2KKUU7ita

100
Part II: Putting Ethical Hacking in Motion
Countermeasures
The only true defense against weak authentication is to ensure your operating
systems require a password upon boot. To eliminate this vulnerability, at
least upgrade to Windows 7 or 8 or use the most recent versions of Linux or
one of the various flavors of UNIX, including Mac OS X.
More modern authentication systems, such as Kerberos (which is used in
newer versions of Windows) and directory services (such as Microsoft’s
Active Directory), encrypt user passwords or don’t communicate the passwords
across the network at all, which creates an extra layer of security.
Cracking passwords with high-tech tools
High-tech password cracking involves using a program that tries to guess a
password by determining all possible password combinations. These hightech
methods are mostly automated after you access the computer and password
database files.
The main password-cracking methods are dictionary attacks, brute-force
attacks, and rainbow attacks. You find out how each of these work in the following
sections.
Password-cracking software
You can try to crack your organization’s operating system and application
passwords with various password-cracking tools:
✓ Brutus (www.hoobie.net/brutus) cracks logons for HTTP, FTP,
telnet, and more.
✓ Cain & Abel (www.oxid.it/cain.html) cracks LM and NT
LanManager (NTLM) hashes, Windows RDP passwords, Cisco IOS and
PIX hashes, VNC passwords, RADIUS hashes, and lots more. (Hashes are
cryptographic representations of passwords.)
✓ Elcomsoft Distributed Password Recovery (www.elcomsoft.com/
edpr.html) cracks Windows, Microsoft Office, PGP, Adobe, iTunes, and
numerous other passwords in a distributed fashion using up to 10,000
networked computers at one time. Plus, this tool uses the same graphics
processing unit (GPU) video acceleration as the Elcomsoft Wireless
Auditor tool, which allows for cracking speeds up to 50 times faster. (I
talk about the Elcomsoft Wireless Auditor tool in Chapter 9.)
✓ Elcomsoft System Recovery (www.elcomsoft.com/esr.html) cracks
or resets Windows user passwords, sets administrative rights, and
resets password expirations all from a bootable CD.