changes,
377270	379610	so do the password policies need to.
379650	381850	Hey, this is warfare, right?
381850	384090	Everything is move, counter, move.
384090	386210	We have electronic countermeasures.
386210	388530	You have electronic counter-countermeasures.
388710	391610	And then it goes up above that and I lose track.
391610	395150	So we're getting questions about
395150	399530	have you run the Google common word attack against passphrases?
399530	403210	So, like, if you just load words into a cracker,
403210	406030	then doesn't that crack passphrases?
406030	408130	Sure. Yes, it does.
408290	412310	How many combinations of four-word passwords are there?
414410	416490	So how long is that going to take you?
416490	419490	What if you start using words from a foreign dictionary?
419810	422510	What if you start putting salt into those words?
422510	425130	Like, but I just, I think if four words,
425130	428330	and if you start using special characters as a spacer between your words
428330	430390	and things like this,
430390	434370	the question is, are you more secure than you were with eight?
435610	438250	But, yes, there are attacks against everything.
441110	443390	So, Darren kind of summarized this up,
443390	445430	this from-the-field kind of our results,
445430	446950	but I just did want to talk about it.
446950	450070	We have no success with people who have 15-character passwords.
450170	453130	Approach is zero. And we have tried these things.
453130	455250	Now, we're constrained in our time.
455250	457190	Normally, we don't have more than a week or so
457190	458870	to do our password guessing,
458870	461910	whereas ATT&CK, according to a Verizon report,
461910	464290	they've got, like, what, nine months, something like that?
464890	466530	Okay, another question, Jason.
466530	469530	Yes, so this question's come up a few times.
469530	471450	Are spaces legal?
471670	475790	Yes, they are a special character, and they are very good.
476070	477910	And it depends on the...
478910	480650	And I'm going to cut it there.
480730	482830	So, they have some pretty solid reasons,
483150	484770	a couple of pointed recommendations,
484770	487350	but perhaps the most interesting thing mentioned
487350	490010	is that they have been given hashes from a domain
490010	491950	with a 15-character passphrase policy
491950	493830	specifically to crack them.
493830	497050	And the amount they can crack in a week approaches zero.
497050	498630	Basically, no success.
499130	502330	There's also that mention of spaces are a special character.
502430	504650	We'll get back around to that one.
505370	507370	They are a character, certainly.
507930	510930	Any case, approaching zero success.
511290	513550	Pack it in. Presentation over.
514190	515690	That's all, folks.
517610	519810	No? You're not buying that?
519810	521970	Well, good, because neither am I,
521970	523930	and I should address the final reason I'm here
523930	526390	presenting on this topic in particular,
526390	528290	which is the CISO of my company.
529410	531090	So, getting on the password policy,
531090	533850	so, taking that innovative kind of incubator mindset
533850	535210	and looking at passwords.
535310	538730	So, passwords are something that's highly audited,
538730	540370	because it's very easy to do.
540370	541870	If you're an auditor and you're trying to assess
541870	543250	whether somebody's passing muster,
543250	544670	you can have this rule set,
544670	546830	and you can walk in and either they pass or they fail.
547110	548250	And you'll see a lot of that,
548250	550110	and a lot of the companies have this password policy
550110	551470	that comes straight out of audits.
551470	554150	Eight characters and three or four of uppercase, lowercase,
554150	555230	special characters and numbers.
555230	556110	There, I just rattled it off.
556110	557870	It's been almost 20 years of that.
559090	561150	So, we looked at that, though,
561150	563330	and as we went through the red teaming,
563330	566050	we found that one step in what we call the kill chain,
566050	568290	if an attacker were successful,
568290	569730	and we actually give them a leg up,
569730	571010	we actually bring hackers on
571010	573210	and bring them in as fake employees.
573210	575670	We give them a laptop and a password and they start.
575890	577210	And we found one step in the kill chain
577210	580070	was taking all the passwords and cracking them.
580070	583570	And they would run computers with graphic processing unit,
584170	586390	augmentation, and they'd run for hours,
586390	588350	and they'd be able to crack a few passwords
588350	590090	and hopefully they'd find a privileged account,
590090	592010	and then they were off to the races with that.
592070	593310	So, while that was only one step
593310	595070	in what I call the kill chain,
595070	597150	we just said, you know, we want to win that battle.
597150	598970	And here we are compliant,
598970	600830	but it's just not getting it done.
600830	602430	I'm just meeting compliance.
602870	605030	So, we ran some math on the whiteboard
605030	606030	and we said, well, what if we went out
606030	608070	to a really long password, 15 characters,
608070	610070	but got rid of all the complexity requirements?
610710	613510	And, you know, I have a lot of people
613510	616010	with high math SAT scores on my team.
616010	617130	Let's put it that way.
617510	619070	So, we had some great whiteboard battles
619070	620290	and, you know, how much better would it be
620290	621250	and that sort of thing.
622390	624030	But what kept creeping in there
624030	626110	because of kind of that tick box mentality
626110	627770	was, well, we have to have complexity.
627830	628690	Everybody's expecting that.
628690	630810	We have to have uppercase and lowercase and on and on.
630810	632430	But we said, well, let's just try it out.
632950	635570	So, the math held and we felt pretty good about it.
635570	636950	And then around that time,
636950	639750	the National Institute of Standards and Technology, NIST,
639750	641310	released an updated standard.
641310	642870	And they said, well, length is king.
642870	644390	And if you can get a longer password,
644390	645470	you can get rid of some of that stuff
645470	647750	as long as you look for commonly used passwords
647750	649030	and block them out.
649310	651230	So, long story short, we did it.
651230	653730	And it took about 90 days to roll it in.
654090	656990	And the impact has been substantial.
657070	658830	And the only reason we were able to do that
658830	661210	is because we innovated and created this thing
661210	662630	that we called the Kraken
662630	664410	that every single day tries to crack
664410	666010	all the passwords in the company.
666130	668250	And we see the success rate of that machine
668250	669930	just dropping precipitously.
669930	670790	We saw it.
671050	672530	And I'm going to cut it there.
673070	676970	So, yeah, that's out in the public domain.
678290	682750	And we need to talk about that math Jerry mentioned.
683270	686730	See, the math might hold up,
686730	688490	but the equation isn't realistic.
688490	690530	There's more than one way of approaching this problem.
690530	692850	And I've heard the arguments spun multiple different ways.
