Do password crackers / brute-force attacks put a higher priority on "picture-passwords"?

Question

Some time ago I saw a post on reddit about someone with the seemingly very random username "78523965412369874123":

If you trace those numbers on a usual keyboard-numpad, it spells out a swastika with a box around it.

I know from the Android pattern lockscreen, that there exist 389112 lockscreen combinations for a 3x3 matrix.

Edit: You should keep in mind that the pattern lockscreen has some limitations like the pattern needs to be one continuous movement, jumping therefore is not allowed. In the swastika-example the user indeed can jump, start new etc. so the possible combinations should be far higher.

Calculation:

Moves = 4, combinations = 1624
Moves = 5, combinations = 7152
Moves = 6, combinations = 26016
Moves = 7, combinations = 72912
Moves = 8, combinations = 140704
Moves = 9, combinations = 140704

Total possibilities: 1624 + 7152 + 26016 + 72912 + 140704 + 140704 = 389112

It turns out, that users tend to prefer visually appealing passwords, which are easy to shoulder-surf and also easy to guess based on smudgepoints since they give you a possible start- / endpoint, which drastically reduces the search-space.

Back to the swastika: Since people tend to use visually appealing passwords, would a password-cracker or brute-forcer put a higher priority on those "visual passwords" on a keyboard or a numpad?

Are there lists for that?

Should I advise people in my company to not use visual passwords that represent something? Because most of the passwort guidelines focus on not using dictionary-words or widespread terms.

Edit 2:

My question is not limited to the numpad. Every device that you can type on should be considered.

Visual passwords might be much longer than usual passwords, that you find in a dictionary. Since you "paint" them and only have to remember the visual form, I think that there could be passwords with 20 digits or more.

A brute-forcer usually would not check those long passwords, but if there would be a list of "typable visual forms", suddenly a brute-forcer might be able to check really long words, since there are only so many visual forms that you type on a keyboard.

See example here:

This example spells out "Cool!", which would look like this if typed:

EWAZXTRDCVGYGBNJUIK,.P;/ - 24 symbols.

PS: I am not a native english speaker and I'm not very satisfied with the terms "picture-passwords", "visual passwords", ... but despite researching beforehand I did not find a more fitting name for what I mean. Is there a better one? Should I change the title of my post?

Answer 1

So if I may restate what you're asking, you would like to know a prioritized order of things-to-guess that you would place ahead of brute force sequential or random password guessing. Additionally, you would like to know if anyone has done this yet for pattern-based passwords, and found an optimal place for them in the priority of password searching tools.

The answer is two-fold. Yes, people have long created prioritized orders of password values to guess first. 20 years ago, "crack" supported drawing from several types of lists to facilitate efficient guessing; in order I recall:

1. Dictionary of previously cracked passwords
2. Modifications to previously cracked passwords
3. Dictionary of common passwords
4. Modifications to common passwords
5. Dictionary of all English words
6. Modifications to dictionary words
7. Brute force sequential search

The previously cracked passwords were any passwords recovered from a prior run of the tool, based on the evidence that people on a system often just alter the same passwords with simple rules, such as increasing the last digit, etc. The common passwords were published lists of passwords recovered from hacks and surveys.

Password modifications included things like substitution rules, such as "add a digit from 0-9 to the end of the word", "add a symbol to the end of the word", "substitute @ for a", "substitute 0 for o", etc. The modifications could be customized to each dictionary; the idea being that the previous password list was very short, and therefore more CPU time could be spent on many combinations and permutations of those passwords than of variants of random dictionary words. (Back then, CPUs were far more limited than they are today.)

To be more specific in your instance, I'm not aware of any pattern-based password generators that could be plugged into a toolchain, but that doesn't mean they couldn't exist.

However, if pattern-based passwords are as common as you theorize, then those patterns of digits or letters should show up in the passwords revealed in several of the recent breaches; as they would be treated the same as any other password in the database. If they were truly common, the password count would increase for them and the most common would float towards the tops of the lists.

We have long seen that some patterns do appear in the common lists: 123456, qwerty, etc. So one argument is that we may not have to do anything special to support the fancier patterns, because we have evidence that they will naturally float themselves to the top to be revealed in the next major breach.

