Running Head: Lab Assignment: Password Cracking Using Cain and Abel

Lab Assignment 1: Password Cracking Using Cain

University of Maryland University College
Fall 2015

Lab Report

Provided below is a table of the different generated user accounts and their accompanied passwords, along with the methodology used to crack each and either the time it took to reveal the password or estimated time provided by Cain and Abel to generate a successful solution. NTLM HASH | | Brute Force | Dictionary Attack | User 1 | No result, due to estimated time > 4yrs | Password cracked in < 1min | UUser 2 | No result, due to estimated time > 4yrs | Password cracked in < 1min | UUser 3 | No result, due to estimated time > 4yrs | No result. Estimated Time > 3hrs. |
Table1: NTLM password cracking results

LM HASH | | Brute Force | Dictionary Attack | User 1 | Password cracked in < 3min | Password cracked in < 2 min | User 2 | Password cracked in < 3min | Password cracked in < 1min | User 3 | No result, estimated time >3hrs | No result, I stopped it after 5 min. |
Table2: LM password cracking results

1. Explain the two different types of attacks that can be performed in Cain and Abel to crack user account passwords. Which do you think is the most effective and why?
A dictionary attack uses a file containing words, phrases, common passwords, and other strings that are likely to be used as a password. Each word in the file is hashed, and its hash is compared to the password hash. If they match, that word is the password. These dictionary files are constructed by extracting words from large bodies of text, and even from real databases of passwords. A brute-force attack tries every possible combination of characters up to a given length. These attacks are very computationally expensive, and are usually the least efficient in terms of hashes cracked per processor time, but they will always eventually find the password.
When it comes to effectiveness, brute force attack’s time to complete is greater, but there is greater coverage of likely cleartext value. On other side, the execution time of dictionary attack is reduced because the number of combinations is restricted to those on the dictionary list. Brute force attack will discover the password; however, it could take very long to try all possible combinations. I will start with the dictionary attack and if it fails I will move to the brute force attack.
However, for this exercise, the Dictionary attack using NTLM was the quickest to reveal the entire password – nearly half the time when compared to the LM method. 2. Compare and contrast the results from the two methods used to crack the accounts for the three passwords each encrypted by the two hash algorithms. What conclusions can you make after using these two methods?