692850	694910	The first of which is it's inconceivable
694910	697230	to crack a 15-character password
697230	699290	because brute-forcing through all the possible numbers
699290	702590	and lowercase letters is 1.6 sextillion combinations.
702930	704110	Another argument I have heard
704110	706330	that comes from a better standpoint
706710	709050	is assuming the passphrase is made up of words.
709050	711390	There are a lot of words around five characters or more,
711390	713050	so you can say a 15-character passphrase
713050	714490	is probably three words,
714490	716850	which is extremely difficult.
716870	719010	You'd have to go through more than 50 quadrillion options
719010	719770	to be sure.
719770	720570	Okay, big number,
720570	722670	but certainly smaller than the last one.
723050	725510	And the last one I've heard,
725510	727730	perhaps the most educated of these strawman arguments,
727730	730430	is based on the common requirement of eight characters doubling
730430	733150	that gets you just above the 15-character requirement,
733150	734790	so maybe we should think about passphrases
734790	736530	as just multiple passwords combined.
736530	738950	In which case, the lowest margin for cracking
738950	743010	all of the combinations of two passphrases
743010	746170	is just the combinations of two common passwords combined.
746170	748070	Which, if we're using the RACU dictionary,
748070	750450	is still over 205 trillion,
750450	752530	which they'll tell you is unreasonable.
752850	754490	Well, I'm here to tell you that all of these arguments
754490	756990	that say that cracking past 15 characters,
756990	759270	regardless of reasoning, can be undermined,
759270	762330	and they can be undermined with only three factors.
762470	763890	What are those factors, you might ask?
763890	765230	Are you just teasing us?
765230	767390	Is this a timeshare scheme in disguise?
767510	771150	No, the big secret weakness is humans.
771810	772690	Inconceivable!
773090	773870	I know.
775010	777670	Specifically, humans are bad at big numbers,
777670	779550	humans pack complexity on the ends,
779550	781670	the ends of passwords or passphrases,
781670	783190	and humans pick similar things.
783190	784690	Similar things to other humans,
784690	786890	common things are common because they're commonly picked.
787350	788630	Before I get too far,
788630	791630	we should define some limits on what is reasonable,
791630	795550	and I should address the other part of the clickbaity title of this talk.
795550	797070	Why the $500 limit?
797310	801030	Well, besides it being a nice round number that is easy to pitch,
801030	803530	it's also the roundabout cost of an entertainment system,
803530	806530	and you can safely assume that every type of threat actor
806530	807930	you might need to be worried about,
807930	809550	including LulzSec and the Script Kitties,
809550	811170	has access to this amount of money.
811170	813690	It's also an amount that can pack a sizable punch
813690	815090	regardless of the path you take,
815090	817570	either owning a cracking rig or renting out cloud computing.
817570	820890	$500 is more than enough to go off and build a small cracking system
820890	824030	out of a GPU from eBay and some outdated desktop parts,
824030	825910	which you might have found in a dumpster,
825910	830750	which should net you the theoretical max of 53 gigahashes against NTLM.
830870	836710	As for the cloud, in AWS, $500 will get you 68 hours on a spot instance,
836710	840630	which, yes, might get preempted. Probably won't, though.
840630	843430	With eight V100 GPUs, which you can do manually,
843430	845750	or you can use a management tool like CoalFire's NPK
845750	847510	to manage the spot instances for you,
847510	850010	for both scale and automation of the attack.
850190	852790	If you're an attacker, and what you're planning on doing
852790	854150	is a series of short-running attacks,
854150	856350	instead of waiting 68 hours to get all the results,
856350	859690	why not just spend 68 instances and get the results in one hour?
860110	862090	Sadly, NPK doesn't work with Google Cloud,
862090	863710	which actually appears to be cheaper,
863710	867190	and if you squeeze out everything you can,
867190	870930	you can get 83 hours of time on an instance with eight V100 GPUs.
870930	873550	Which, besides being terrifically cheap,
873550	875850	brings us to a terrifying theoretical max
875850	880390	of 189.3 petahashes of NTLM, we can guess.
880390	882850	Not mega, not giga, not tera.
883110	885990	Peta. 189 quadrillion.
885990	887990	If we compare that to that last strawman argument
887990	890210	of the ROCU dictionary on top of itself,
890210	892990	sure, theoretical isn't real performance,
892990	896850	but the difference isn't off by a factor of a thousand times.
897150	899090	Although humans aren't bad with big numbers.
899370	902730	Which brings us around to the second strawman argument.
902990	904630	I'd like to throw in an alternative equation
904630	906950	that is still very conservative for how many guesses it takes
906950	908970	to crack a three-word passphrase.
909170	911670	All of the words that are obsolete to the third power
912190	915070	divided by the number of people in the organization
915070	917670	or number of hashes an attacker has to crack,
917670	920370	all of which is divided by the factor of human laziness squared.
920370	922930	How do you quantify human laziness, you might ask?
922930	924450	Don't ask me, but trust me,
924450	927770	the value of that variable always seems to be greater than one.
928050	931050	This is a somewhat joking equation,
931050	932830	but the very conservative hypothesis here
932830	934770	is that people making a passphrase
934770	936490	will use words from languages they know
936490	939470	and can think of under the duress of password creation,
939470	941690	which tends to be a much more limited set.
941690	943330	In fact, I'm going to say now and support later
943330	944970	that the pool to pick from for a lot of people
944970	947770	seems to be between 32,000 and 64,000 words.
948050	949330	Which brings me to a point
949330	951890	where we are going to need to break out a lot of math.
951950	953610	Because underminer number one,
953610	955490	people are bad at big numbers.
955690	957630	Thankfully, people are good at spotting trends
957630	959130	after they have all the information.
959410	961610	So let me give you something that is easier to parse,
961610	962870	or hopefully easier to parse.
962870	965290	This is a chart of the actual computational limits
965290	966810	of combining words together
967300	969250	in an attack on a single 2080 Ti
969250	970950	on NTLM hashes,
970950	973990	which I picked because it's a consumer GPU and I have access to one.
973990	975350	The horizontal axis of this chart
975350	977690	is the number of words in a passphrase.
977690	980230	The vertical axis is the size of the dictionary,
980230	981630	or perhaps a more useful way to think about it,
981630	983670	the rarest word in a passphrase that can be cracked.
983770	985350	Because a logical attacker is going to use
985350	986870	the list of words by frequency.
