CAPEC-55: Rainbow Table Password Cracking
Description
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Employ Probabilistic Techniques
Prerequisites
- Hash of the original password is available to the attacker. For a better chance of success, an attacker should have more than one hash of the original password, and ideally the whole table.
- Salt was not used to create the hash of the original password. Otherwise the rainbow tables have to be re-computed, which is very expensive and will make the attack effectively infeasible (especially if salt was added in iterations).
- The system uses one factor password based authentication.
Skills required
- LowA variety of password cracking tools are available that can leverage a rainbow table. The more difficult part is to obtain the password hash(es) in the first place.
Consequences
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Use salt when computing password hashes. That is, concatenate the salt (random bits) with the original password prior to hashing it.
Related weaknesses (CWE)
- CWE-261Weak Encoding for Password
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-521Weak Password Requirements
- CWE-654Reliance on a Single Factor in a Security Decision
- CWE-916Use of Password Hash With Insufficient Computational Effort
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-OTPOne-time Password1 shared
- D3-PWAPassword Authentication1 shared
- D3-PRPassword Rotation1 shared
- D3-SPPStrong Password Policy1 shared
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-CDPChange Default Password1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared