6

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force attacks. Based on my experiences with John The Ripper, I doubt that repeating a pattern in a password would shorten the time to successfully brute force a password like f00B@rf00B@rf00B@r as opposed to a random string of equal length. However, my doubt is based on the fact that, according to the documentation, JTR does not include a specific attack mode for repeating patterns. JTR, and presumably other brute force tools, can be customized for any arbitrary attack mode. But we can't know how often attackers bother to customize attacks in this way. So then the question becomes mathematical. Please forgive the awkward pseudo mathematical notation.

T = brute force cracking time

PL = pattern of characters of length L

N = number of times PL is repeated

R(LN) = string of random characters of length (L times N)

Would it be true that

T(PL*N)= T(R(LN))

If true, then a repeating pattern password would not affect brute force cracking time. But is it true?

  • 1
    Take a look at Hashcat if you want brute force by a known pattern! – Henning Klevjer Oct 13 '12 at 20:47
  • 1
    And the mathematical assertion will be true, indeed, if there is no prioritizing of repeated patterns over random letters. I think John runs incrementally through the character space, and with hashcat you can guess on a pattern. This helps if the password policy is bad enough to restrict the password to contain e.g. three numbers at the end, or "not begin with a number". Although rare, these rules can appear.. – Henning Klevjer Oct 13 '12 at 21:02
  • It now occurs to me that, although it sounds like the mathematical assertion would be true, a patterned password would have a much smaller keyspace. For simplicity, lets assume that you've got two passwords made up of only the five vowels, upper or lowercase. That makes 10 possible letters. The patterned password, with a four character pattern, would, if the pattern were repeated five times, be a 20 character password with a keyspace of (10^4)*5 = 50,000 combinations. But a 20 character password, even if constrained to 10 possible characters, would have 10^20 combinations. Sound correct? – Luke Sheppard Oct 14 '12 at 16:05
  • 1
    That sounds about right. This is what we call a low-entropy password. Very simply put, entropy is the degree of "randomness" in your password. If the password is restricted by rules, the entropy level drops. – Henning Klevjer Oct 14 '12 at 18:28
9

There are three scenarios here:

Attacker has no knowledge of the pattern scheme:
When the attacker has no knowledge of the patterns, the brute-force attempt will have to be exhaustive. The attacker gains no practical efficiency improvement, because there is no way of him knowing the construction of the password.

Attacker has some or full knowledge of the pattern scheme:
If the attacker has knowledge of the patterns, they may improve the efficiency of their bruteforce attack by not attempting passwords that do not match the pattern scheme.

Attacker has no initial knowledge of the pattern scheme, and multiple hashes are available:
If the attacker has no initial knowledge of the pattern, but has a number of different password hashes to crack (all of which use the same scheme for the password) he may crack a small number of them via exhaustive bruteforce, then deduce the pattern. From there, the attack becomes much more efficient.

5

The knowledge of the password pattern could give you really speed-up in the brute-force method. If you know, that brute-forcing password is a repeating pattern password, you can reduce the cracking time.

If you know, that the password consists of N the same parts, then, all you have to do is find that part. So to speed the cracking process up, you need to add a few lines into your brute-force function. Let's say that the brute-force algorithm checked if your password is abba. Before you let it go to the another step (checking abbb), you should "glue" that try and check passwords like abbaabba, abbaabbaabba and so on.

  • 3
    I suppose OP's question is: If one has no knowledge whatever at all of a password and that password does have, say, a repeating pattern, whether that shortens the cracking time. Patterns could be of very diverse kinds, it could be abba..., and also abab..., etc. etc. and it would be, I am afraid, rather difficult for a cracking software to know which particular pattern or patterns to try. – Mok-Kong Shen Oct 13 '12 at 20:40
0

Most of the answer has been provided by @Polynomial. But however, I will add another angle to it.

Brute forcing of a password is a process where the attacker randomly guesses the password based on an existing history of passwords or through other statistical methods. Having said that, it becomes evident that if the victim (upon whose machine the Brute forcing is carried out), whether he uses a repeating pattern or a random string of characters will not matter to the attacker because he/she is not aware about it (considering that the attacker knows nothing about the victim's password policy).

A script kiddie or a hacker will definitely give up with his/her attempt, if the password takes a very long time to crack. Only a serious hacker would take up this task.

Also, statistics can infer from past records and suggest that users are most likely to use certain alphabets, symbols, or numbers within their passwords. But having repeated characters, jumbling up the order of repeating the patterns, will definitely make the task slightly easier for the hacker. But again, the question will be one based on probability, which the hacker will take time to ascertain.

I believe repeating the characters, jumbling them up with other random characters, and then changing the entire password after a definite period, will definitely provide a similar security posture to the victim as in the case wherein he/she uses a random string of characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.