986870	990110	The bigger that list is, the rarer the words are going to be that are in it.
992510	993690	Now, all the numbers
994270	995050	in the colored boxes
995050	997770	are the amount of minutes required to complete
997770	1000170	an attack search space.
1000170	1001630	And the coloration tells you how long a time
1001630	1003890	that is relative to minutes, hours, days, weeks,
1003890	1005770	months, or years. Because I'm not going to lie,
1005770	1008250	I don't know off the top of my head how many minutes are in a week.
1008590	1009850	Going down or to the
1009850	1011890	right exponentially increases the amount
1011890	1012830	of work needed.
1014330	1015810	And there's a lot of spots
1015810	1017530	here where the
1017530	1019690	jumps in difficulty are
1019690	1022150	sharp. And this is where the idea of a
1022150	1024030	computational wall comes in. A seemingly
1024030	1026710	sudden increase in difficulty that you can't go over.
1026710	1028010	But of course,
1028010	1030490	this is only on the chart for a consumer GPU.
1030490	1032550	What about a V100?
1032550	1033810	Well, it's not actually that much
1033810	1034630	different.
1035610	1037610	There are a lot of reasons why V100 should be
1037610	1039750	much better for cracking generally, but it isn't
1039870	1041770	a variable for this particular chart. Anyway,
1041770	1043750	what if we have more than one GPU? Why not
1043750	1045750	eight? Well, the chart is going to shift
1045750	1048170	down a little bit and open up some options.
1048170	1049850	Those of you that have noticed the size of the
1049850	1051830	numbers we're dealing with on the vertical axis
1052830	1053810	probably already have
1053810	1055710	some nightmares to take home, but I'm going to make sure
1055710	1057270	everyone else has them too.
1057330	1059550	In the two-word column, that is more than
1059550	1061590	16 million words in 20 minutes.
1061590	1063810	Basically, every word actually in use
1063810	1065830	from every language spoken by at least 1%
1065830	1067470	of the world's population fits in here
1067470	1069610	with room to spare for a couple extra
1069610	1071170	million common passwords.
1071650	1073530	In the three-word column, that is
1073530	1075670	every non-obsolete word in the English language
1076130	1077870	and it's testable in a
1077870	1079990	matter of hours. In the four-word
1079990	1081870	column, we have a sizable chunk of
1081870	1084110	commonly used words where a target attack, say from
1084110	1086010	scraping the memos and websites of the target
1086010	1088070	makes sense.
1088070	1089590	Before I get too excited, I'm sure someone
1089590	1091590	is thinking, okay, cool, that's just
1091590	1092990	NTLM. What about a slower
1093590	1096190	actually secure hash or quote-unquote secure hash?
1096190	1097550	Well, here's that same chart for
1098870	1099350	shop512unitspassphrases
1099350	1101490	and you'll notice there are still some viable
1101490	1103750	attacks on two- and three-word passphrases.
1103790	1105470	And here's bcrypt or blowfish
1105470	1107590	configured with the Unix defaults, albeit this is
1107590	1109630	some pretty weak Unix defaults.
1109630	1111670	I think Ubuntu has gone well past
1111670	1113550	this now. In any case,
1115170	1117590	we lose a lot of capability, but even
1117590	1119730	when that difficulty curve is ramped
1119730	1121510	way the heck up,
1121510	1123710	we still have options in the two-word
1123710	1125730	passphrase category. As an attacker,
1125730	1127130	this chart makes me really sad, but
1127130	1129630	the reality of most corporations using
1129630	1131650	Windows somewhere in infrastructure is that there
1131650	1133590	will be somewhere something using a hash
1133590	1135870	that, like NTLM,
1135870	1137950	isn't going away
1137950	1139830	for quite a while to come.
1140190	1141770	And as far as individual users
1141770	1143010	that are concerned with
1143670	1146150	what they need to have as a passphrase,
1146150	1148190	well, they need to make sure what they have
1148190	1150090	isn't going to get cracked when the hashes get dumped,
1150090	1152150	either inside an institution or
1152150	1154050	when a website gets all of its password dumped by
1154050	1156070	SQL injection. And let's be real, a lot of major
1156070	1158090	websites and companies keep on getting caught with
1158090	1160010	their pants down, and we only find out they're using
1160130	1161670	a fast hash or plaintext
1161670	1162990	the hard way.
1163730	1166150	Not to mention the difficulty of computing a hash
1166150	1168090	is a linear factor in a world where computing
1168090	1170090	power increases exponentially. So I'm
1170090	1172010	going to go back to the other chart, because it's
1172010	1173970	time to get into the attacker mindset and play
1174090	1175630	a game of bad recommendations.
1175990	1178270	First up is Google, and yes,
1178270	1180010	the advice is old, but the
1180010	1182130	advice, much like their policy,
1182130	1183890	hasn't been updated in more than a decade.
1183890	1185830	So, I love sandwiches.
1185850	1187670	It's not a great example, and that mix of
1187670	1190410	leet-speak and case-shifting doesn't do much for the difficulty.
1190410	1191910	I'll be generous and say that it makes it
1191910	1193950	about 100 times harder. In terms
1193950	1195550	of the rarity, this slide shows
1195550	1197810	where the various words fall on Google's
1197810	1199950	own most searched list,
1199950	1202010	that's the G number, and
1202010	1203830	the Wikipedia frequency list,
1203830	1205530	which would be the W number.
1206770	1207990	The fact of the matter
1207990	1209990	here is, the underlying phrase is crackable
1209990	1211950	in under 3 minutes. And even giving the
1211950	1213830	benefit of the doubt and the difficulty of guessing
1213830	1215870	leet-speak substitutions, that's crackable in
1215870	1217350	244 minutes.
1217650	1219850	I should probably also mention the recommendation
1219850	1221930	put forth in the absolute latest NIST and
1221930	1224150	FBI recommendation, because they suggested
1224150	1225970	in a... they suggested the
1225970	1227890	passphrase, voices protected 2020
1227890	1230230	we are, and then suggested the passphrase
1230810	1232550	that is even better.
1233010	1234130	At least according to them.
1234130	1236090	Which is director-month-learn-truck, because
1236090	1237630	the words are unrelated.
