Bashing The Hash: IBM X-Force On Password Follies

As the computing capacity and resources available to encryption-cracking hackers continues to increase, simple password security practices have all but lost their efficacy and are symptomatic of bigger picture identity and access management (IAM) problems. Citing research done on data in-house at IBM and industry statistics, researchers with IBM highlighted the deteriorating state of password security in the IBM X-Force 2012 Mid-year Trend and Risk Report it released today.

"It used to be that the cost to crack passwords with letter, number and punctuation combinations of more than eight characters, with the computing power that was available to the bad guys, was high enough to deter them," says Clinton McFadden, senior operations manager for IBM X-Force research and development.

[How are your web apps bringing databases under fire? See 10 Ways Developers Put Databases At Risk.]

Not so anymore. According to McFadden, IBM tracked market reports and customer stories that show an increasing number of large password stores targeted by thieves, even when the passwords are hashed with encryption mechanisms.

"The problem is getting worse," he says. "And as criminal products, uncracked passwords are worth more now because they're cheaper to crack."

The computational resources at just about any savvy hacker's disposal these days make it imperative to avoid slipshod password storage and encryption, IBM warned in its report. For example, creative use of Graphical Processing Unit (GPU) chips that are designed for first-person shooter games, but more fundamentally for "crunching huge batches of numbers repeatedly in quick succession," has seriously eased the burden of cracking large stores of passwords.

"Password guessing has even gone 'in the cloud,'" the report said. "By using a cloud service provider, it is quite inexpensive to rent an array of GPUs to crunch a task for a few hundred dollars an hour. These types of computations scale very well in parallel."

And other hardware-based products like Field Programmable Gate Arrays (FPGAs) are making it possible to guess over 1.7 million passwords per second, the report observed.

IBM examined the weaknesses of hashing alone, noting the speed with which researchers were able to crack the 6.5 million SHA-1 hashed passwords dumped online this summer from LinkedIn, recovering 90 percent of these in just a few weeks. These hashed passwords were not salted and with no random-added values thrown into the password string before encryption -- the speed with which the password's hashed values could be cracked was increased dramatically as a result.

Crypto experts have for a while now lamented the false sense of security hashing passwords without salts has engendered. Even when organizations do decide to take steps necessary to protect passwords in application environments, they often bungle it in execution, choosing to forgo hash salts.

"Adding a salt to a hash effectively lengthens the password, making it harder to brute-force the hash in order to derive the password; this also applies to brute-forcing multiple hashes at once, as each hash may use a different salt," says Daniel Jacobowitz, senior research engineer for BeyondTrust.

But even when organizations do salt their hashes, they can still go wrong by choosing to store passwords in the same table within a database.

"For additional security, consider storing the salt in a separate table or even a separate database only accessible by the authentication service," suggests Kenneth Pickering, development manager for security intelligence at Core Security.

Beyond the important minutiae that need be considered when it comes to properly storing and encrypting passwords, it is also critical for enterprises to look up from the microscope as well. Many of these issues are symptomatic of larger-scale IAM problems. Poorly executed password encryption could be a red flag of poorly centralized IAM controls. And the lack of multi-factor authentication and the enforcement of frequent credential refreshes to mitigate the risk when passwords are compromised likely betrays a lack of overarching IAM strategies in place.

"We constantly want to have this conversation with customers and with the industry because it's still not fixed," McFadden says, "and as we expose more data to the Web, we're not seeing a healthy adoption of some of these better security practices."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.