CSC 400 Assignment: Password Cracking Competition
CSC 400 Assignment: Password Cracking Competition If you have not already, read the man page on the libc crypt function as implemented on our department Unix installation. Use this function, web resources, possibly department computational resources, and anything else you can get your hands on without annoying department personnel or bringing the law down on us, to mount an attack on the encrypted passwords in the file password18_cipher.txt. which will be posted on assignment day. (The correct file will not be present prior to class on assignment day)
Many of these passwords are poorly chosen, i.e. they are short, or one or more words, or names, or minor variations thereof, or potentially guessable because they are TOOOO clever, or the prof. repeats himself, or all of the above. (No guarantees about only lowercase letters being present though). See how many you can find out of the list of 190 or so.
Stealing or sharing classmates results is specifically disallowed in this assignment, as is cracking the professor's account. The intent is that you do some programming of your own, so use of fully canned password crackers is discouraged, as are pre-encrypted dictionaries (although it could be interesting to compare how well you do with the performance of canned crackers). Use of text dictionary resources on the other hand, is encouraged, and probably necessary to complete the assignment in a timely fashion.
As usual, document all of the resources you use. Note that the crypt function does not run all that fast (deliberately), so you may have to allow considerable time for your program to run. Or you may be able to find a faster version of crypt. Note that other class members will be running their programs in the same period, so don't count on having exclusive access to the cluster or SMP resources. Also, if you bog down real research computation, there will be blood...
Next class, you will give a short presentation describing your approach(es) and results. As usual, hand in a written report.
BTW, in June 2012 a large encrypted PW file was stolen from LinkedIN. 8-Character passwords had been encrypted WITHOUT SALT using MD5. The attackers quickly broke all 7 Million passwords they had, and published them on the internet. Clearly someone did not take this class...
And just last year (9/2016) it was announced 500 million account records were stolen from Yahoo (way back in 2014) Users were encouraged to change their passwords... After two years, that's kind of like going to shut the barn door after the horse has escaped and run to Massachusetts and sired 300 illegitimate foals and the barn has been struck by lightning and burned to the ground and the owners have taken the insurance money and moved to the Cayman Islands...
In June 2017, most of Yahoo's Internet assets were sold to Verizon for the fire sale price of $4.48 billon. (In 2008, Yahoo rejected a bid by Microsoft to buy it for $44.6 billion) And just this week (10/2017) it was revealed that ALL 3 BILLION Yahoo acounts had actually been compromised in the 2014 attack... which may have actually occured in 2013... and may have involved Russian bad actors...