1238270	1240150	Well, those words might seem unrelated, but they
1240150	1241930	all have one thing in common, and that's they're all
1241930	1244230	eye-searingly common. The rarest
1244230	1247010	word in there is truck, and oh boy,
1247010	1247870	that isn't the top
1247870	1250210	4,000, regardless of
1250210	1251570	which list you choose.
1252130	1254430	Four common words are not safe from offline cracking,
1254430	1256330	which does bring up another, perhaps more
1256330	1257630	viral recommendation
1258710	1259670	from XKCD
1260450	1261410	936.
1262310	1263770	Now, a lot
1263770	1265550	of people have used this as password
1265550	1266570	advice,
1267870	1270090	including the management intercontinental exchange.
1270090	1271990	And the matter of it is,
1271990	1273730	the math in XKCD's advice
1273730	1275690	as written is actually fine, because it
1275690	1277650	was written to handle an online attack
1277650	1280330	where the rate of guessing is only 1,000 a second.
1280450	1281730	Now, there's
1281910	1283690	a claim here that the average user shouldn't have
1283690	1285630	to worry about attempts to crack a stolen
1285630	1287650	hash, and I'm here to tell you from experience
1287650	1289970	the average user reuses passwords.
1290030	1291630	The average user also works at a company,
1291630	1293490	and if that company is larger than a couple dozen
1293490	1295510	people, they should also worry about stolen or dumped
1295510	1297190	hashes, both from their own infrastructure
1297650	1299310	and the websites their users are
1299310	1301610	using both professionally and personally.
1301970	1303570	Four common words isn't safe from offline
1303570	1305170	attacks. If anything, XKCD
1305650	1307690	the example here is a little stronger than intended
1307690	1309370	because staple isn't actually that common.
1309370	1311630	It's number 11,363
1312590	1313750	on the Wikipedia frequency list
1313750	1315670	and completely off the end of the Google list.
1316110	1317610	Then there's level entropy.
1317610	1319850	XKCD says it's a
1319850	1321750	common word. If we say
1321750	1324190	common words are words that are in the
1325690	1326390	first 2048
1326390	1327930	of any given word list,
1327930	1329750	and the attackers, well,
1329750	1331750	they're going to win all the way out to six word phrases.
1331750	1336070	Yes, really six. Like, good luck Diceware users.
1336070	1338350	This is nasty.
1338350	1339930	This is not how this...
1339930	1341570	there is no way out of this computationally
1341570	1343630	with just throwing on
1344270	1345470	common words.
1345930	1347690	Mind you, there are some caveats.
1347730	1349590	The real world isn't as simple as an Excel
1349590	1351550	sheet, so before we get into real
1351550	1353530	world results and the mechanics of attacks, we
1353530	1355630	should very quickly cover the things that
1355630	1357710	are going to be ever present when attacking these passwords
1357710	1358730	using a GPU.
1359750	1361770	Yeah, this is going to get real technical real quick.
1361770	1363530	First of which is the dictionaries and the size
1363530	1365530	of the dictionaries. There's a lot of bandwidths to go around
1365530	1367590	for operations within a GPU and its memory, but
1367590	1369250	transferring data to the GPU?
1369250	1371610	Well, PCI Gen 3 by 16
1371610	1373530	is only 16 gigabytes per second
1373530	1375350	max theoretical, not
1375350	1377810	real world, and that might seem like a lot,
1377810	1379530	but when we're dealing with 16 billion
1379530	1382090	theoretical bytes per second,
1385430	1387370	modern GPUs can do 26
1387370	1389420	billion real hashes of a passphrase
1390030	1391270	per second,
1391270	1393290	and one of these numbers doesn't fit within the other
1393290	1395750	and also is real, not theoretical.
1396050	1397550	That PCI
1397550	1399850	bandwidth is not going to match up with the hash rates.
1399950	1401690	The other limitation to be mindful in terms
1401690	1403690	of what kind of attacks
1403690	1405470	are possible is the nature of
1406170	1407770	CUDA or the AMD equivalent,
1407770	1409290	I'm not going to get into it, cores in the GPU
1409290	1412010	and what they can do. Compute Unified Divided Architecture,
1412010	1413730	which is, well, not a lot actually.
1413730	1415450	They were built to do lots of single
1415450	1417530	instruction multiple data computations on matrices
1417530	1419210	and vectors for graphics, which means
1419210	1421570	lots and lots of units they can do
1421570	1423690	arithmetic, ALUs,
1423690	1426410	and not a lot of space or silicon devoted to controlling them.
1426410	1428530	The nature of single instruction
1428530	1430430	multiple data means groups, or in this diagram
1430430	1432490	rows of ALUs, all need to
1432490	1434510	be doing the same type of thing at the
1434510	1436790	same time, and those instructions and a
1436790	1439170	significant portion of the data needs to fit in a smaller
1439170	1440770	shared cache, and oh right,
1440770	1442470	the instructions better be simple and something
1442470	1444750	it can actually do. If that something isn't
1444750	1446950	exactly implemented in HashCat or John the Ripper,
1446950	1448950	often the best bet is to find
1448950	1451150	a workaround. Also, thank you HashCat
1451150	1453150	and John the Ripper devs for making it easy
1453150	1454370	to use these devices for cracking.
1454370	1457050	Okay, let's talk about techniques and results.
1457050	1458210	First, dictionary attacks,
1458210	1460470	basically checking through a massive list of passwords
1460470	1462250	in a file, with or without GPU generating
1462250	1464710	some additional candidates to check,
1464710	1466650	though more on rules later.
1466970	1467930	Intercontinental exchange,
1469550	1470690	we've been running a
1470690	1472750	dictionary attack during the period that Jerry
1472750	1474470	mentioned in that soundbite,
1474470	1476730	while we rolled out the 15 character policy,
1476730	1478590	and as you can see in this graph,
1478590	1482490	the average length of a cracked password,
1482490	1482750	the policy
1482750	1484990	wasn't just successful, it caused some rapid
1484990	1487190	jumps in length when it started to be enforced.
1487270	1488570	And after implementation,
1488570	1490890	the average length evened out despite some outlying
1490890	1492750	spikes. But this is the less interesting
1492750	1494670	half of the story. This is the graph of the
1494670	1496730	percentage of passwords that were cracked by
1496730	1498770	dictionary attacks, only dictionary attacks.
1499130	1500730	Yes, that
1500730	1502550	number in the upper left is 50%.
1502550	1504970	Dictionary attacks are very good when you have a
1504970	1507210	dictionary of passwords made of the same password
1507210	1509130	policy that you're targeting.
