Cracking Passwords in Forensic Investigations - Scholarly ...

3.1.4 Password Strength: an Empirical Analysis
The researchers Dell‟Amico, Michiardi and Roudier (2010) conducted a study to
compare and evaluate the effectiveness of various password cracking attacks using
known datasets of passwords. The empirical analysis study was conducted to answer
the research question: “given a number of guesses, what is the probability that a state-
of-the-art attacker will be able to break a password?”(Dell‟Amico et al., 2010, p.1).
Based on the study, the researchers found the „diminishing returns‟ principle to hold
true. They found that weak passwords are cracked easily; however, as the attack goes
on, the probability of finding the correct passwords decreases. Dell‟Amico et al.
propose that the results of the study would help to evaluate the security of passwords
and serve as a basis for developing effective pro-active password checkers and
security auditing tools.
Dell‟Amico et al. (2010) discuss the importance of evaluating the resilience of
passwords to guessing attacks. The resilience can be measured by comparing the
number of guesses (i.e., the search space size) against the percentage of passwords
successfully cracked. The attack model used would determine the cost of each guess
for the attacker. Combining the cost of each guess with the size of the search space
would result in a cost-benefit analysis for guessing-based attacks on password
authentication systems. Dell‟Amico et al. also conducted a literature review of the
previous work done in the area. They compared search space size versus number of
cracked passwords using various attack methods, including dictionary attacks, brute-
force attacks, dictionary mangling, probabilistic context-free grammars, and Markov
chains. They conducted the experiments on three large datasets of passwords, which
differed in terms of application, domain, and user localisation.
The three datasets of passwords obtained by the researchers were the „Italian
dataset‟, „Finnish dataset‟ and „MySpace dataset‟. The Italian dataset contained
unencrypted passwords from an Italian instant messaging server running on the
XMPP protocol. The Finnish dataset contained a publicly released password set in
encrypted and unencrypted format from different Finnish forum websites. The
researchers considered the unencrypted passwords from this dataset for the purpose
of their study. The MySpace dataset contained disclosed passwords that were
37