In this lesson,
we're going to cover the Basics of Increasing Hash Security.
Now, before we talk about how to increase hash security,
we probably should focus first on two common types
of hashing attacks that are used by threat actors.
These are the Pass-the-Hash-Attack and the birthday attack.
Now, first we have the Pass-the-Hash-Attack.
Hashing is a commonly used method of storing passwords
inside of our systems, and therefore, if the hash digest
or hash value of that password can be obtained
by an attacker,
they can try to break into your network
using those hash credentials.
Now, the Pass-the-Hash-Attack is a hacking technique
that allows you an attacker to authenticate to remote server
or service by using the underlying hash
of a user's password
instead of actually associating the plain text password
that you normally have to log in with.
Now, if an attacker is able to sniff that hash
or steal it some other way,
they don't actually need to brute force the hash
to try and get that clear text password
of your giving user account.
Instead, the attacker can simply reuse the hash
of that arbitrary user account
as they go and authenticate against the remote system
and they can then impersonate the user that way.
In other words, from an attacker's perspective,
hashes are functioning equivalent to the original password
that they generated,
and this means they don't
actually need to get the actual password
for your account to log in as if they were you.
The pass the hash attack is really difficult to defend
against because there are so many possible exploits
inside of the Windows operating system
as well as the applications that run on top of it.
Any of these can be used
by an attacker to elevate their permissions
and then be able to pull off the credential harvesting
or hash harvesting that they can then use
in a further attack using pass the hash technique.
Also, only one machine
in a Windows domain needs to be misconfigured
or missing a critical security patch
for that hacker to be able to find their way in
and be able to execute this pass the hash technique.
Now, there are many penetration tools out there
like Mimikatz that will give you the ability
to automate this process of harvesting the hashes
and conducting the patch the pass the hash technique.
To prevent the Pass-the-Hash-Attack,
you should ensure
that only trusted operating systems are allowed
to connect to your servers
that your Windows domains have their trust set up properly
and that workstations are all going to be patched and updated
as well as making sure your multifactor authentication
is being used properly in your network
and that all user accounts have been set up
to use the concept of lease privilege.
Now, the second type of attack I want to cover
is what's known as a birthday attack.
And the birthday attack occurs
when the attacker's able to send two different messages
through a hash algorithm
and then get the same identical hash digest.
This is what we call a collision.
And in the case of a birthday attack,
we actually are trying to create collisions.
Now, this attack gets its name from something known
as the Birthday paradox,
which says that if you have a random group of people,
the chances that you're going to have two people in that group
with the same birthday is pretty high.
Now, when I teach this course in person to a group
of 30 people, most of the time two people
in the class are going to have the same birthday
based on the same month and day
because there are only 365 days in a year.
So if you actually do the math on this,
you only need 57 people in a room to get a 99% chance
of having two identical birthdays.
Now, with 23 people in the room,
your odds are about 50/50,
and that's why in a class with about 30 students,
more often than not we have identical birthdays
because that puts us somewhere in the 70 to 80% range
based on the underlying math.
Now, in the world of hashes
two identical hash digests are called a collision
and if an attacker can find two identical messages
with the same hash,
they can use this as an attack against your system.
For example, let's say that I found a match
to your password's hash,
that I can then use that
to bypass your authentication system,
even if I'm entering in the wrong password
as long as that password has the same hash value.
For this reason, we want to make sure we're using hashes
with long output digest, so we start using things
like SHA-256 over MD5
because this will significantly reduce
the amount of collisions
and the effectiveness of a birthday attack.
So how else can we increase the strength of our hashes,
especially when using them as part of our password security?
Well, one of the first things we can do
is use something known as key stretching.
Now, key stretching is a technique
that's used to mitigate a weaker key
by increasing its effectiveness
and thereby increasing the time needed to crack that key.
When you stretch a weaker key, the weaker key is run
through an algorithm
to create a longer more secure key,
than what would normally be used.
Many systems are going to utilize key stretching
to increase the security they provide,
including systems like Wifi Protected Access,
Wifi Protected Access 2, Pretty Good Privacy
Decrypt and others, which all use key stretching
to mitigate a shorter keys inherent weakness.
Second, we have salting.
Now, salting involves the addition of random data,
which we call a salt to the password
before it undergoes a one-way cryptographic hash function.
This process ensures that
even if two users have the same password,
their hashed outputs will be different
because they're using different salts.
Now, by doing so, salting amplifies password security
and thwarts various password cracking strategies
and techniques like dictionary attacks, brute force attacks
and rainbow table attacks.
Dictionary attacks happen when an attacker tries every word
from a predefined list
and this becomes much more challenging
because the salt is going to alter the hash outcome
for those commonly used passwords.
Similarly, brute force attacks where every possible
password combination is tested becomes
a much more time consuming process
because of the salting process.
And finally, we have rainbow tables
which are pre-computer tables
for reversing cryptographic hash functions
and these are rendered ineffective against salted hashes
because the added salt forces the attackers
to compute a new table
for each and every salt value making this type
of attack much more impractical.
The third thing we have to use is what's known as nonce.
Now, utilizing a nonce is a strategic way
to enhance the security of potentially vulnerable passwords.
Nonce, which stands for number used once,
is a unique often random number
that's going to be added
to the password based authentication process.
The primary function of a nonce is to ensure
that even if the attacker is able to get your password
or its corresponding authentication data,
they simply can't reuse it for unauthorized access.
By adding this transient number
to the authentication sequence,
your resulted hash data is going to change
every single time and make it significantly
harder for a cyber adversary to exploit stolen credentials.
This ephemeral approach is going to
add an additional layer of security,
especially in systems that are vulnerable
to replay attacks where the attacker attempts
to resubmit capture data for unauthorized access.
Finally, your systems need to be configured
to limit the number of failed login attempts
allowed for a giving user.
This will help to prevent password cracking attacks
against your accounts.
Normally, you want the number
of incorrect passwords entered
before locking out the account
to be set somewhere pretty low like three, that way,
if somebody enters the password incorrectly three times,
that account will automatically be locked.
Yes, this can become painful for your users
if they accidentally enter the wrong password to many times,
but it does increase the security drastically
and it does help to slow down an attacker
who's trying to guess the user's password
and break into your systems.
So remember, hashing can be attacked
through the use of pass the hash techniques
to reuse a password without cracking its hash first
or by using the birthday paradox
or birthday attack to create known collisions.
To prevent these types of hashing attacks
you should increase your security
of your hashing system by using key stretching, nonce
and limiting the number of incorrect login attempts.
Key stretching is a technique that's used
to enhance the security of stored passwords
by applying a hash function multiple times
and therefore making brute force attacks
much more time consuming
and computationally expensive for an attacker.
Nonces are unique values, often random numbers.
They're going to be used once inside
of a cryptographic operation to prevent replay attacks
by ensuring the repeated transactions
produce different outputs.
And limiting the failed login attempts
is a security measure that restricts the number
of incorrect login attempts
that a user can make within a given timeframe
and the goal here is to deter attackers
from continually guessing a user's credentials.
By implementing these techniques, our hash digest
and their associated data can be better protected
from threat actors
who may be targeting your enterprise networks.