1509130	1510730	And yes, dictionaries
1510730	1512670	also aren't very good after people change their password
1512670	1514770	under a completely different and
1514770	1516630	significantly changed policy
1516630	1518850	and start picking things that aren't going to be in the dictionary
1518850	1520770	anymore. In fact, if we overlay the
1520770	1522710	two graphs, we see multiple downward shifts
1522710	1524810	in the number of cracked passwords, even after the
1524810	1526970	average of cracked passwords is above 15
1526970	1528970	characters, as further enforcement
1528970	1531890	for cracking cracked passwords was rolled out.
1531890	1532770	Until it settled
1532770	1534710	down and around the 1%
1534710	1536650	range. Mind you, it didn't approach
1536650	1538550	zero. It held down near a certain
1538550	1540610	percentage. There is always somebody
1540610	1543110	picking and re-picking a terrible password.
1543150	1544530	And these attacks are trimmed and don't show
1544530	1546530	anything that has happened recently. But I assure you, straight
1546530	1548810	dictionary attacks have not had much success.
1549750	1550490	Though I was
1550490	1552290	hired around this time. So let's talk
1552290	1554510	combinator attacks. Attacks
1554510	1555970	centered around combining
1555970	1558550	different dictionaries or the
1558550	1560850	same dictionary results into itself.
1561170	1562490	Or sorry, the same dictionary
1562490	1564450	onto itself. The attack here is pretty
1564450	1566590	straightforward and we've kind of already talked about it
1566590	1568190	so let's get right into the results.
1568470	1570470	And well, here's a chart of every
1570470	1572650	passphrase password longer than 15 characters
1572650	1574290	ever cracked in a continental exchange.
1574290	1576450	That was crackable with a small dictionary of
1576450	1578450	words or common passwords organized to
1578450	1580610	reflect the charts from the computational
1580610	1582850	wall part of the presentation a little bit earlier.
1583150	1584470	In order to do this, I had to modify
1584470	1586290	an algorithm for dissecting passwords called
1586290	1588470	zxubn to be able to actually properly
1588470	1590170	handle common separators like spaces
1590170	1592490	between passwords and a passphrase because
1592490	1594470	apparently the creators of zxubn didn't
1594470	1597130	think that was important to handle. Anyway, I digress.
1597710	1598670	A password slide here
1598670	1600330	based on how many elements, usually
1600330	1602390	words, but sometimes a common password
1602390	1603290	zxubn
1604670	1606250	believes it is made up of
1606250	1608430	and the rarity of the rarest element
1608430	1610350	based on the number of guesses
1610350	1612670	required, which should roughly
1612670	1614410	dictate the size of the source dictionary
1614410	1616210	required. And
1616210	1618490	you can see there's a rather precipitous
1618490	1620390	drop-off somewhere between 32,000 and
1620390	1622390	64,000. Along
1622390	1623370	with some pretty significant
1623950	1626810	preference for three element passphrases,
1626810	1627070	which
1628110	1630210	might have had something to do with certain recommendations
1630210	1631670	packaged with the policy.
1633350	1634930	Now, this is neat and all,
1634930	1636430	but what about the other datasets?
1636430	1638010	Say, not from this company.
1638230	1640230	Well, I considered calling up various
1640230	1642250	companies with 15-character policies and seeing
1642250	1644110	if they were willing to give me their hashes.
1646530	1647030	But it
1647030	1648390	didn't work and it seemed pretty unlikely,
1648390	1649970	so I had to artificially make one.
1649970	1651870	So this is the result of over
1651870	1654290	37 million hashes from the have-I-been-pwned
1654290	1655890	version 2 collection, where every
1655890	1657970	password known to be less than 15 characters long
1657970	1660050	has been stripped out, which is really only possible
1660050	1662190	because over 90% of this list has already been cracked.
1662450	1663990	Both of the attacks here are pretty
1663990	1666030	shallow and short-running, in large part because I
1666030	1667850	only needed to prove a point, and
1667850	1669910	also the hashrate is artificially terrible when
1669910	1671810	cross-checking 37 million
1671810	1674110	hashes for matches. That being said,
1674110	1675850	this is 1.14% of
1675850	1677750	all the passphrases in the dataset
1677750	1680070	in less than 3 minutes.
1680370	1681630	Scared yet?
1681710	1683990	Good! Because this is an example
1683990	1685770	of what happens when you use a lot more candidates
1685770	1687730	and checking combinations of
1687730	1689830	passwords. If you still remember
1689830	1691390	that third strawman argument,
1691390	1693710	this is all of the ROKU word
1693710	1695930	list on top of itself. Sure, it takes
1696130	1697830	a day and 16 hours on some piddly
1697830	1699570	GPU horrifically bogged down by
1699570	1701510	37 million hashes to crack.
1701750	1703750	Normally in cloud infrastructure, this would take
1703750	1705690	16 minutes. For a single machine in
1705690	1707410	AWS or Google Cloud with those
1707410	1710110	8 GPUs, it would cost single-digit dollars.
1710870	1711790	Now that I've got
1711790	1713770	the would-be crackers excited, there are some technical
1713770	1716030	shortfalls with HashCat that also need to be noted.
1716030	1717710	The combination mode only takes 2 files
1717710	1719670	as input. You want to use
1719670	1721590	this so HashCat can load as much as it can on
1721590	1723790	GPU RAM ahead of time, which
1723790	1725790	means if we want to check 3 or 4
1725790	1727510	element passphrases,
1727510	1729830	you need intermediate dictionaries, being mindful
1729830	1731430	of the exponential file size.
1731610	1733810	And it's a similar deal for the hybrid mode,
1733810	1735510	which can only take one word list and
1735510	1737690	one mask file. You could
1737690	1739730	use other programs and pipe in candidates,
1739730	1742130	but you pay the piper when doing so in a fast hash.
1742330	1743650	And the other thing
1743650	1745310	HashCat isn't going to do for you is
1745310	1747610	generate variants of passphrase candidates with
1747610	1749730	all the spaces and capitalization that people generally
1749730	1751730	use. From what I've seen, you're
1751730	1753690	going to want title case, sentence, and all
1753690	1755970	lowercase, both with and without spaces.
1756630	1757590	No, I do not consider
1757590	1759450	spaces a special character anymore.
