syssec_red_book

7. Authentication and Authorizationeight character-long, NTLM-encrypted passwords in just about five hours [60].Yet another approach involves using cloud resources to quickly crack varioustypes of hashes [9]. If a salt is not used, cracking can be accelerated further byemploying rainbow tables [374].Once passwords are cracked, the attacker can do any of the following:• Access all information stored in the service by other users.• Steal the identity of a victim or impersonate them.• Incriminate the user by carrying out questionable activities using theirprofile.• Escalate to more valuable assets. For example, accessing a victim’s webe-mail might be sufficient for compromising their e-banking account.7.4 What Is the Worst That Can Happen?A cautionary tale that shows what can happen when multiple services areinterconnected, all using weak authentication mechanisms, is the epic hack ofMat Honan, a reporter working for Wired.com. In his own words [212]:In the space of one hour, my entire digital life was destroyed. Firstmy Google account was taken over, then deleted. Next my Twitteraccount was compromised, and used as a platform to broadcastracist and homophobic messages. And worst of all, my AppleIDaccount was broken into, and my hackers used it to remotely eraseall of the data on my iPhone, iPad, and MacBook.However, although Mat Honan experienced the dramatic consequencesof password theft, and eventually of losing control over his digital assets, hemanaged to sustain his quality levels along many critical dimensions. First, hedidn’t suffer from critical financial loss. Second, the health of his life was notin danger, and, third, he didn’t face heavy incrimination, connecting him withillegal actions and eventually making him face, wrongly, the consequencesof violating the law. Mat Honan may managed to escape from such seriousdangers because he was already famous, and he was more of a victim of a badprank, than a targeted attack.Nevertheless, password theft and, eventually, identity theft can lead to verybad consequences along all the above three dimensions. First, it is reportedthat financial loss from identity theft is increasing [19]. Note that the reportstates that year by year less people are victims, but the loss is greater. Second,although there are no reported cases of identity theft that can lead to lifethreateningsituations, a lot of medical data are stored on-line, and passwordtheft can lead to privacy leaks associated with the health’s condition of a victim.54