<body>

Hands-on Project 7-2

Date: Sunday, August 22, 2010


Hands-on Project 7-2 : Download and install a Password Storage Program



To begin with this hands-on project, I go to http://keepass.info/
This is a password storage program. You can understand more about KeePass below.

What is KeePass?
Today you need to remember many passwords. You need a password for the Windows network logon, your e-mail account, your homepage's FTP password, online passwords (like website member account), etc. etc. etc. The list is endless. Also, you should use different passwords for each account. Because if you use only one password everywhere and someone gets this password you have a problem... A serious problem. The thief would have access to your e-mail account, homepage, etc. Unimaginable.

KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. The databases are encrypted using the best and most secure encryption algorithms currently known (AES and Twofish). For more information, see the features page.


To download this program, go to Download.
For this practical, I downloaded the Portable Version



This is the downloaded zip file.



I unziped the file and here's the files it contain.
Click on KeePass.exe to launch the program.



Screenshot of KeePass opening screen.



To start with a new password database, we need a strong master password to protect all of the passwords in it.
Go to File>New and I see this "Create New Password Database" screen.
Enter the mater password.



After I create a new database, I add a entry to it.
As can see from the screenshot, I added my gmail account.



Lastly, I double click on the URL and go to gmail.com
I fill up the username and password by dragging those I entered into KeePass.

Reflection:
Through this practical I feel that KeePass is convenient and easy to use. It has simple layout, and small mouse-over pop up to guide users with what to do. It has a very useful function, random password generator. I tried to crack one of the passwords it generated with rainbow table (Hands-on Project 7-1), didn’t not manage to crack it.

However, it has a very serious weakness. As quote from the KeePass website:
If you forget this master password, all your other passwords in the database are lost, too. There isn't any backdoor or a key which can open all databases. There is no way of recovering your passwords.
I created the master password a day before I test it out with my gmail account. When I come back to KeePass, I could not remember the master password I set. (Mainly because I used a new and complicated password which I had never use before.) And I realize there's no way I can get it back. Now, not only can hackers not get into my personal information, but neither can I!


Although there's only one master password to remember, it is not guaranteed that all users will remember this strong, complicated password. Consider you were overseas for a few weeks and you did not use KeePass during this period, you can easily forget the password. If you just save everything (e-mail account, website account, online passwords etc), there's no way to get back your information, and KeePass is not going to do anything to help you. Thus, because of this, I will not use KeePass. The consequence of losing all my usernames, passwords and important account is unimaginable to me.

Labels: ,


林小颍's work ^—^V

Hands-on Project 7-1

Date: Saturday, August 21, 2010


Hands-on Project 7-1 : Use Rainbow Tables


Left: Download ophcrack-win32-installer-3.3.1.zip from http://ophcrack.sourceforge.net/
Right: unziped ophcrack-win32-installer-3.3.0.exe installation file



A screenshot of Ophcrack opening screen



Loading rainbow tables into Ophcrack



The table I have downloaded is XP free small, and I have loaded it into Ophcrack. ^_^



Screenshot http://www.objectif-securite.ch/en/products.php
I will be getting hash value of passwords from here.




Scroll to the bottom of Objectif Sécurité webpage and I get this XP Special Demo.
Enter a password, for example, 12345, and click on submit password.



I get a hash value for password of 12345 in return.



Load>Single Hash>Load Single Hash screen
I copied the hash value returned to Ophcrack.



Click on crack and it start cracking the hash value.
Time taken to crack 12345 is 13s


The picture below shows the result with the different passwords I tried with.

Password: 12345
Hash: aebd4de384c7ec43aad3b435b51404ee:7a21990fcd3d759941e45c490f143d5f
Time: 13s

Password: zxcv123
Hash: 84cf5065794faec1aad3b435b51404ee:aa6f4b6d557d69a9048d44a83054948d
Time: 5s

Password: Zxcv123
Hash: 84cf5065794faec1aad3b435b51404ee:80b9ff147bbf43518967a7bafe2c0031
Time: 6s

Password: Zxcv!@#456
Hash: 7768facc10e799b32ecdb8acb87b6d97:619c214a282ff2e0f58c1d21227f0851
Time: 1m50s

Password: 6812J-aHea*UkO
Hash: 8568e12c4bf323fd092546a3b896fce5:15ff49ef7c09044f6599321ffcac1a7f
Time: 4m


Reflection:
In this hands-on project, I downloaded and installed Ophcrack, which is an open-source password cracker program that uses rainbow tables. Rainbow tables is defined as an attack on a password that uses a large regenerated data set of hashes from nearly every possible password.

There are two steps to using rainbow tables. First, it requires creating the table itself. Next, that table is used to crack a password. However, for this practical, I do not need to create the tables myself; I download one that is already created. One advantage of using rainbow tables is that is it much faster than dictionary attacks, and the amount of memory needed on the attacking machine is greatly reduced. According to RamNet, Inc., while brute force took 1.6days to crack a 8-digit password of all letters, rainbow table takes only 28minutes. This shows rainbow table is more productive.
I tried to crack a password that is similar to my own password with rainbow table too.
Password: 6812J-aHea*UkO
Hash: 8568e12c4bf323fd092546a3b896fce5:15ff49ef7c09044f6599321ffcac1a7f
I created my passwords with a mix of letters, numbers and special symbols, and it is about 14 characters.  With reference to the last screenshot, the result shown is “not found”. Thus, I think my password is strong enough.

Labels: ,


林小颍's work ^—^V