1759510	1761210	The easiest way to do this is with
1761210	1763250	individual rules on a
1763250	1765890	combinator tack, starting with a preprocessed
1765890	1768090	dictionary that already has the spaces
1768090	1769330	between capitalized words.
1769330	1771710	Then you can manipulate it easily enough to get the spaces
1771710	1773510	and capitalization desired. For HashCat,
1773510	1775970	J corresponds to the left word list, K corresponds to the
1776010	1777830	right list. Which, on the topic
1777830	1779530	of rules, is another shortfall.
1779530	1781890	You can only do one set of rules per word list in
1781890	1783450	combination mode. Yes, sorry, if you
1783450	1785850	want to check lots of different things using rules
1785850	1788570	like common words in between two words,
1788570	1789090	you're going to need
1789810	1791070	a honking, massive, and ugly
1791070	1793130	bash file, or a program to manage it for you.
1793130	1795050	This is actually what TrustedSexHatecrack is
1795050	1796930	doing behind the scenes for what they call middle
1796930	1798850	or thorough combinator attacks. It's basically
1798850	1801190	spawning off tons of
1801190	1802810	HashCat command lines.
1803870	1804570	Alright.
1805370	1807150	Enough about conditions of combinators,
1807150	1808950	let's move on to PrinceAttacks, which, despite
1808950	1810870	the other name for the attack, has
1810870	1813610	nothing to do with the artist formerly known as.
1813710	1815370	Prince is a
1815370	1817750	acronym for Probability Infinite Chained Elements,
1817750	1819550	but it is pretty
1820090	1821690	simple in purpose. Take
1821690	1823670	the path of least resistance and find more
1823670	1825650	passphrases sooner by outputting shorter linked
1825650	1827670	candidates first. Not only is the search
1827670	1829470	space smaller, but we can also expect to find more
1829470	1831510	passphrases here because people tend to pick
1831510	1834130	passphrases close to the minimum required effort.
1834350	1835810	This overlap of least resistance
1835810	1837870	motivations is just great for an attacker.
1838430	1839710	How does Prince work? Well, it
1839710	1841670	ingests a word list, sorts all the contents
1841670	1843690	by links, and puts them into separate
1843690	1845670	lists, and then begins producing
1845670	1847810	candidates at the minimum specified length
1847810	1850430	out of the lists of the various links,
1850430	1851910	iterating through all possible combinations
1851910	1854150	of lists until the options are exhausted,
1854150	1855890	at which point it moves on to making longer
1855890	1858070	candidates. Now,
1858070	1859750	after that explanation of how Prince works, you might
1859750	1861930	be wondering, why not just
1861930	1864550	use combinators of length-cut lists?
1864570	1865750	Aren't Prince and Hashcat separate
1865750	1867710	programs? Won't I have to pay the piper? Didn't you
1867710	1869730	just say that transferring all that stuff for PCIe was
1869730	1872050	terrible for performance? Well, yes,
1872050	1873770	you do have to pay the piper, and you could
1873770	1875910	manage all of these attacks manually,
1875910	1877950	but it gets pretty crazy to manage
1877950	1879830	all the lists and combinations for 3- and 4-word
1879830	1881930	elements. It's doable, but you really need another
1881930	1883630	programmer script, and
1883630	1885830	there's a solution that circumvents this,
1885830	1888150	and it comes back to one of the undermining factors.
1888870	1889630	This is
1890450	1891830	the positions of dictionary
1891830	1893850	elements in passphrases. Larger
1893850	1895830	numbers here mean more passphrases contained
1895830	1898190	in elements straight out of a dictionary in that position.
1898190	1898750	And there is
1899750	1901930	one heck of a disparity between the last
1901930	1904670	position in a passphrase and the rest of a passphrase.
1904810	1905830	Because humans pack
1905830	1908190	complexity on the ends. Most of the end,
1908190	1910150	sometimes in the beginning, extremely
1910150	1911810	rarely in the middle.
1912550	1913970	So, the fix for Prince's
1913970	1915530	terrible hashrate on fast hashes
1915530	1918430	when it's piped in? Rules.
1918450	1920410	Because you can use the default
1920410	1922490	hashcat cracking mode, you can specify
1922490	1924530	with a rules file.
1924530	1926770	Any problems? Well, yeah, most rule
1926770	1928610	lists are made by people on the internet
1928610	1930150	and aren't long enough to make use of a GPU's
1930150	1932170	spare resources or are more focused on modifying
1932170	1934350	passwords and not altering
1934350	1936330	passphrases, like adding suffixes
1936330	1938230	or prefixes. So, I've made
1938230	1940170	them one more focused on common prefixes
1940170	1941530	and suffixes,
1942070	1944450	you know, your 20, 20, your exclamation point,
1944450	1945330	etc. With
1945330	1948910	4,175 rules,
1948910	1950070	which is up in the
1950070	1952330	rephraser repo I'll mention later,
1952330	1954170	and soon to come I'll also be releasing a prefix
1954170	1956250	and suffix list, which probably is already up by
1956250	1958030	now, based on the frequency data
1958030	1960050	of those cracked password phrases mentioned
1960050	1962670	earlier in the have-I-been-pwned-version-2 list.
1963130	1963830	Okay.
1963830	1965110	Let's talk success rates
1965830	1967150	for print.
1968970	1970030	Now, the
1970030	1971430	kicker here is that
1972030	1973950	we're making use of that rule list I mentioned
1973950	1976210	to catch passphrases with common suffixes
1976210	1977830	and prefixes. There are no
1977830	1979970	single-element passphrases here. We can
1979970	1982730	see a repeat of an earlier trend.
1982990	1984070	Namely, a sudden
1984070	1986350	drop-off between 32,000 and 64,000
1986350	1988630	with some clustering around three elements,
1988630	1990410	including the suffix or prefix.
1990990	1992390	You've got to remember all of these are being
1992390	1993430	run with the rules.
1994030	1996170	This works out pretty well for sussing out
1996170	1998290	passphrases, at least within
1998290	1999670	your continental exchange.
2000570	2002390	What about a much larger dataset?
2002630	2004450	Well, we can also see the reason
2004450	2006390	why people
2006390	2007990	like using print's attacks.
2008070	2010090	Both of these attacks were using the
2010090	2012090	RockU password dictionary as the source, and
2012090	2013870	both were stopped at the same time at
2013870	2016070	1.8, the runtime of the RockU squared
2016070	2018670	combinator, RockU on top of itself.