Provided below is a table of the different generated user accounts and their passwords, along with the methods used to crack each account with time it took to discover the password. | User1_cyber | User2_cyber4 | User3_C$ber$% | Dictionary NTLM | YesTime< 1min | YesTime< 1min | NoTime> 5min | Brute Force NTLM | NoTime> 4 yrs | NoTime> 4 yrs | NoTime> 4 yrs | Dictionary LM | YesTime< 2min | YesTime<2min | NoTime> 5min | Brute force LM | YesTime<3min | YesTime< 3min | NoTime~3hrs |
Table3: Cain & Abel Password Cracking Results
With respect to all methods used, the Dictionary method with the NTLM hash was the most successful based on the amount of time required to generate a solution – this method revealed all passwords and was the quickest path to success. The least effective method was estimated to be the Brute Force attack with the NTLM hash. Both Brute Force attacks did not reveal the password in a reasonable amount of time and the estimates, based on Cain and Abel projections, were measured in years. I can conclude that the Brute Force attack was the least effective type of attack in this exercise and the Dictionary attack was more successful. However, it appeared that the LM method would’ve been more effective via Brute Force based on displayed projections, whereas, the NTLM hash method was more effective within the Dictionary attack.
In light of the outcomes from this lab, the Dictionary attack utilizing LM or the NTLM hashes may be an effective strategy for uncovering user passwords on more established Windows frameworks with powerless security approaches set up. Moreover, from the point of view of a person protecting frameworks, using password authentication protocols LM and NTLM, are inclined to abuse and in this manner strong password generation rules and more current security protocols ought to be utilized to secure a system. 3. Research another algorithm used to store passwords that were not discussed here. (Include references in APA format.)
In the laboratory experiment, both the LM and NTLM algorithms were featured to show case vulnerabilities. There are other algorithms available for password encryption besides the aforementioned LM and NTLM hashes, including SHA-224, RIPEMD-320,and MD5. Specifically, MD5 was published in 1992 under RFC 1321 and as of 2008 is no longer considered secure as the United States government states that, “it should be considered cryptographically broken and unsuitable for further use” (Vulnerability,2008). Collision vulnerabilities were published in 1996, the practical ability demonstrated in 2004, and in 2005 the vulnerability was demonstrated which finally rendered this methodology obsolete (Vulnerability, 2008). As of March 15, 2006 federal agencies recommend using he SHA-2 family of hash functions “for all applications using secure hash algorithms” (NIST, 2005).
References:
NIST’s Policy on hash functions. (2005, April 15). National Institute of Standards and Technology Information Technology Laboratory (NIST). Retrieved September 26, 2015 from http://csrc.nist.gov/groups/ST/hash/policy.html
Vulnerability note VU#836068: MD5 vulnerable to collision attacks. (2008, December 30).US-CERT (United States Computer Emergency Readiness Team). Retrieved September 26, 2015 from http://www.kb.cert.org/vuls/id/836068 4. Research another password recovery software program and provide a thorough discussion of it. Compare and contrast it to Cain and Abel. (Include references in APA format.)
There are a variety of windows password recovery tools: Ophcrack, LCP, Johnthe Ripper, ntbf, lmpf, Rainbow Crack, and Mdcrack.
Ophcrack is fast and easy to use even for a user with basic Windows skills. It works well with Windows 7/Vista/XP and does not require any installation. The only downside of this tool is that you need to download the Live CD ISO and it doesn't support Active Directory password recovery for domain controllers. Ophcrack cracks Windows passwords by using LM hashes through rainbow tables. The program includes the ability to import the hashes from a variety of formats, including dumping directly from the SAM files of Windows. On most computers, ophcrack can crack most passwords within a few minutes (Fisher, 2015). It is called time-memory tradeoff cracker because it relies on precomputed hash tables already in memory, so by sacrificing the memory, the password cracking time is drastically decreased (Rogers, 2005).
Unlike Ophcrack and other popular Windows password recovery programs, Cain & Abel requires access to Windows under an administrator account. In fact, Cain & Abel is a bit more complicated to use than other password recovery tools which is usually unavailable for Windows Vista as is said. If you have no way of getting in to your Windows PC, you will not be able to use Cain & Abel to recover Windows password. Moreover, before you can use Cain & Abel, you'll need to download a rainbow table. These large databases of passwords are required so Cain & Abel can reset the forgotten windows password.
References:
Tim Fisher, Free Windows Password Recovery. Retrieved September 26, 2015. http://pcsupport.about.com/od/toolsofthetrade/tp/passrecovery.htm
Rogers, R. (2005). Network security evaluation using the NSA IEM. Rockland, MA: Syngress. 5. Anti-virus software detects Cain and Able as malware. Do you feel that Cain and Able is malware? Why or why not?
Several different anti-virus and malware sniffing software packages recognize Can and Abel as malware because of the potential harm that it can cause. Much like most security applications on the market, they can be used to test vulnerabilities and expose them to IT system administrators. However, this same tool, in the hands of a black hat security expert can be used for nefarious purposes. Consider them as dual use applications and depending on the person and intent, it can be used legally to expose security flaws or illegally to exploit security weaknesses.
I would surmise that most security specialists see this program as a terrible thing to have on the system, since nobody, outside of selected inner IT experts inside of an organization, ought to have entry to or utilize this application. In this way, on the off chance that someone inside the network was found to have this tool or utilizing it, this would be viewed as a security breach. In the event that the network administrator is utilizing this application on a month to month premise to test for shortcomings, they would be working it as a white hat and are utilizing the instrument as it was proposed. as it was intended. Ultimately, it should be revealed in an anti-virus search and the network administrator should know, based on the machine it is loaded on, if Cain and Abel is planned for damage or security testing. At last, if the right security conventions are set up and upheld, Cain and Abel is simply an approach to guarantee great security practices are held fast to. In the event that Cain and Abel uncover security openings inside of the system, it can be accepted that somebody, with access and means, can see the same gaps that a security expert can see when utilizing it.