In this lesson, we're going to take a look
at some OS-specific security logs, and specifically,
we're going to be looking at two different examples
so you can determine what kind of password cracking
is being used on that system.
Now, in this example, I'm going to create a very generic log
that is not specific to any specific operating system
like Windows, Mac, or Linux,
but the concepts will be exactly the same.
And on the exam, you'll see something like this
as opposed to a Windows security log
if you get a question about this concept.
Now, when you look at a OS-specific security log,
you're going to be able to look through the security logs
and see what type of things have been happening,
such as failed login attempts, incorrect number of attempts
to log in over multiple times, and in some cases,
even with the password being attempted for that login was.
So that's what we're going to be looking at here.
So we're going to determine two types
of password cracking attempts and distinguish between them.
Now, the first one we're going to look at here
is going to be a very simple log that shows the time,
the user taking the action, the event,
the IP address of the machine trying to log in,
the status, and the details.
When we start looking at this log, we first see the time,
and we see that this happened at 16:45 in the afternoon,
and at 1 second, 3 seconds, 5 seconds,
7 seconds, 9 seconds, and 11 seconds.
So essentially every two seconds,
this user, jdoe, was trying to log into the system.
We see the event was a login attempt.
We see where they were trying to log in from,
in this case, 192.55.233.89,
and the status of failed for all of them.
Then we see the detail, and on this system,
they're actually logging in using a smart card with a pin,
and that pin will be a six-digit unique code to that user.
So somebody may have gotten a hold of this person's
smart card and tried to log in as if they were them
by guessing these pins.
So they started out with 1, 2, 3, 4, 5, 6.
Then they went to 1, 2, 3, 4, 5, 7,
1, 2, 3, 4, 5, 8,
1, 2, 3, 4, 5, 9,
1, 2, 3, 4, 5, 0, and after the fifth attempt,
that account was actually locked out
for failing to log in incorrectly too many times.
Also, we then generate an alert to the admin
to let them know that this user, jdoe,
had their account locked because of
this failed login attempt five times in a row.
So what are we seeing here based on these pins?
What kind of a password cracking attempt
do we think this is?
Well, if you see this, they all were incrementing
one each time, which is really a good indication
of a brute force style attack.
Another indication of a brute force style attack
would be if you see a lot of numbers, letters,
and symbols that just look very random,
because that way the system is just generating things
and throwing it at this password
and trying to see if it can get in.
That's the idea of using a brute force attack.
Let's take a look at the second one.
The second one we have is in a very similar format,
and you'll see we just changed users here.
Now we have msmith trying to log in,
and again, they tried five times in a row
from that same system at 192.55.233.89,
and all five times, they were failed.
When we look at the passwords they tried,
they were using common words like puppy, and baseball,
and cupcake, and companion, and loved,
and after the fifth time wrong,
this ended up locking the account
and then a notice was sent to the administrator
letting them know that this account
for msmith was locked as well.
Now, based on this using common words,
what kind of attack do you think this is?
Well, this is a dictionary-based password attack,
because they're using common dictionary words.
Now, on the exam, you'll see something like this
where they're using common words
or common words with a little bit of flare,
like using something like puppy1 or baseball,
but replacing the A with an at sign
and the S with a dollar sign.
If you see that, this still means it's a dictionary attack
because we're using common dictionary words
or variations of those that we would find
inside of a hacker's dictionary.
So keep that in mind as you're reviewing your security logs.
Most of the time when you're dealing
with a security log on the exam,
it's going to be focused on passwords and password cracking,
and whether you're using a dictionary-based attack,
or a brute force attack, or some kind of hybrid of the two.
But as I said, most of the time it is going to be a dictionary
or a brute force attack, so keep that in mind for exam day.