2018710	2020010	That complete attack
2020010	2021890	I mentioned earlier took one day, 16
2021890	2023970	hours on our piddly setup, and got
2023970	2025930	5.82%. These attacks
2025930	2027770	managed to concentrate a significant
2027770	2030450	portion of that success very early in cracking.
2030470	2031870	The other comparison here
2031870	2033990	is the performance between restricting the
2033990	2035750	number of elements print is allowed to use
2035750	2037750	in the attack. At least
2037750	2040150	in this case,
2040150	2042150	there was a limited but significant advantage
2042150	2043990	to focusing only on three-word element
2043990	2046090	passphrases. Because again, we're also using
2046090	2047990	that ruleset mentioned earlier with the prefixes
2047990	2050150	and suffixes, based on the print's candidates.
2050370	2051990	I'll also say again,
2051990	2054250	this was at a really abysmal hash rate.
2054530	2056030	We barely were reaching
2056030	2058050	one gigahash when doing this, and
2058050	2060210	these attacks can be much, much faster
2060210	2062190	when you're not drowning your GPU
2062190	2064370	in 37 million hashes to check.
2065010	2066410	And speaking of fast,
2066410	2068250	it's about time I get to the new and shiny.
2068250	2070270	Word-level markup chains for going after
2070270	2071870	passwords that are at their core
2071870	2073470	phrases.
2073930	2076030	What are word-level markup chains?
2076030	2078070	The simplest explanation I can give is
2078070	2080050	it's an over-glorified state model
2080050	2082690	to store relationships between groups of words.
2082690	2084170	For this example,
2084170	2086710	we'll just do a two-gram model,
2086710	2088410	think two elements in the state.
2088410	2090330	If the phrase used for training is
2090330	2091850	the cows eat grass,
2092150	2094270	a two-gram model will record state transitions
2094270	2096070	for the cows to eat
2096070	2098690	and cows eat to grass.
2098690	2100930	Obviously, this isn't a terribly
2100930	2102570	useful model by itself, but
2102570	2104790	imagine if it had some more training data,
2104790	2106870	say, hundreds, thousands, or millions
2106870	2108750	of sentences. The intent is to build up
2108890	2111210	a model of the relationships between groups of words.
2111210	2112790	And if we want to be more accurate, we can also
2112790	2114610	increase the number of elements in the state,
2114610	2116830	or raise the number-gram of the
2116830	2118570	model to three or beyond.
2119190	2120650	Though research generally
2120650	2122490	seems to show that three is
2122490	2124670	probably the point where you should stop.
2125430	2126650	Now, there is
2126650	2128690	one pre-existing proof of concept
2128690	2130390	I could find that does
2130390	2131730	more or less this
2133130	2134670	and actually would generate
2134670	2137170	output fast enough to be useful in password cracking.
2137170	2138670	Sadly, it was single-threaded,
2138670	2140890	written in a mix of C-sharp and C++,
2140890	2142710	and designed with a Windows Compile
2142710	2144670	target in mind. That simply wouldn't do
2144670	2146710	for my purposes, so I created something similar in Python
2146710	2148950	that is parallel, uses existing libraries,
2148950	2151010	and is naturally more multiplatform.
2151030	2152490	So, how well does it do?
2152810	2154630	Well, the astute members of the audience
2154630	2155950	when I showed this table
2155950	2158090	on the right of every
2158830	2160090	passphrase crack that was
2160390	2162410	combinator-findable may have noticed
2162410	2163450	some numbers that were
2164150	2166510	a little too far into the lower right
2166510	2168370	based on the computational complexity charts
2168370	2169750	we went through before.
2170010	2171850	Let me color that in for you.
2172350	2173930	Now, the very astute of you
2173930	2176270	might also infer that I did not
2176270	2179450	in fact have unlimited access to eight V100s,
2179450	2180730	and also
2180730	2182170	that chart on the right is
2182170	2184010	strangely positioned almost as if it
2184010	2186150	extends further to the right.
2186230	2187770	Well, it does.
2187890	2190730	And I had a single 2080 tie for my research.
2190910	2192090	I was also
2192090	2194070	heavily timeboxing everything on here
2194070	2196210	that isn't a shade of green, not from
2196210	2198370	combinator attacks. Flat out.
2198550	2200650	Admittedly, it's not a deluge of results,
2200650	2202430	but, come on.
2202570	2204270	Years. Literal years
2204270	2206610	for the combinator attack would not have yielded some of these.
2206610	2208130	And the couple out in the six
2208130	2209890	and seven element column?
2209890	2212110	Do you have any idea how long 10 to the 13 is?
2212110	2213690	Because that's what it is corresponding
2213690	2215990	on the difficulty computation.
2215990	2217230	It's millennia.
2217610	2220490	Certainly I'm very happy, but what about our much larger dataset?
2220870	2221950	Well, a similar story.
2221950	2223610	These attacks are very quick
2223610	2225630	when doing only a couple of words,
2225630	2227630	but admittedly don't pull in too much.
2227830	2229870	Only tens of thousands, you know.
2230410	2231830	The other factor you're likely
2231830	2233830	to play here is there's just
2233830	2235530	not that many passphrases that are also
2235530	2237650	phrases that exist in the dataset with
2237650	2238890	four words.
2239290	2241530	While we're here, I would like to point out the accuracy tradeoff
2241530	2243690	of choosing a 3-gram over 2-gram
2243690	2244470	model.
2247310	2249610	You can see that the 3-gram got a little over
2249610	2251530	half as much, but it only took
2251530	2253310	1 twelfth the time.
2253570	2255390	That is the accuracy tradeoff.
2255470	2257450	Now, before people get too uninterested, I should
2257450	2259330	show off the really impressive thing for me,
2259330	2261470	which is what happens when you put these to use
2261470	2263250	on even longer passphrases.
2263850	2265550	There still shouldn't be much out
2265550	2267390	here in the search space, but people seem
2267390	2269770	content to use phrases at this length.
2269770	2271350	Possibly because these should be safe,
2271350	2273450	according to everybody's advice. And these aren't
2273450	2275210	even common phrases, they're just kind of
2275210	2277390	normal phrases. Here are some
2277390	2279210	examples of what isn't safe anymore.