But that doesn't mean your idea is invalid. If you begin to work on this, I'd recommend testing your code against a public database of leaked passwords. Depending on how many you find, it might be a very valuable resource, or you might find that the practice is less common than you thought.

Answer 2

They very well could.

Actually it depends on the content of the dictionary of the cracker. The person that handles the cracking will (as you probably know) start with a dictionary of real words and known passwords, then once the dictionaries have been exhausted, the hacker will start using masks before doing a real brute-force attack.

So now that you put this post here, more hackers will add such "known passwords" in their dictionary. If I was one, I would - right now :)

Now it depends on the person cracking the hashes : they don't have the same dictionaries.

Answer 3

It's not the password cracker that puts prioritization on "visual passwords" but the rainbow table used.

Rainbow Table (definition)

The emphasis for an attack is based on two things, what hash/encryption your braking (e.g MD5, SHA1. SHA2) and what attack pattern you are trying to break (e.g Alphabetic, Numeric, Alpha-Numeric, Alpha-Numeric /w Symbols). This is usually expressed in entropy based on the number of available symbols one can use to create a password.

Password Physiology (definition)

This is basically the study of why we select bad passwords, and you can find a lot of research around the subject. Patterns are very common in much of what most people do.

A simple example of this is:

qwerty

which if you look at you keyboard is pretty obvious. There are many patterns related to this sort of behavior, such as

1qa2ws3ed
123qweasd
/.,mnbvcc
-[0p9o8i7

Too many password systems, those are moderate passwords, but if you type them on the keyboard, you will see the simple logic behind them.

Password Lists

Since I don't plan on showing you how to go about purchasing and or acquiring these lists (not that Google couldn't get you stared), I think any penetration tester would agree, you start with the basics (e.g. A Rainbow table with the 1200 most common passwords) and your alter it based on the target.

Summary

OOTB crackers like JTR use general attack lists, or brute force in guessing passwords. Many crackers can be supplemented with user defined lists which would put the emphasis on patterns of your choosing. Your theory of patterns is actually how many password lists are generated, because people actual study how people create passwords. We don't see things like your swastika example much, because probability doesn't weigh in favor of other more common attack patterns.

Answer 4

Back to the swastika: Since people tend to use visually appealing passwords, would a password-cracker or brute-forcer put a higher priority on those "visual passwords" on a keyboard or a numpad?

Are there lists for that?

They could be generated programatically with some statistics. But what's the point? Why would you limit your analysis to this particular attack?

A list of common passwords will already include all common "patterny" passwords, and it would be easy given the keypad/keyboard layout, to compute different rotations of them.

This would be a combined dictionary/bruteforce attack, where you take your dictionary and compute different variations on its elements.

When people talk about dictionary attacks, the attackers aren't literally using a dictionary. It's preferrable to use a list of previously known common passwords. These lists are usually built from previous breaches, like the linkedin breach that made the frontpages this year.

Also, checkout this paper from University of Cambridge. While focused 4-digit pins, the same principles could be applied to larger numbers.

Keep in mind that numeric-only passwords are usually PINs, where there are additional protections in place to compensate for the low entropy inherent to this kind of input:

• increasing delay between each failed attempt
• max number of attempts before getting locked out
• risk-analysis and other heuristics

Should I advise people in my company to not use visual passwords that represent something? Because most of the passwort guidelines focus on not using dictionary-words or widespread terms.

The correct answer depends on your threat model, but again you'd be better served by simply banning common passwords which would already include the "patterny" ones if they're common enough.

Since we're at it, be careful with your password policy. Find a good balance between usability and security, or you'll end up losing security when your users start writing down their passwords on post-it notes under the keyboard.

Answer 5

Some years ago, when MySpace was still in vogue (but nonetheless in decline), a social application site that extended social networks (including MySpace) was hacked, revealing the usernames and passwords of over 30 million accounts. An interesting consequence of the hack was that, once the list was later made available, security researchers suddenly had a huge body of data available to them about users' password selection habits. 32 million is a pretty huge and exhaustive sample, and many password crackers are configured to first search out patterns and passwords that the RockYou attack revealed to be common.

Doing research into what passwords produce "pictures" would be a larger amount of work than it would be worth when you already know from previous experience -- experience from the the RockYou hack in particular -- that users aren't likely to use that method.