2279470	2281690	These probably aren't the passphrases
2281690	2283430	you expected to leave here knowing are
2283430	2285550	crackable, and certainly not crackable in 1, 2,
2285550	2287830	or 9 hours at speeds barely over 1GHz
2287950	2289830	a second. Do you have nightmares yet?
2289830	2291550	Because everything here was generated
2291550	2293210	by a Markov model and a simple
2293210	2295170	hashcat rule set. No dump passwords
2295170	2297330	as input, no cherry picking shenanigans,
2297330	2299070	and the training data was completely agnostic
2299070	2301290	to the target passphrases. No targeting
2301290	2303270	of any kind. Admittedly,
2303270	2305350	it does produce some strange candidates sometimes,
2305350	2307350	and I've collected some of the weirder ones
2307350	2308650	I've seen on the right here.
2309070	2311150	I don't know how he went from intrauterine
2311150	2313170	pressure catheters to Kiwi or Kiwis. I can
2313170	2315230	only assume one of the websites scraped from the training data
2315230	2317390	was a blog post about making Kiwi or Kiwis
2317390	2319490	with an embedded catheter cowboy advertisement.
2319490	2320750	I really don't know.
2320750	2322870	Now I should head off to some common questions
2322870	2324750	I'm anticipating. Some of you
2324750	2326730	familiar with hashcat might be thinking,
2326730	2328730	um, doesn't hashcat already have
2328730	2331050	Markov chains? Why can't we just do this?
2331150	2332730	Well, it does. It has a pre-made model
2332730	2334750	for character-level predictions,
2334750	2336690	which, when you start going out to 15 character
2336690	2338650	passwords and what you want is multiple actual
2338650	2341010	words, that model falls apart pretty quickly.
2341010	2342670	Not to mention it doesn't store relationships
2342670	2344670	between words, and it will basically
2344670	2346890	never finish, because the search space is at least
2347550	2349250	333 sextillion combinations.
2349250	2351290	If you're thinking, haven't you tried
2351290	2353190	this with GPT-2 or some other
2353190	2354490	machine learning algorithm?
2355470	2357150	My answer is, have you considered
2357150	2359310	hash rates? Markov models are good for this
2359310	2361370	because they're quick, especially compared to massive
2361370	2363250	models like GPT-2 or
2363250	2365370	some other ML model, which by itself
2365370	2367190	is more than 5 gigabytes and tends
2367190	2369490	to take multiple seconds to pop out a
2369490	2371510	single prediction. We need millions of predictions
2372790	2373350	in a second for it
2373350	2375250	to be viable in password cracking.
2375250	2377270	The other side of this is, the more advanced
2377270	2379230	models focus on making paragraphs, or
2379230	2381150	complete pages. We barely need
2381150	2382950	sentences. And there are very few passwords
2382950	2386770	I've seen that resemble more than a
2386770	2388470	sentence fragment.
2388470	2389390	Alright, head back
2389390	2391750	out of the weeds here, it's time to wrap up and summarize.
2391750	2393610	If you're not an attacker, you've probably
2393610	2395710	been sitting through this talk, mildly
2395710	2397530	terrified, waiting for some kind of
2397530	2399510	recommendation. Allow me
2399510	2401370	to make you wait slightly longer by addressing
2401370	2404250	the red teamers first. Red teams,
2404250	2405370	please, don't
2405370	2407230	cop out. 15 character passwords
2407230	2409730	are hard, but they aren't that hard to crack.
2410130	2411430	Even against Bcrypt, you should
2411430	2413370	at least be doing Combinators, PrinceAttacks,
2413370	2415750	and MarkovChains for the duration of your engagement.
2415910	2417510	And don't pretend your results should
2417510	2419170	approach zero, it should never
2419170	2421470	be zero. There will always
2421470	2422910	be somebody who picks something like
2423610	2425670	HelloSpring2020 as their passphrase.
2425930	2427190	Blue team, your turn
2427190	2429330	finally. Do the math that applies to
2429330	2431250	your situation, and do a little
2431250	2432950	more than just gather people that
2432950	2434930	scored highly on the SAT more
2434930	2436590	than a decade ago, and
2436590	2439230	pack them into a conference room and whiteboard it.
2439270	2440870	If intercepted or dumped hashes
2440870	2443610	or personal password reuse is a
2443610	2445630	concern for you, and it almost always should be,
2445630	2447330	feel free to take my math and represent it.
2447330	2449170	Unless your organization is cracking
2449170	2451090	its own passwords, you will not know what people
2451090	2453450	are using. I recommend the best
2453450	2455450	behaviors, but plan for the absolute worst.
2455450	2457250	Which brings me to something that
2457250	2459170	can serve as a starting point for
2459170	2460770	what to pass along to end users.
2460770	2463090	And this is my personal recommendation,
2463090	2464710	which of course is fairly paranoid, but the
2464710	2466770	intent here is to make sure
2466970	2468770	a hash, regardless of what type
2468770	2470770	of hash it is, can't be cracked
2470770	2473070	in $500 of expense.
2473290	2474450	Which means you're going to be making
2474450	2476490	illogical or highly unlikely phrases
2476490	2478750	of five or more relatively uncommon words
2478750	2480710	that are thematically unrelated.
2481350	2482070	Whew.
2482610	2484690	That seems like a lot, but we're talking about
2484690	2486690	diabetic unicorn trap Chicago tunnel
2486690	2488210	as a passphrase.
2488210	2490430	It takes a little
2490430	2492270	bit to make, but these
2492270	2494330	things should be able to hang around for a while.
2494330	2495770	And unless you force an attacker to use
2496330	2498170	a large dictionary combining multiple types
2498170	2500270	of words, cities, structures, fantasy creatures, verbs,
2500270	2502290	medical conditions, and use some words
2502290	2504110	that are uncommon, you're going to be building your
2504110	2506390	security posture with cracks at the foundation.
2506390	2507870	There will be some
2507870	2510090	edge case that will allow them to crack
2510090	2511010	your passwords.
2512370	2514230	So here's a very
2514230	2516090	overfull slide of everything.
2516090	2518230	Any questions? I am in the
2518230	2520230	Discord channel waiting by this
2520230	2521250	time.
2522870	2524190	Rephraser is up there at the
2524190	2526210	top, though it's probably just easier to
2526210	2527990	look for GitHub trap code
2527990	2529950	rephraser in Google.
2530810	2532050	And, yeah.
2533010	2534350	Feedback is appreciated.